Three categories, one switch per category
Cookies on khelo bet24 fall into three categories: essential (always on), analytics (aggregate, anonymised), and marketing (only with consent). The switch is on the wallet screen under Settings → Privacy → Cookies.
Essential, analytics, marketing
How each category is used
Essential cookies hold the login session, the CSRF token, and the security headers. They cannot be switched off because the lobby cannot authenticate the user without them. Switching off essential cookies is technically possible at the browser level; the lobby will then require the user to sign in on every page load.
Analytics cookies record aggregate page views, scroll depth, and click-through rate. The data is anonymised: no IP address is stored in the analytics table, no device fingerprint is built, no cross-session identifier is set. The data is used only to improve the editorial hierarchy of the lobby.
Marketing cookies power the attribution pixel and the remarketing tags. The default is off; the user opts in via the switch on the wallet screen. Switching off marketing cookies does not affect the lobby or the catalogue.
Toggle analytics and marketing on the wallet screen
The cookie switch is on the wallet screen under Settings → Privacy → Cookies. The switch is per-device and per-account; switching off analytics and marketing does not affect essential cookies. The switch persists across sessions; the user can change it any time and the change takes effect on the next page load.
| Switch | Default | Effect when off | Where set |
|---|---|---|---|
| Essential | Always on | Login fails; user signs in on every page load | Browser, not the wallet |
| Analytics | Off | Page views not recorded; editorial team uses server-side counters only | Wallet → Settings → Privacy → Cookies |
| Marketing | Off | No attribution pixel, no remarketing tag | Wallet → Settings → Privacy → Cookies |
Google Fonts only, no third-party trackers
The only third-party request the lobby makes is to Google Fonts (fonts.googleapis.com and fonts.gstatic.com). The fonts are loaded via a stylesheet; no tracking pixel is included. The preconnect hints in the head reduce the round-trip cost; the font files are cached for 365 days under the browser's default cache policy.
The lobby does not embed any third-party analytics SDK (no Google Analytics, no Mixpanel, no Segment). The lobby does not embed any third-party chat widget (the support chat is in-app). The lobby does not embed any third-party remarketing tag (the marketing pixel is opt-in).
How long each cookie persists
| Cookie | Purpose | Lifetime | Category |
|---|---|---|---|
| session | Login session ID | 24 hours | Essential |
| csrf | Cross-site request forgery token | 24 hours | Essential |
| analytics_consent | Remembers analytics opt-in | 365 days | Essential (consent record) |
| marketing_consent | Remembers marketing opt-in | 365 days | Essential (consent record) |
| lang | EN or हिंदी switch | 365 days | Essential (preference) |
Clearing cookies from the browser side
The user can clear cookies from the browser's privacy settings at any time. Clearing essential cookies signs the user out; clearing analytics and marketing consent records resets the switches to the default (off) on the next page load. The lobby does not store cookies in any other location: no localStorage, no sessionStorage, no IndexedDB.
The user can also use the browser's "Do Not Track" header. The lobby honours DNT by disabling analytics and marketing cookies regardless of the wallet-side switch.
Cookies are not set on devices used by minors
Age-18 enforcement at the cookies layer
The lobby does not set cookies on devices used by minors. The age-18 enforcement runs on the wallet endpoint: a sign-up attempt by a user declaring age below 18 is refused before any cookie is set. The lobby does not have a "minor mode"; a minor simply cannot open an account or load the wallet-bearing lobby.
Even on the editorial site (which does not require sign-up), the cookies are limited to essential: language preference (EN or हिंदी) and consent records. No analytics, no marketing, no tracking pixel. The editorial site honours Do Not Track as a strict signal.
Parents who share a device with a minor can clear the cookies from the browser privacy settings at any time. Clearing cookies on a shared device is the simplest way to reset the lobby to its default state.
What the cookie set proves, what it does not
Reading the cookie set
The session cookie proves the user is signed in. The cookie alone does not prove identity; identity is established by the mobile number and OTP at sign-up. The session cookie expires after 24 hours regardless of activity; the user signs in again.
The csrf cookie proves the request originated from the same origin as the lobby. The cookie alone does not protect against phishing; the user must verify the URL is https://khelo24bet9.com before signing in.
The consent cookies prove the user opted in or out of analytics and marketing. The cookies alone do not affect the lobby; the lobby functions the same with or without these switches.
Inspecting the cookies on your device
Where to look in the browser
Chrome: Settings → Privacy and security → Cookies and other site data → See all cookies and site data. Search for khelo24bet9.com. The list shows the session cookie, the CSRF cookie, the consent cookies, and the language preference.
Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data. Search for khelo24bet9.com. The list shows the same five cookies.
Safari: Preferences → Privacy → Manage Website Data. Search for khelo24bet9.com. The list shows the same five cookies, plus any iCloud-synced cookies.
Edge: Settings → Cookies and site permissions → Cookies and site data → See all cookies and site data. Search for khelo24bet9.com. The list shows the same five cookies.
If the user sees a cookie not listed on these settings, that is a bug. The user can report it through the /contact/ channel.
How the cookies policy is updated
The cookies policy is reviewed at least once per quarter. Material changes (new cookies, new categories, new retention rules) trigger an immediate review. The last-reviewed date at the bottom of every page records the most recent review.
Material changes are reflected on the cookie policy and in the change log below.
The user can subscribe to cookies-policy updates through the wallet screen under Settings → Notifications → Cookies updates.
Change log
2026-08-21: Added a section on inspecting cookies and on age-18 enforcement at the cookies layer.
What the cookies policy looks like under different jurisdictions
The cookies policy described on these settings is written for the Indian jurisdiction. The GDPR framework treats cookies as personal data, requires explicit opt-in for non-essential cookies, and grants the user the right to data portability. The CCPA framework treats cookies as personal information, requires opt-out for the sale of personal information, and grants the user the right to know and the right to delete.
The lobby does not target users in the EU or California; the operator serves Indian users only. The cookies policy described on these settings is therefore the applicable one. If the operator expands to other jurisdictions, the cookies policy will be updated to reflect the regional rules.
Where this hands off
Privacy
Data handling, retention, rights.
Delete account
Closure path and data-deletion window.
Legal
Project boundaries and disclaimers.
Responsible play
Deposit caps, cooldown, age-18.
Wallet & KYC
Document set, 12-hour turnaround.
DMCA
Copyright notice and takedown path.
Decision questions on this route
Are essential cookies required?
Can the user switch off analytics and marketing separately?
Does the lobby use Google Analytics?
What happens if the user clears cookies from the browser?
Does the lobby honour Do Not Track?
Where is the cookie switch?
Review the cookies on your device
The lobby stores five cookies: one session, one CSRF, two consent records, and one language preference. Each one has a defined lifetime and a defined category.