Cookie policy
The table lists cookies set directly by ShortFreeURL. Analytics services on the public website may set additional identifiers as described below.
| Cookie | What it does | How long | When it is set |
|---|---|---|---|
ms_session | Keeps you signed in to the dashboard | 30 days | set only after you sign in |
ms_admin | Keeps an administrator signed in to the admin panel | 2 days | staff only |
ms_org | Remembers which organisation you are viewing | 90 days | signed-in customers |
ms_oauth_state | Protects a sign-in-with-Google handshake from replay | 10 minutes | only during that sign-in |
ms_attr | Remembers which campaign brought you, so a signup can be attributed | 30 days | set on the marketing site |
msv | A random visitor id for the marketing site’s own traffic report. It is a random value, not a fingerprint, so clearing it genuinely ends the identity | 400 days | marketing site only |
mss | Groups those page views into one visit | 30 minutes | marketing site only |
ms_ab_<id> | Keeps a visitor on the same A/B variation, so a test measures people rather than page views | 30 days | only on links running a split test |
ms_pw_<id> | Remembers that you unlocked a password-protected link | 24 hours | only after you enter the password |
ms_bc | Records that a browser passed the anti-scraping check | 1 hour | only on domains with scraping protection on |
The cookies in this table are set by ShortFreeURL. Third-party analytics on the public website are described separately below.
Marketing site analytics
We use Umami Cloud on the public marketing site to measure page views, referrals and aggregate visitor trends. Its tracking script does not set cookies. It derives aggregate location and device reports from request information without storing raw visitor IP addresses. Umami is not installed on customer short-link redirects or the signed-in dashboard. See Umami's analytics documentation.
Google Analytics 4 (GA4) measures public website visits and interactions. The Google tag may use cookies or similar identifiers and send usage data to Google. See Google’s privacy policy.
Microsoft Clarity helps us understand how visitors use public website pages through aggregate heatmaps and session recordings. It may use cookies or similar identifiers and process interaction data; sensitive inputs should be masked. See Microsoft’s privacy statement.
Google Tag Manager loads configured measurement tags on the public website only after you accept optional analytics. A tag can send page or event data to its configured destination. See Google’s privacy policy.
On your first visit, choose Accept analytics or Reject optional. GA4, Tag Manager and Clarity do not start until you accept; Umami remains cookieless. Use Analytics choices beside the Cookie policy link in the footer to change your choice. Rejecting after acceptance reloads the page without optional tags.
On your own links
The redirect path sets a cookie only where a feature needs one — a split test, a password gate, or scraping protection. Retargeting pixels fire only on links where you have configured them yourself, and only on your own domain; the privacy policy lists every destination that can receive a click.
Turning them off
You can reject optional analytics using the choice above. Blocking cookies in your browser may affect split-test consistency. Sign-in will not work without ms_session, because that cookie is the session.
Still have a question?
If you need this list in your own cookie banner or records of processing, ask and we will send it in a format you can paste.
Open a support ticket Read the documentation
The contact form opens a real ticket, gives you a reference number and a link to follow the answer — you do not need an account. Choose General question as the subject so it reaches the right person. If you already have a ticket open, reply on its link rather than starting a second one.
Last updated 2026-09-25.