Yeah, all you need is to encrypt the URL (which includes tracking query parameters), and then the URL you give out is the encrypted blob.
When the web server gets a request, it can validate & decrypt, update any tracking values, and redirect to the real URL.