Cookie Notice
What ITA.TO stores in your browser, when, and how to change your mind. Last updated 29 October 2026.
Only the necessary items below are used until you choose. Everything else is off by default and starts only if you accept it, and you can withdraw at any time using “Cookie settings” in the footer of every page. Standard marketing pages have no analytics or advertising scripts configured. An optional, separately enabled /t/ advertiser gateway is described below.
Cookies and browser storage
| Name | Category | Purpose | When it is set | How long |
|---|---|---|---|---|
itato_consent | Necessary | Remembers your cookie choices so we do not ask again and can honour them. First-party; readable by the page so the banner can show your current choices. | When you make a choice in the cookie banner | 180 days |
itato_session( __Host-itato_session in production) | Necessary | Keeps you signed in, protects forms against cross-site request forgery, and shows one-time messages. First-party, HttpOnly, SameSite=Lax, Secure in production. | When you open a sign-in, registration or account page, or a protected access page that contains a form. It is not set when you only follow a short link, scan a QR code, read the public information pages, or record a cookie choice (unless you already have one). | Until you close your browser |
itato_device( __Host-itato_device in production) | Necessary | Lets us recognise a browser you have signed in from before, so we can email you if your account is used from a new one (security). Holds a random value that is stored on our side only as a one-way hash, and no personal information. First-party, HttpOnly, SameSite=Lax, Secure in production. | When you sign in successfully. | 1 year |
hc_<page code> | Necessary | Set only when a visitor presses "Get my code" on a coupon page: it remembers the code they were given, so reloading the page shows the same code instead of giving out another. Holds the code only. First-party, HttpOnly, SameSite=Lax, limited to that one page. | When a visitor claims a coupon. | 90 days |
itato_ab_<number> | Functional | Remembers which version (A or B) of a destination you were shown, when a link owner has switched on an A/B test, so you see the same version each time. Holds only “A” or “B”, with no personal identifier. First-party, HttpOnly. | Only if you accepted Functional cookies and open a link that has an A/B test. Without consent no cookie is set and you may see either version on each visit. | 30 days |
itato-theme (local storage) | Functional | Remembers your light or dark choice. Stored on your device only; never sent to our servers. | Only if you accepted Functional cookies, when you press the theme button. Without consent the choice applies to the current page only. | Until you clear your browser data or withdraw consent |
itato_internal_<number> | Functional (set at your request) | Marks this browser as belonging to a workspace member so visits from it are left out of that workspace’s statistics. Holds a signed value tied to one workspace, with no personal identifier. First-party, HttpOnly, SameSite=Lax. | Only when a signed-in workspace owner or administrator presses “Don’t count this browser” in Settings › Internal traffic. It is never set by following a link or scanning a code. | 1 year, or until you press “Count this browser again” |
Things that do not use cookies
Following a short link or scanning a QR code sets no cookie. Link health checks and AI explanations do not use cookies either.
Optional customer advertising gateways
Customers can separately enable /t/ URLs for individual, eligible short links. Those pages ask whether you want to load named Meta, Google Ads or TikTok tags. No advertising tags are loaded until you actively select Allow and continue to the approved page. You can always continue without choosing Allow. A choice is not remembered across visits. Our choice record stores the link, advertiser categories, your selection and time, not a visitor identifier or IP address, and is deleted after 365 days by the daily retention job.
After you allow, the named advertising vendors can set or read their own advertising cookies or similar technologies. Their precise cookie names, purposes, transfer arrangements and retention periods depend on the vendor and the customer's configuration and should be explained in the advertiser privacy notice linked from the choice page. This is separate from our ordinary ITA.TO cookie banner. You may block/delete vendor cookies in your browser or contact the advertiser using the linked notice to exercise rights or withdraw future advertising use. Standard /alias redirects never load customer advertising tags.
How your choice is recorded
When you choose, we keep a record so we can show that your choice was respected: a random identifier held in your consent cookie, the time, which categories you accepted, the banner version and the page you were on. We do not record your IP address or browser details in this record, and it is not linked to an account. Records are kept for 730 days.
Google Consent Mode
Before you choose, every Google consent signal (ad_storage, analytics_storage, ad_user_data, ad_personalization, and the functionality and personalisation signals) is set to “denied”. They change only when you accept, and are set back to “denied” if you withdraw.
Third parties
- Cloudflare Turnstile is used on some forms (such as sign-in and registration) to stop automated abuse. It loads from
challenges.cloudflare.comand may set its own cookies or storage as described in Cloudflare’s policies. We treat this as necessary for the security of those forms. Where the service is delivered through Cloudflare’s network, Cloudflare may also set security cookies. - Stripe hosts the payment and billing-portal pages you are sent to when you subscribe or manage billing. Stripe’s own cookie policy applies there.
Controlling cookies in your browser
You can also block or delete cookies in your browser settings. Blocking the session cookie prevents you from signing in. Following short links and scanning QR codes works without any cookie.
Changes and contact
If we add cookies or tracking technologies we will update this notice and ask you again. Questions: privacy@ita.to. See also the Privacy Notice.