Cookie Policy
This policy explains the cookies and similar technologies GO LAW uses on go.law and app.go.law, what each one does, and how you can choose which ones we use. It should be read together with our Privacy Policy, which explains how we handle personal information more generally.
What cookies are
A cookie is a small text file a website stores in your browser. Websites also use similar technologies, such as local storage and session storage, that keep information in your browser in the same way. In this policy "cookies" covers all of them.
The choice we ask you to make
The first time you visit, we ask whether you accept analytics and session replay. Nothing in that category runs until you answer. If you accept, PostHog analytics and session replay start. If you reject, we use only the necessary cookies described below, and PostHog counts your visit without setting any cookie or storing anything in your browser, using a one-way code calculated on PostHog’s servers that cannot be used to follow you from visit to visit.
You can change your answer at any time with the Cookie settings link at the bottom of every page on go.law, or in the account menu when you are signed in to app.go.law. Your choice applies to both.
Necessary cookies
These cookies are needed for GO LAW to work and cannot be switched off in our settings. They do not track you for analytics or advertising.
| Name | Set by | What it does | How long it lasts |
| sb-…-auth-token | GO LAW (through Supabase, our sign-in provider) | Keeps you signed in, including the temporary guest session that lets you draft and review documents before creating an account. It is shared between go.law and app.go.law so your documents follow you. | Until you sign out or the session expires |
| golaw_consent_v1 | GO LAW | Remembers whether you accepted or rejected analytics and session replay. | 1 year |
| golaw-theme, golaw-sidebar | GO LAW | Remember the light or dark theme and whether the sidebar is open in the signed-in app. | 1 year |
| Cloudflare security cookies, when set (for example __cf_bm) | Cloudflare | Cloudflare delivers our public website and may set these to protect it from automated abuse. | Up to 30 minutes |
When you pay for an attorney review, you enter your card on a page hosted by Stripe, our payment processor. Stripe sets its own cookies on that page to process the payment and prevent fraud. Stripe’s use of them is described in Stripe’s own cookie policy.
Analytics and session replay (only if you accept)
We use PostHog, an analytics service, to understand how people use GO LAW, to find what is confusing or broken, and to improve the service. If you accept, PostHog records:
- the pages you visit, the links and buttons you click, how far you scroll and how long pages take to load;
- which features you use, for example starting a GO Draft document, uploading a contract to GO Review or asking for an attorney;
- your browser, device type, approximate location derived from your IP address, and the page that referred you;
- if you are signed in, your account ID and email address, so we can connect visits made from different devices;
- a session replay of your visit, described in the next section.
| Name | Set by | What it does | How long it lasts |
| ph_golaw_ph, ph_golaw_ph_cpm | GO LAW (PostHog) | Give your browser a random identifier so PostHog can tell one visit from the next and connect a visit on go.law with a visit on app.go.law. Also kept in local storage. | 1 year |
| Session storage entries starting with ph_ | GO LAW (PostHog) | Hold the current session and the replay while it is being sent. | Until you close the tab |
What a session replay contains
Session replays are not masked. A replay is a reconstruction of your visit as you saw it: the text and layout of each page, your mouse movements, clicks and scrolling, and what you type. That includes the information you enter into GO LAW, such as the answers you give in GO Draft, the text of contracts you upload to GO Review, and messages you write to an attorney. The replay also records the requests your browser makes to GO LAW and our responses, and messages your browser writes to its console.
Password fields are never recorded. Card details are entered on Stripe’s page, which PostHog does not record. If you do not want your visit recorded, choose Reject or switch off analytics and session replay in Cookie settings. Rejecting does not stop you using any part of GO LAW.
Only GO LAW personnel who maintain and improve the service can view replays. We use them to fix problems and improve GO LAW, and not for advertising. Replays are deleted after 30 days.
Error monitoring
When something goes wrong on GO LAW, a report is sent to Sentry, our error monitoring service, so we can find and fix the fault. A report can include the page and request that failed, your browser and device, your IP address and, if you are signed in, your account ID and email address. Sentry does not set cookies. Because it is needed to keep the service working and secure, error monitoring runs whether or not you accept analytics.
Who receives this information
PostHog, Inc. and Functional Software, Inc. (Sentry) process this information on our behalf as service providers, on servers in the United States. We do not sell this information and do not use it for targeted advertising.
Other ways to control cookies
Most browsers let you block or delete cookies in their settings. If you block the necessary cookies, you will not be able to sign in or keep a draft between pages. Deleting the consent cookie means we will ask for your choice again.
Changes and contact
If we change the cookies we use in a way that affects your choice, we will update this policy and ask you again. For questions about this policy or to exercise your privacy rights, use the contact details in our Privacy Policy.