Cookie notice

What this covers

GPN.TOURS uses a few cookies and browser storage entries so the trade desk can sign you in and remember work on this device. We do not use advertising or analytics cookies.

Cookies

gpn_at is an httpOnly cookie that carries the access session. It lasts about 20 minutes.

gpn_rt is an httpOnly cookie that carries the refresh session. It lasts 7 days and rotates when the access session is renewed.

gpn_csrf is a cookie the page can read. The site sends the same value as the x-csrf-token header on writes so another site cannot use your session.

These cookies are required for sign-in. SameSite is Lax. On the public site they are Secure and, when the site and the API are on sibling hosts, they use the parent domain.

Storage in this browser

sessionStorage key gpn_user keeps the signed-in profile (name, role, and status) so the header can render. It does not contain the access or refresh token.

localStorage may keep the shortlist, an agent markup preference, a driver GPS queue when the network drops, and whether the desk sidebar is collapsed. Those stay on this browser until you clear site data.

How to remove them

Sign out to clear the session cookies for this browser. Sign out every session in account settings ends other devices as well. You can also delete cookies and site data for gpntour.com in the browser settings. The desk will ask you to sign in again.