Privacy notice

This notice explains what personal information CricZone collects when you use www.criczone.com.au, why, who else handles it, and what you can ask us to do about it.

CricZone manages personal information in line with the Australian Privacy Principles.

You can read the whole site without telling us who you are

No account is needed to read CricZone. If you never sign in, never subscribe and never write to us, we hold nothing that identifies you.

What we collect, and when

When you read the site

Nothing that identifies you. CricZone counts readership in its own database: which page was opened, which article, and the text typed into the search box. Those records carry no visitor identifier, no cookie id, no IP address and no account id.

Readership is also counted by Google Analytics, and only for a reader who has allowed analytics in their cookie choices. Refuse analytics and nothing at all is requested from Google. The section below sets out exactly what is sent when you allow it. There is no tag container on this site, no advertising pixel and no session recording.

When you hold an account

• Your name and, if you set one, a display name.
• Your email address, and whether you have confirmed it.
• Your password, stored as a hash. We never hold it in a form anybody can read.
• What you have saved, and which teams and players you follow.
• A record of each active sign-in, which holds the browser you signed in with and the IP address the request came from, so you can see and end your own sessions.

We do not ask for your date of birth, your phone number or your postal address.

When you subscribe to the newsletter

Your email address, the date you subscribed, and a token that lets you unsubscribe in one click without signing in. If the address matches an account, the two are linked so your account can show your subscription.

When you write to us

The contact form takes your name, your email address, an organisation if you give one, which desk you are writing to, a subject and your message. Depending on the desk it may also ask for a related page, an order number, an account email, campaign details, or details of how you want to use a photograph.

You can attach files. Attachments are stored with the message.

Every message is recorded with a reference before anything is emailed. We use what you send to answer you. We do not sell it, and we do not add you to the newsletter because you wrote in.

When you choose what cookies to allow

Your choice is stored in a first-party cookie that names nobody: it records which categories you allowed and when, and nothing else. If you are signed in, the same choice is also recorded against your account so it follows you between browsers. The cookie notice lists every cookie this site sets.

Protecting sign-in and the forms

Sign-in attempts, password resets and form submissions are rate limited. The record behind that is a one-way hash of a secret, the operation and the caller's address. The address itself is not stored in it, and each record expires when its window ends and is then swept away.

Records of what staff did

Actions taken inside the newsroom and the control plane are recorded: who did what, to which record, and when, together with the request identifier and the route. Message bodies and request headers are never recorded. These records cannot be edited or deleted, which is enforced by the database itself.

The shop and membership

No payment can be taken through this site. No payment provider is connected, no card details are collected and none are stored. The shop and membership records that exist in the system today are marked as simulated and were created for testing.

What we do not do

• We do not sell or rent personal information.
• We do not run advertising tags on reader pages. No advertising network is connected, and there is no Meta or TikTok pixel.
• We do not record your session. No session-recording tool runs on this site.
• We do not build a profile of you across other websites.
• We do not add you to a mailing list because you wrote to us or bought something.
• We do not use a comment platform hosted by another company. None is connected.

Every item in that list is a capability this software could be given and has not been. Each one would need a change to this site's code and to the security policy that decides which addresses a page may contact, and this notice and the cookie notice are changed in the same release that turns one on. The two third parties this site does use are Google Analytics and the anti-robot check on five forms, and both are set out below.

Google Analytics

CricZone uses Google Analytics to understand which stories are read, so the newsroom can decide what to cover. It runs only for a reader who has allowed analytics.

Nothing is loaded before you allow it. That is a stronger arrangement than the common one, where the analytics script loads on every page and is then asked to hold back: on CricZone the script is not in the page at all until analytics is allowed, so a reader who refuses makes no request to Google of any kind and there is nothing for a setting elsewhere to get wrong.

What is sent

One page view for each page you open, and nothing else. CricZone sends Google no events of its own: not that you subscribed, not that you signed in, not that you saved a story, and never your name, your email address or your account. Nothing on this site can be bought, so there is no purchase or advertising conversion to report.

Like any request your browser makes, the request to Google carries your IP address, and Google uses it to work out an approximate location. What Google does with it after that is governed by Google's terms rather than by ours. Google publishes that it discards the IP addresses of readers in the European Union, Switzerland and the United Kingdom before logging them, and CricZone cannot verify from its own systems what happens for readers elsewhere.

The cookies it sets

Two, both set by Google's script rather than by CricZone, and both stored as first-party cookies on this site's own address. They are named, described and dated in the cookie notice. Neither is created at all if you refuse analytics, because the script that creates them is never loaded.

Who receives it, and where it goes

Google. Google is an international company, so this measurement is handled outside Australia.

How long Google keeps it

The reports themselves are held by Google rather than by CricZone, and how long the underlying data is kept is set in the Google Analytics property rather than in this site's software. Google offers two months or fourteen months for it. Write to us and we will tell you which is in force.

Changing your mind

Turn analytics off on the cookie preferences page and Google Analytics stops running on that browser from that moment. Clearing your cookies removes the identifier Google's script created there. CricZone sends Google nothing that identifies you, so there is no name or account for us to point Google at in order to have past measurement removed.

There is no tag container

Some sites load their measurement through a Google Tag Manager container, which can be changed to load other companies' tags without any change to the site itself. CricZone has no container and is not getting one. The Google Analytics tag is loaded directly by this site's own code, so what runs on a CricZone page is decided here rather than in somebody else's interface.

If one were ever added it would depend on your marketing choice rather than your analytics one, because a container can load advertising tags. Allowing readership measurement would never be enough to load it.

Anti-robot checks

CricZone uses Google reCAPTCHA to tell a person from a robot on five forms: the contact form, the newsletter sign-up, account sign-up, the password reset request, and the request to resend a verification email. No other form on the site uses it, and each of those five says so beside its send button.

The check does not run when you open a page. Google's script is requested the first time you touch one of those five forms, so a reader who never fills one in never contacts Google over it. When you send the form, your browser obtains a token from Google and CricZone asks Google whether that token is genuine. A submission that arrives without a valid token is refused.

Google's floating badge is hidden. Google permits that on the condition that the page says the site is protected by reCAPTCHA and links to Google's privacy policy and terms, and that sentence is on each of those five forms.

This protects the forms from abuse, so it sits under strictly necessary and is not a separate choice you can switch off. Everything you can read on CricZone is readable without touching any of those forms.

Cricket data

Scores, fixtures, squads and player records come from cricket data suppliers. That flow runs in one direction: nothing about a reader is sent to them.

Embedded video

Video on CricZone is hosted by YouTube. The still image on a video card is fetched from Google's image servers when the page loads. That is one picture: it runs no code and sets no cookie.

The player itself is different. No YouTube player exists on the page until you press play, and the play control only appears if you have allowed comments and third-party media in your cookie choices. Pressing play loads the player from YouTube's privacy-enhanced address and tells YouTube which page you are on.

Who else handles it

CricZone uses a small number of service providers to run the site. They handle information on our instructions and for no other purpose.

Where it is held, and whether it goes overseas

The database that holds accounts, subscriptions and enquiries is in Sydney, Australia, and the servers that run this site are in Sydney too.

Requests reach those servers through the hosting provider's international network, so a request from your browser may pass through equipment outside Australia on its way. Files and images are held on Cloudflare's international storage network. Email is delivered by a third-party email service.

Two things go to Google and are handled outside Australia: readership measurement through Google Analytics, where you have allowed analytics, and the anti-robot check on the five forms that use reCAPTCHA. Neither carries your name, your email address or your CricZone account.

Those providers are international companies, so personal information may be handled outside Australia in the course of providing those services. If you want to know which countries are involved at a given time, write to us and we will tell you in writing.

How long we keep things

This is what the software does today. Where no deletion period has been decided, this notice says so rather than quoting one.

• Your account and the things attached to it are kept while the account exists.
• A sign-in session expires seven days after it was last used, and is extended each time you use it.
• A newsletter subscription is kept until you unsubscribe. The record that you unsubscribed is kept afterwards, so that we do not mail you again by mistake.
• An enquiry and its attachments are kept as the record of that conversation. No automatic deletion period has been set for them.
• Rate-limiting records expire when their window ends and are then swept away.
• CricZone's own readership counts identify nobody, so there is nothing in them to delete. No deletion period has been set.
• Google Analytics data is held by Google rather than by CricZone. How long is set in the Google Analytics property, and Google offers two months or fourteen months for it.
• Records of staff actions are kept permanently and cannot be altered.

If you want something deleted sooner, ask us. We will do it where we are not required to keep it, and we will tell you if we cannot and why.

Getting a copy, and correcting it

If you hold an account, your account pages show what you have saved, the teams and players you follow, and your active sign-ins, and you can end a sign-in there.

For anything else, write to us through the contact form and ask for a copy or a correction. We answer in writing. We may need to check that you are who you say you are before we hand anything over, and we will tell you what we need.

There is no charge for asking. If we refuse, we will tell you why in writing.

Closing your account

Ask us to close your account and we will do it. Some records survive it, because they are records of something that happened rather than records about you: a correction published on an article, or an entry in the staff action log. Where that is the case, your account is removed from the record rather than the record being deleted.

Complaining

If you think CricZone has mishandled your personal information, write to us through the contact form and say so. We acknowledge it, give you a reference, and answer in writing.

If you are not satisfied with our answer, you can take the complaint to the Office of the Australian Information Commissioner.

How we protect it

• The whole site is served over HTTPS, and browsers are told to refuse plain HTTP for it.
• Passwords are stored hashed, and password reset and email confirmation tokens are stored hashed too.
• The cookie that keeps you signed in cannot be read by any script on the page.
• A content security policy restricts what a page is allowed to load, so an injected script has nowhere to send anything.
• Access inside the newsroom and the control plane is by permission, and what people do there is recorded.

No system is perfect. If something goes wrong that puts your information at serious risk, we will tell you.

Children

CricZone is a general audience cricket publication. We do not seek personal information from children and we do not ask any reader their age.

Changes to this notice

The version and the date this notice took effect are at the top of this page. Every published version is kept, so if you need to know what it said on a particular date, write to us and quote the date.

How to contact us

Use the contact form. Choose the desk that fits, or General if none does. Every message gets a reference and an answer in writing.