Cookie and Browser Storage Notice

The controller for cookies and browser storage on this public website is Josip Totić, acting as a natural person. Travel Club Croatia is the website name. For privacy requests, contact info@travelclubcroatia.com. The member app is closed; its storage described below is not active on this website.

The current landing website does not load analytics, advertising, Google Maps, Cloudflare Turnstile or account authentication. It stores only your first-party privacy-choice record. Optional preference storage remains off by default and is not used by the landing page even if selected.

Optional storage is disabled by default. You can accept all optional categories, reject them, or select categories individually. Rejecting optional storage does not prevent you from using the public website. The member travel app is not yet public.

You can reopen Cookie settings at any time from the button shown on the website and app. Withdrawing consent is as easy as giving it and removes the optional first-party storage currently controlled by Josip Totić.

• tcc_consent_v1 — first-party cookie recording your category choices and their date; retained for up to 180 days.
• nf_jwt and nf_refresh — strictly necessary first-party, Secure, HttpOnly and SameSite authentication cookies. They maintain sign-in and server-side session renewal for the applicable token validity period and are not readable by browser JavaScript.
• __Secure-tcc_login_challenge — a strictly necessary, random HttpOnly identifier used for the one-time e-mail code after a correct password. It expires after 10 minutes and contains no e-mail address or code.
• __Host-tcc_member_session — a strictly necessary, Secure, HttpOnly and SameSite=Strict server-signed proof that both password and one-time e-mail code were verified. It expires after 12 hours; an Identity token without this proof cannot use private Travel Club APIs.
• __Secure-tcc_admin_session — a strictly necessary, Secure, HttpOnly and SameSite=Strict administrator step-up proof scoped to the moderation API. It expires after 15 minutes and is issued only after the signed-in administrator's individual six-digit authenticator-app TOTP is verified. Codes are account-bound, short-lived and protected against replay.
• __Host-tcc_pending_invite — a strictly necessary, Secure, HttpOnly and SameSite=Lax encrypted and authenticated cookie that returns an invited user to the correct invitation after sign-in or account confirmation. It expires after 30 minutes and is cleared after the invitation is accepted or declined; browser JavaScript cannot read it.
• tcc-push-subscription-version — records the current technical Web Push subscription version after you explicitly enable push notifications; retained until push is disabled or browser data is cleared.
• Cloudflare Turnstile challenge storage — Cloudflare may use strictly necessary, short-lived challenge storage and process browser/device signals when the account-creation security widget is shown. The widget returns a one-time token that expires after five minutes and is not stored by the website operator. Pre-clearance is disabled, so our configuration does not ask Turnstile to issue a persistent cf_clearance cookie. Cloudflare may use internal challenge cookies to diagnose service issues.

• travel-club-hub-ui-v1 — remembers the last app section, trip tab and selected destination; stored only after Preferences consent and retained until you withdraw consent or clear browser data.
• sidebar_state — remembers whether the app sidebar is open; retained for up to seven days.
• tcc:google-country-place-ids:v1 — caches country map identifiers to reduce repeated map requests; stored only after Preferences consent and removed when consent is withdrawn.
• Google Maps Platform — Google map and place scripts load only after Preferences consent. Google may then process map interactions, search text, IP address and standard browser request information under its own privacy terms.

No analytics, advertising, session-recording or personalised marketing technology is currently active. We will update this notice and request any required consent before introducing one.

Web Push is not activated through the cookie banner. It requires a separate, explicit browser permission and an authenticated opt-in inside your Travel Club profile. If enabled, the browser creates a device subscription containing a push endpoint and encryption keys, which the app stores only to deliver requested service notifications.

You can disable push in your profile or in your device/browser notification settings. Expired or rejected subscriptions are removed automatically.

Use the persistent Cookie settings control on any page. You can also clear cookies and site data through your browser. Browser controls may remove necessary authentication storage and sign you out.