Cookie Policy

1. About this policy

The Fortune Club website uses cookies and browser storage to keep your member account secure and remember your chosen language. This policy explains the purpose of each record and how to manage it. General information about personal data appears in the Privacy Notice.

The current web application does not use advertising, behavioural tracking or visitor analytics cookies. Links to partner establishments do not place those partners' cookies in your browser. If you follow an external link, the destination website's own policy applies.

2. Session and security cookies

• access_token: Identifies your signed-in account and enables access to member pages you are authorised to use. A first-party session cookie that JavaScript cannot read.
• refresh_token: Securely renews a valid session. A first-party cookie that JavaScript cannot read, restricted to a path used for authentication requests. For member and administrator accounts it is a session cookie. For business accounts it is a persistent cookie kept for 1 year so the session survives closing and reopening the browser; the period restarts each time the session is renewed.
• csrf_token: Helps prevent unauthorised actions on your account. A first-party session cookie that the application uses to verify requests.

Apart from the refresh_token period on business accounts, these cookies have no persistent browser-storage expiry assigned. Your browser's session-restore settings can affect when its session ends; account access also depends on the server's session-validity checks. Signing out clears these cookies. In the production environment they are transmitted over a secure connection.

3. Language and browser storage

• NEXT_LOCALE — language cookie: Remembers the interface language when you use the language switcher, open an English or Russian address, or switch to your account's language preference. It is first-party and stores only a language code. Its lifetime is one year, renewed when the cookie is set again.
• fr.auth.refreshedAt — local storage: Stores the time of the last successful session renewal to prevent open tabs from renewing the same session simultaneously. It contains no password or session token. The application only acts on records from the preceding ten seconds; the record may remain on the device until replaced or browser data is cleared.
• fr.cookieNotice — session storage: After you select “Got it”, remembers that the notice should stay closed during the same tab session. It stores only the notice version. It lasts for that tab session, subject to your browser's session-restore behaviour.
• fr.auth.signedOutAt — local storage: When you sign out in one tab, or the session ends, lets the other open tabs sign out as well. It stores only the time and a one-word reason (for example inactivity) — no password, session token or account details. The record may remain on the device until replaced or browser data is cleared.
• fr.auth.accountChangedAt — local storage: When you sign in in one tab, lets the other open tabs re-check which account is signed in. It stores only the time. The record may remain on the device until replaced or browser data is cleared.
• fr.staff.lastActivityAt — local storage: Used only in establishment and administration staff sessions. Stores the time of the last activity so that input in any tab postpones the automatic inactivity sign-out in all of them. It contains nothing but a timestamp.
• fr.auth.signOutReason — session storage: Stores a one-word reason (for example inactivity) so the sign-in page can say once why the last session ended; it is removed when shown. It lasts for that tab session.
• fr.panel.guide — local storage: Used only in the business panel. Stores whether guide mode is on, which hints have been read and which page guides were folded; it holds no account or personal information. The choice belongs to this browser and can stay on the device until it is updated or browser data is cleared.
• fortune-royal.panel-sidebar — local storage: Used only in the business and administration panels to remember whether the side menu is collapsed. It holds no personal information.
• hotel.scanner.facing — local storage: Used only by the QR scanner in the business panel to remember whether the front or back camera was chosen. No camera images are stored; it holds no personal information.

These records support account security, your chosen language, closing the notice, coordinating sign-out and activity between open tabs, and panel display preferences. They are not used to create advertising profiles. The local-storage and session-storage records listed above are not sent to the server.

4. The notice and your choices

The cookie notice is informational. “Got it” only closes the notice: it does not grant marketing consent or activate an optional tracker. Your optional communications preference during registration is separate.

You can review, remove or block cookies and site data in your browser's privacy settings. Blocking session and security cookies can prevent member sign-in and account actions. Removing the language record forgets your preference; removing the notice record allows the notice to appear again.

If an analytics or marketing technology requiring consent is introduced, its purpose and storage duration must be explained before activation, with a way to accept, reject and change the choice. This policy does not request consent for such future use.

5. Updates and contact

This policy describes the website's current implementation. See the Privacy Notice for the mobile app's device storage and permissions. The current version and date appear at the top of this page. You can send questions through our contact page.

• Operator: Fortune Club Turizm
• E-mail: info@fortuneroyalturizm.com