If that URL is being sent over an HTTPS link (which of course it should be) then the only two points that can log/cache it are the browser at the local end, and

If that URL is being sent over an HTTPS link (which of course it should be) then the only two points that can log/cache it are the browser at the local end, and the server at the remote end. The latter is up to server design, the former is an interesting point. Browsers are unlikely to cache get parameters, but these things might end up in history etc..