Cookie policy
Last updated: 28 October 2026
What a cookie is
A cookie is a small file a website stores in your browser when you visit. It exists to remember something between one page and the next: that you are signed in, which language you want to read in, or that you have been here before.
They do not all do the same thing. Some are essential for the service to work and cannot be turned off without breaking it. Others measure the audience of the site or tell us which adverts bring visits; those are only set if you accept them, with a single exception explained in the next section, and you can change your mind at any time.
How we ask for your permission
The first time you visit the marketing site a notice appears at the foot of the screen with three buttons: "Settings", "Accept" and "Reject". Accept and reject each take a single click, without going through "Settings".
There are two categories you can accept or reject separately under "Settings": analytics, which is Google Analytics and PostHog, and advertising, which is Google Ads. Neither is ticked in advance, and "Save choices" stores exactly what you ticked. "Accept" turns both on and "Reject" turns both off.
Until you choose, and if you reject, we set and read no analytics or advertising cookie in your browser, except in the case explained next. You can keep using the site as normal: the notice blocks nothing, and rejecting costs you no functionality.
The exception, so it does not take you by surprise: if you arrive from one of our Google adverts, we turn on Google Ads and Google Analytics measurement as soon as you arrive, before you answer the notice. That sets their cookies (the _gcl_ and _ga ones in the table) so we can tell the visit came from that advert and whether it ends in a sign-up, plus a first-party session cookie, gofeed_paid, that remembers it while you browse. It does not turn on advert personalisation or PostHog. The notice still appears: if you accept, what you accept stays; if you reject, we delete those Google cookies and gofeed_paid, and stop measuring. And if you register, the link passes the identifier of that advert click to the application whether or not you accept, so we can tell Google Ads the advert brought a sign-up.
Your choice is stored in a first-party cookie, gofeed_consent, for thirteen months. After that, or if we change the cookies we use in a way that needs your permission again, we will ask you again.
Cookies we use
This is the complete list. The first column is the name as your browser will show it, and the second says where it is set: this marketing site, or the application once you sign in to your account.
| Name | Where | What it does | Lifetime | Type |
|---|---|---|---|---|
| gofeed_consent | Marketing site | Stores your cookie choice: which categories you accepted and when, so we do not ask you on every page. It is first-party and used for nothing else. | Thirteen months | Necessary |
| gf_lead | Marketing site | Only if you send us one of the forms on this site (contact, demo or the affiliate application): tells the confirmation page that your submission went out, so it counts as received. It carries no identifier, only the digit 1, and the page deletes it as soon as it reads it. What that page then passes on to Google Analytics and Google Ads follows your choice about analytics and advertising, as explained below. | Five minutes at most | Technical |
| Cloudflare Turnstile | Marketing site | Checks that whoever sends a form (contact, demo or subscription) is a person and not a program sending automated messages. Cloudflare documents that it uses cookies and the browser's local storage to hold that check. It does not start when the page opens: only when you begin typing in one of those forms, so if you never type, it never happens. | That of the check | Necessary (security), does not require your consent |
| gofeed_paid | Marketing site | Only if you arrive from a Google advert and have not answered the notice yet: remembers for this visit that you arrived that way, so Google Ads and Google Analytics measurement stays on across the following pages. It is first-party, holds only a "1" and is deleted as soon as you answer the notice, whether you accept or reject. | The session | Advertising |
| _ga | Marketing site | Google Analytics: tells one visit from another so we can count how many people arrive. Only if you accept analytics, or from arrival if you come from a Google advert and have not answered the notice yet. | Two years | Analytics |
| _ga_ followed by the property identifier | Marketing site | Google Analytics: keeps the measurement session state as you browse. Your browser shows it with the identifier already filled in, without the "G-" prefix. Only if you accept analytics, or from arrival if you come from a Google advert and have not answered the notice yet. | Two years | Analytics |
| ph_ followed by the project key and _posthog | Marketing site and application | PostHog: tells one visit from another and, if you later create an account, lets us recognise it as the same person. It is first-party, on the gofeedapp.com domain, and has a twin of the same name in browser local storage. On the marketing site it is only set if you accept analytics; in the application it is tied to your account. | One year | Analytics |
| _gcl_au | Marketing site | Google Ads: stores anonymously which advert brought you here, so we can tell which campaigns work. Only if you accept advertising, or from arrival if you come from a Google advert and have not answered the notice yet. | Ninety days | Advertising |
| _gac_ followed by the campaign identifier | Marketing site | Google Ads: ties a visit to the particular campaign you arrived from. Only if you accept advertising, or from arrival if you come from a Google advert and have not answered the notice yet. | Ninety days | Advertising |
| gf_attribution | Marketing site | Remembers which advert or campaign you arrived from, so a later sign-up can be attributed to it. It is not a cookie: it is browser local storage. Only if you accept advertising, and it is deleted if you reject it later. | Ninety days | Advertising |
| gf_attr | Application | Carries that same fact into the application while you register, because signing in with Google loses it on the way. If you did not accept advertising on the marketing site, it carries only the identifier of a Google advert click, when you arrived from one, and no other campaign data. It clears itself after half an hour. | Thirty minutes | Advertising |
| Session cookie | Application | Keeps you signed in while you are using it. | The session | Necessary |
| gf_locale | Application | Remembers the language you want to read the application in. | One year | Necessary |
| gf_last_workspace and gf_last_workspace_day | Application | Remember the last workspace you opened, so you land back in it, and the day that memory was last renewed. | Ninety days | Necessary |
| gf_client | Application | Remembers the last brand you worked on inside a workspace, so you land back on it. | Ninety days | Necessary |
| gf_portal_client and gf_portal_brands | Application | In the client portal, remember the last company and the last brand you looked at, so you land back on them even after closing the window. | Ninety days | Necessary |
Technical and session cookies
The ones marked necessary in the table genuinely are: without them you could not stay signed in and the service would not remember your basic preferences. They are indispensable to providing the service you asked for, which is why the law allows them to be set without asking you.
They are first-party, meaning this service sets them rather than a third party, and they are not used to watch your behaviour or for advertising.
The marketing site you are reading sets a single necessary cookie: gofeed_consent, which remembers your choice about the others. If you send us one of its forms, it also sets gf_lead, a technical cookie with no identifier whose only job is to let the confirmation page know your submission went out; it is deleted as soon as that page reads it, and after five minutes at the latest. Language needs none here because it is part of the address itself, in "/es" or "/en". The other necessary cookies in the table belong to the application and only appear once you sign in.
There is one exception, and it deserves explaining rather than hiding in the table: if you begin typing in the contact form, the demo form, the affiliate application or a subscription form, Cloudflare Turnstile loads, which checks that you are a person and needs to store something in your browser to do so. We do not ask first because the law exempts what is strictly necessary to provide the service you asked for, and what you are asking for at that moment is to send us a form. If you never type in one, it never loads.
Third-party cookies
If you accept analytics, we use Google Analytics to measure the audience of the marketing site: how many people arrive, where from, and which pages they read. It tells us what we are explaining badly, not who you are.
We also use PostHog, for the same purpose. On the marketing site it measures the audience; in the application, once you sign in, it measures which features are used. What is collected and on what legal basis is explained in our privacy policy, at /en/legal/privacy.
For the fourteen days after an account is created, PostHog also records how the application is used: which screens are opened, where people click and how the page scrolls. It shows us where new users get stuck so we can improve the product. What is typed into fields and the data of the account's clients are hidden in the recording, keys and access codes are not recorded at all, and each recording is deleted after thirty days. It adds no cookie: it uses the same PostHog cookie listed in the table. After those fourteen days the account is no longer recorded.
We also use Google Ads. If you arrived from one of our adverts and accept advertising, or have not answered the notice yet, we store an identifier for that click, so we can tell which campaigns bring people who then register. It exists so we do not spend the budget on adverts that do not work, and the identifier refers to the advert rather than to you: it carries no name, no email address and nothing that identifies you.
Both services are loaded through Google Tag Manager, which is only the mechanism that places them and stores nothing of its own. What each one stores is in the table above.
The provider of the Google services is Google Ireland Limited, and the data may be processed by Google LLC in the United States under the EU to US Data Privacy Framework. The provider of PostHog is PostHog Inc., and the data is hosted in its European cloud, in Frankfurt.
Apart from the Google advert exception explained above, none of these cookies is set until you accept it in the notice. One point deserves to be plain: until you accept, Google Analytics and Google Ads may still receive a cookieless signal, what Google calls consent mode. That signal says a visit happened, but it stores and reads nothing in your browser and carries no identifier that tells your visit apart from another, and Google only uses it to estimate overall figures. PostHog receives nothing until you accept analytics.
If you accept advertising, pressing the button to register sends the application the details of the campaign that brought you. If you do not, the link leaves without them, with one exception: the identifier of a Google advert click always travels, so we can tell Google Ads that the advert brought a sign-up.
Cloudflare is this section's exception, so it comes on its own. Its Turnstile service checks that whoever fills in a form is a person. It only loads when you type in one, it receives your IP address and technical signals from your browser, and it does not see what you write. It is not used for measurement or advertising and is not combined with anything above. The provider is Cloudflare, Inc., in the United States, with servers in the European Union too. As a security measure necessary for the service you are asking for, it does not depend on accepting cookies, and it keeps working if you refuse them.
We do not sell this data and we do not pass it to anyone beyond the providers named here. We use no social network pixels today; the day we do, they will appear in the table above before they are set.
Retention period
Each cookie lifetime is in the table above. Session cookies disappear when you close the browser; the rest expire on their own after the stated period, and you can delete them sooner whenever you want. Your cookie choice lasts thirteen months, after which we ask you again.
How to change or withdraw your consent
From the site itself. At the top of this page there is a button, "Cookie settings", that reopens the notice with your current choice. You can tick or untick analytics and advertising separately and press "Save choices"; with both unticked you reject everything: withdrawing consent is as easy as giving it. When you withdraw it we delete the Google cookies in that category this site can reach and stop measuring from that moment. The PostHog one is the same cookie the application uses with your account, and there it does not depend on this notice: if you reject analytics here, the marketing site stops reading it and stops measuring; it removes it only if it had stored it under an earlier acceptance of yours, and the application sets it again when you sign in. Processing that took place before you withdrew remains lawful.
From your browser. All of them let you see a site’s cookies, delete them and block third-party ones, and also clear them automatically on close. It is under "Settings → Privacy and security" in Chrome, "Settings → Privacy & Security" in Firefox, "Preferences → Privacy" in Safari and "Settings → Cookies and site permissions" in Edge. If you browse in a private or incognito window, they clear themselves when you close it. If you delete gofeed_consent, we will ask you again on your next visit.
For Google Analytics alone. Google publishes an opt-out add-on that stops Analytics measuring your browsing on any site, not only this one. It is at https://tools.google.com/dlpage/gaoptout.
For Google advertising alone. At https://myadcenter.google.com you can turn off ad personalisation on your Google account, and at https://www.youronlinechoices.com you can manage advertising preferences across much of the industry at once.
By writing to us. If you have any trouble changing your choice, or want us to stop processing data already collected for measurement or advertising, write to support@gofeedapp.com, without having to explain why. We will act on it and reply to you.
Note that if you block all cookies, including the necessary ones, the application may stop working properly: without the session cookie you could not stay signed in.
Changes to this policy
We will update this page when the cookies we use or the providers that set them change. The date of the last update is shown at the top. If the change affects what you accepted, we will ask you again in the notice before setting anything new.
Contact
If you have any question about cookies or about what we store, write to us at support@gofeedapp.com. The detail of how we handle your data is in our privacy policy, at /en/legal/privacy.