Cookies

Every cookie this site sets, what each one does, and how to change your choices.

Version: 2
In effect from: 24 Aug 2026

A cookie is a small piece of text a website asks your browser to keep. This page lists every cookie CricZone sets, what each one is for, and how long it lasts.

Note

The short version

CricZone sets a handful of first-party cookies of its own. The only other company whose cookies can appear here is Google, through Google Analytics, and only if you allow analytics. No advertising network, no tag container and no comment platform is connected to this site.

Changing your choices

You can change what you allow at any time on the cookie preferences page. Your choice is remembered for twelve months and then we ask again. We also ask again whenever what these categories cover changes, so an answer you gave is never spent on something you were not told about.

You can also delete cookies and block them in your browser's own settings. Blocking the strictly necessary ones will stop you signing in.

The cookies CricZone sets

Strictly necessary

These cannot be switched off, because the thing you asked for does not work without them. None of them tracks you across other websites and none is shared with an advertiser.

cz_consent

What it does: Remembers which categories of cookies you allowed
Set when: You answer the cookie banner, or save your preferences
What is in it: The version of this notice, the categories you allowed, and the date. No identifier.
How long: 12 months
Provider: CricZone (first party)
Readable by the page: Yes. The banner has to know whether to show itself.

__Secure-better-auth.session_token

What it does: Keeps you signed in
Set when: You sign in
What is in it: A session token. No personal information.
How long: 7 days, extended each time you use the site
Provider: CricZone (first party)
Readable by the page: No. It is marked HttpOnly and Secure.

cz_cart

What it does: Remembers a basket for a visitor who is not signed in
Set when: You put something in a basket. Never on an ordinary page view.
What is in it: A random token. No account id, no contents, no prices.
How long: 30 days
Provider: CricZone (first party)
Readable by the page: No. It is marked HttpOnly.

cz_ref

What it does: Records that you arrived through a partner link, so the partner can be credited
Set when: You follow a CricZone referral link. Never otherwise.
What is in it: A random reference to that visit. No partner name, no rate, nothing about you.
How long: The attribution window on the link you followed, up to 12 months
Provider: CricZone (first party)
Readable by the page: No. It is marked HttpOnly.

Preferences

cz_rail

What it does: Remembers whether the control plane's side navigation is open or collapsed
Set when: A signed-in member of staff collapses or expands it
What is in it: The word expanded or collapsed
How long: 12 months
Provider: CricZone (first party)
Where: The control plane only. Never on a reader page.

Analytics

These two are created by Google's own script, and only after you allow analytics. Refuse analytics and neither is ever created, because the script that would create them is never loaded. Both are stored against this site's own address rather than Google's, which is what first party means here.

_ga

What it does: Lets Google Analytics tell one browser from another
Set when: You have allowed analytics and you open a page
What is in it: A randomly generated identifier for this browser. No name, no email address and no CricZone account.
How long: Up to 2 years, and your browser may cut that short. Chrome caps it at 400 days and Safari at 7.
Provider: Google, stored as a first-party cookie on criczone.com.au
Readable by the page: Yes. Google's script has to read it.

_ga_ followed by this site's data stream identifier

What it does: Remembers where you are in a visit, so a run of page views counts as one session rather than several
Set when: You have allowed analytics and you open a page
What is in it: Session state for this browser. No name, no email address and no CricZone account.
How long: Up to 2 years, shortened by your browser in the same way
Provider: Google, stored as a first-party cookie on criczone.com.au
Readable by the page: Yes.

CricZone sends Google one page view per page and nothing else. No event, no purchase, no account and nothing that names you. The privacy notice sets that out in full.

What the anti-robot check puts on your device

Five forms are protected by Google reCAPTCHA: the contact form, the newsletter sign-up, account sign-up, the password reset request, and the request to resend a verification email. Each of them says so beside its send button.

Google's script is not loaded when you open a page. It is requested the first time you touch one of those five forms, so a reader who only reads never loads it. From that point Google can set its own storage on your device, under Google's terms rather than ours. CricZone does not set it and cannot read it.

This protects the forms from abuse, so it belongs to the strictly necessary category and is not a separate choice. Nothing you can read on CricZone requires you to touch one of those forms.

Other storage on your device

The story editor in the control plane keeps a copy of what is being typed in the browser's own storage, so that a draft survives a closed tab. It is kept for seven days and is not used anywhere on the public site.

What happens when you press play on a video

Video on CricZone is hosted by YouTube, and the player is not loaded until you ask for it.

On page load, the still image on a video card is fetched from Google's image servers. It is one picture: it runs no code and sets no cookie.
The play control only appears if you have allowed comments and third-party media.
Pressing play loads the player from YouTube's privacy-enhanced address. From that point YouTube can set its own storage on your device, under its terms rather than ours.

What CricZone does not set

None of the following runs on this site, and none of them sets a cookie here. Each is something the software can be configured to use and none of them is configured.

Google Tag Manager or any other tag container. CricZone loads its own measurement directly, so what runs on a page is decided in this site's code rather than in somebody else's interface.
Google AdSense and any other advertising network
Meta and TikTok advertising pixels
Microsoft Clarity or any other session recording
Disqus or any other hosted comment platform

Important

If that changes, this page changes with it

Nothing in the list above can start loading without a change to this site's code and to the security policy that decides which addresses a page may contact. This page is updated in the same release, and where a category is involved you will be asked again.

The categories you can choose between

Strictly necessary: signing in, keeping you signed in, protecting forms from abuse, remembering a basket, and remembering this choice. These cannot be switched off.
Preferences: remembering choices you have made, such as a layout or a dismissed notice.
Analytics: counting which pages and articles are read. CricZone counts this in its own database, where it identifies nobody, and allowing it also lets Google Analytics count your visit and set the two cookies above.
Marketing: measuring whether an advertisement or a campaign led somebody to subscribe or to buy.
Comments and third-party media: loading things other companies host, such as an embedded video or a social post.

Analytics, marketing and third-party media are all off until you turn them on, and refusing them is one press with the same weight as accepting.