Cookie Policy
Last updated: 5 October 2026
This policy lists every cookie My Tour Platform sets, and what it keeps in your browser's storage. Read it with our Privacy Policy, which explains how we handle personal data.
1. What cookies are
A cookie is a small text file that a website stores in your browser. The site can read it on your next visit. A session cookie is deleted when you close the browser. A persistent cookie stays for a set time or until you delete it. All our cookies are first-party: only mytourplatform.com sets and reads them.
2. In short
| Kind of cookie | What it does | Do we use it? |
|---|---|---|
| Strictly necessary | Signing in, security, and features you ask for, such as "Keep me signed in". | Yes |
| Functional | Remembering a choice you made, so you do not have to make it again. | Yes, two cookies in the guest app |
| Analytics | Counting visits and tracking how people use a site. | No |
| Advertising | Following people across sites to show adverts. | No |
3. Every cookie we set
Most of these are set only for one kind of user, as shown. All are marked Secure, and all except cookie_consent and ontour_offline_scope are HttpOnly, so scripts on the page cannot read them.
PHPSESSID- Everyone. Keeps you signed in as you move between pages. It also links your browser to the security token (CSRF token) that protects every form; the token itself stays on our server, not in a cookie.
Lasts: Until you close the browser. The session on our server ends after at most 30 days. · Strictly necessary: Yes cookie_consent- Everyone. Remembers that you tapped OK on our cookie notice, which also records that you accepted the two functional cookies below: we set them only after that, and only when you use the guest app features they serve. Section 6 explains how to withdraw this.
Lasts: 1 year · Strictly necessary: Yes td_trusted- Tour Directors, only if you tick "Skip the code on this device for 90 days" when you enter your sign-in code. Remembers this device, so you are not asked for a code each time.
Lasts: 90 days · Strictly necessary: Yes (a feature you ask for) td_remember- Tour Directors, only if you tick "Keep me signed in". Keeps you signed in on this device. Signing out, or "Sign out of all devices" in your profile, ends it.
Lasts: 30 days, renewed as you use it, 90 days at most · Strictly necessary: Yes (a feature you ask for) portal_auth- Guests, Group Leaders, hotels, drivers and chaperones. Keeps you signed in to your tour, so you do not have to enter the access code again.
Lasts: 60 days · Strictly necessary: Yes sch_device_token- Guests who sign in with their own guest account (email and password). Remembers this phone, so you sign in without typing the password again.
Lasts: 30 days · Strictly necessary: Yes ontour_offline_scope- Guests. Keeps the offline copy of tour essentials separate for each guest, tour and access code on a shared phone. It is a fingerprint, not a sign-in, and holds no name or email.
Lasts: Up to 7 days; cleared when you sign out · Strictly necessary: Yes tv_last_code- Guests. Remembers which tour this phone last opened, so when you come back you only type the tour password. The code alone does not open the tour. The "Not your tour? Use a different link" button on the sign-in page removes it. Set only after you tap OK on the cookie notice.
Lasts: 1 year · Strictly necessary: No (functional) tv_ob_later- Guests. Counts how many times you tapped "Not now" on the welcome questions (0 to 2), so we stop asking after the second time. It holds only that number. Set only after you tap OK on the cookie notice.
Lasts: 1 year · Strictly necessary: No (functional) mtp_gone- Guests who have just deleted their registration. Lets the next page finish signing the phone out and clear the offline copy. It only works from our own pages.
Lasts: 60 seconds · Strictly necessary: Yes ch_team_+ challenge number- Photo challenge players. Keeps your phone in your team for that challenge. Leaving the team removes it.
Lasts: 7 days · Strictly necessary: Yes txd_+ company number- Taxi and transfer companies. Remembers a trusted device, so the company signs in with its password only, without an emailed code.
Lasts: 60 days · Strictly necessary: Yes
We no longer set three older cookies: challenge_team_token, portal_gdpr and ef_device_token. If your browser still has one, we delete the first two when we see them, and may read ef_device_token once to recognise a phone you trusted before.
We set strictly necessary cookies without asking, because the Service cannot work, or cannot do what you asked, without them. The two functional cookies are set only after you tap OK on the cookie notice. They only save you typing: you can withdraw at any time with "Reset cookie choice" (section 6), and the guest app still works without them.
4. What we do not use
- Google Analytics or any other analytics service.
- Meta Pixel, Google Ads, or any advertising or remarketing cookies.
- Social media tracking pixels or share buttons.
- Cookies that follow you across other websites.
- Fingerprinting to track you.
5. Other sites
Payments: online checkout is currently unavailable. When it returns, choosing a payment in My Plan will take you to Revolut's payment page, and Revolut may set its own cookies there under its Cookie Policy and Privacy Policy. We do not control those cookies.
Maps: two guest app screens can show a map: map images from OpenStreetMap on the recommendations screen, and an embedded Google map on the tour map screen. Nothing loads from those services until you tap "Show map". They then see your device's IP address, and Google may set its own cookies inside the embedded map. After your first tap, the map opens by itself if you come back to that screen in the same browser session; a new session starts without it.
Fonts: all fonts come from our own server. No page loads fonts from Google Fonts or any other font service.
6. How to manage cookies
Reset your cookie choice: this button deletes cookie_consent and the two functional cookies (tv_last_code and tv_ob_later) from this browser. The cookie notice then shows again. It does not sign you out.
You can see, delete or block cookies in your browser settings:
- Google Chrome: Settings > Privacy and security > Third-party cookies, or Site settings
- Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data
- Apple Safari: Settings > Privacy > Manage Website Data
- Microsoft Edge: Settings > Cookies and site permissions > Manage and delete cookies
If you block PHPSESSID, you cannot sign in or use the Service.
7. Storage in your browser and the app
Besides cookies, the Service keeps some data in your browser's own storage (local storage and session storage). This data stays on your device; it is not sent to us unless the page uses it to save a change you made. Signing out clears it. You can also clear it in your browser's site settings.
- Tour Director app: a copy of the tour you have open (
tour_cache_), so it still opens with a weak signal, and changes not yet saved to our server (pending_save_), so they are not lost. Allergy and diet ticks are never stored on your device: they are saved to our server straight away, and only when you have a signal. These can include the tour's guest names, rooms and notes. They are stored per Tour Director account on that device. Small preferences are kept too, such as list sorting, the last tab you used, hints you closed and your theme. - Guest app: if you choose "Save essential details",
ontour.offline.essentials.v1holds only the published meeting, hotel and Tour Director help details. It does not hold rooms, guest lists, meal or medical notes, payments or luggage photos. It expires after seven days or at the end of the tour, whichever is first. Your text size, notices you have closed, and your game progress are also kept. - Photo challenge: your team's progress and small previews of the photos you took, so you can see them while the upload finishes or you are offline.
- Driver app: luggage scans made without signal (kept until they are sent), your theme and notices you have closed.
- Install prompts: whether you closed the "Add to home screen" banner.
- Session storage (cleared when you close the browser tab): which tab or days you had open, and whether you tapped "Show map".
Service worker: to make the app installable and quick, the service worker keeps public files on your device: styles, scripts, icons and a blank offline page. It does not keep signed-in pages, API answers or luggage photos. If a Tour Director shares a receipt photo into the app from another app, the service worker holds the file only until the app picks it up.
8. Do Not Track
Some browsers can send a "Do Not Track" signal. We do not track you, show adverts or build profiles, so the signal changes nothing on our Service.
9. Changes to this policy
When we add, remove or change a cookie, we update this page and the "Last updated" date. If we ever want to use cookies that are not strictly necessary for anything beyond the two functional cookies above, such as analytics, we will ask for your consent first.
10. Contact
Questions about this policy:
Aurea Futura LTD
Company No. 11132111
18 Spencer Road, London SW20 0QP, United Kingdom
hello@mytourplatform.com
Data protection manager: slim@aureafutura.com