Cookie Policy
Every cookie we use, listed individually — what it does, how long it lives, and who controls it.
Last Updated: August 31, 2026
How Consent Works on This Site
Cookies that are strictly necessary for the site to work are placed without consent — the site cannot function without them (Art. 11.7a lid 3 Telecommunicatiewet). Everything else is placed only after you accept it in the consent banner, which is shown before any non-essential cookie is set. Refusing is as easy as accepting, and refusing never limits your access to the site.
You can change or withdraw your choices at any time:
Strictly necessary
No consent needed
Required for the site to function — signing in, protecting forms. The site cannot work without them, so they are placed without consent (Art. 11.7a lid 3 Telecommunicatiewet).
| Cookie | Purpose | Duration | Party | Controller |
|---|---|---|---|---|
| __Secure-authjs.session-tokenHttpOnly | Keeps you signed in to your account | 30 days | first-party | GoBeyondDutch |
| __Host-authjs.csrf-tokenHttpOnly | Protects forms against cross-site request forgery | Session (deleted when you close the browser) | first-party | GoBeyondDutch |
| __Secure-authjs.callback-urlHttpOnly | Returns you to the right page after signing in | Session (deleted when you close the browser) | first-party | GoBeyondDutch |
Consent preferences
No consent needed
Remembers the cookie choices you made in the consent banner, so we do not ask you again on every page.
| Cookie | Purpose | Duration | Party | Controller |
|---|---|---|---|---|
| cf_consent | Stores your cookie-consent choices (set by Cloudflare Zaraz on our behalf) | Persistent — until you change your choice or delete it | first-party | GoBeyondDutch (Cloudflare as processor) |
Analytics
Only after you consent
Set via Cloudflare Zaraz only after you accept analytics in the consent banner. Used to understand how visitors use the site.
| Cookie | Purpose | Duration | Party | Controller |
|---|---|---|---|---|
| _ga | Distinguishes visitors for Google Analytics 4 | 2 years | first-party | GoBeyondDutch (Google as processor) |
| _ga_* | Keeps session state for Google Analytics 4 | 2 years | first-party | GoBeyondDutch (Google as processor) |
Marketing attribution
Only after you consent
Not in use yet. When personal links launch, these are set only if you arrive via a personal link we sent you in a direct message, and only with your consent — measured entirely on our own servers and never shared with any third party.
| Cookie | Purpose | Duration | Party | Controller |
|---|---|---|---|---|
| gbd_tHttpOnlyNot in use yet | Links your visit to the personal link we sent you in a direct message, so we know that link was used. Never shared with anyone; unreadable by any scriptWe do not set this cookie yet — it is listed here in advance so this policy is already accurate on the day the feature that uses it launches. | 30 days | first-party | GoBeyondDutch |
| gbd_tmNot in use yet | Marks that a measured visit is in progress so the site knows to record page views on our own server. Contains no identifierWe do not set this cookie yet — it is listed here in advance so this policy is already accurate on the day the feature that uses it launches. | 30 days | first-party | GoBeyondDutch |
What We Deliberately Don't Use
We do not use advertising cookies, cross-site trackers, or social-media pixels, and we do not share cookie data with ad networks. Some of our tooling is deliberately cookieless:
- Vercel Web Analytics & Speed Insights — Aggregate page metrics — sets no cookies
- Cloudflare Web Analytics — Aggregate traffic metrics — sets no cookies
- Sentry error monitoring — Sets no cookies; page text and inputs are masked
More Information
What we do with the data behind these cookies — legal bases, processors, retention, and your GDPR rights — is described in our Privacy Policy. Questions? Email [email protected] with "Privacy" in the subject line.