Login Cookies, Sessions and Account Safety at BetBooker

From Password to Session

Signing in has three parts.

Authentication. You enter your username or phone number and your password. The server compares them with the stored record. Your password is held only as a hash, so the system checks a calculation and not the readable text. For new devices, or when the risk is higher, we ask for a one-time code sent to your phone.

Session creation. If the check succeeds, the server creates a session, which is a temporary record that says this browser belongs to this account. It gives the browser a long random code in a cookie.

Session use. On each page, the browser sends the cookie back. The server looks up the code and knows who you are. It never asks for the password again until the session ends.

The cookie holds only the code. Your balance, name and bets are stored on our servers, and nobody can read them from the cookie.

What Happens When a Session Ends

A session ends in one of four ways:

You sign out. The server deletes the session record, and the cookie becomes useless.

You are idle. After a period of inactivity, for example 30 minutes on sensitive pages, the session expires. This limits the risk if you leave a phone unlocked.

The cookie expires. A session cookie disappears when you close the browser. A persistent cookie disappears on its expiry date.

We end it. If we notice suspicious activity, or if you change your password, we close all active sessions.

After the session ends, you must use betbooker login again.

Stay Signed In Option

On the sign-in page you can tick Stay signed in. This changes the cookie from a session type to a persistent type that lasts up to 30 days. It is convenient on a phone that only you use, since you can open the site and place a bet without typing your details.

The option carries risk on a shared device. If another person picks up the phone, they could use your account until the cookie expires. For this reason, important actions such as changing the password, adding a payment method or requesting a withdrawal always ask you to confirm with a password or one-time code, even when you are signed in.

Recommendation. Use Stay signed in only on a personal phone with a screen lock. Never use it in an internet café or on a work computer.

Device Recognition

BetBooker places a device cookie after a successful sign-in with a confirmation code. The next time you sign in from the same browser, the system recognises it and may skip the extra code if all other signals look normal. If the browser has not been seen before, if the country changes suddenly or if the software that automates browsers is detected, the system asks for additional verification.

You can view and remove recognised devices in your account security page. Remove any device that you no longer use or do not recognise. When you remove a device, it must pass the one-time code check at the next sign-in.

Signals That the System Looks For

To protect accounts, our security tools look at the pattern of a session. Examples include:

• many failed password attempts in a short time;
• sign-ins from two distant locations within minutes;
• a sudden change of browser features or phone model;
• very fast actions that suggest software and not a person;
• a withdrawal to a new wallet shortly after a password change.

A single signal does not mean a problem. A combination may lead to a temporary lock, a code request or a manual review. We message you about the reason, and the lock ends after your identity is confirmed.

Cookies and the betbooker app

The betbooker app does not use browser cookies. After a successful sign-in, it receives an encrypted token and keeps it in protected storage on your phone. It works like a session cookie. It is removed when you sign out, and it can be revoked by us if we suspect misuse. The app can also use fingerprint or face unlock of your phone as a quick way to confirm your identity, and the biometric data never leaves your device.

How to Keep Your Session Safe

Before you sign in

• Check the address of the website. Use a bookmark or the app, and do not follow links from unknown messages.
• Use a unique password of at least twelve characters.
• Avoid signing in over public Wi-Fi when you can use mobile data.

While you are signed in

• Do not leave the phone unlocked and unattended.
• Be careful with screen-sharing and remote-control apps, because they expose everything on your screen.
• Do not install browser extensions from untrusted sources. Some can read cookies and pages.

After you finish

• Press Sign out, especially on shared devices.
• Close the browser tab and, if you used a public device, clear the site data.
• Check the login history from time to time.

Signing In From an Internet Café or a Borrowed Device

If you have no other option, follow this routine:

1. Open a private window.
2. Do not tick Stay signed in.
3. Do not save the password if the browser offers.
4. Complete only the actions that you must.
5. Sign out and close the private window.

If you suspect that someone saw your password, change it from your own device immediately.

Session Rules at a Glance

Strong Passwords and One-Time Codes

A session cookie is only as safe as the password behind it. Use a phrase of several unrelated words and add digits that have no link to your birthday. Do not reuse the password from your email, social media or mobile money accounts, because a leak at one service would open the others. If you receive a one-time code that you did not request, someone has probably entered your username. Do not share the code, and change your password at once. Our staff never call or message players to ask for codes.

Browser Extensions and Cookie Safety

Extensions can read the pages you open, and some can read cookies. Install only a few extensions from trusted publishers, and remove those that you no longer use. Be wary of free tools that promise bonuses, odds comparison or automatic betting, since they may capture your session. If you suspect that an extension has copied your cookies, sign out of all devices, change your password and remove the extension.

If Someone Else Gets Access

Signs of a session takeover include bets that you did not place, a changed phone number or email address, unknown devices in the security page and messages about withdrawals that you did not request. If you notice any of these:

1. Change your password at once from a trusted device.
2. Use the option to sign out of all devices.
3. Contact support through the contact page and explain what you have seen.
4. Contact your mobile money operator if payments are affected.
5. Look at the account history and note the time and amounts of unknown actions.

We freeze the account while we investigate, and we review the logs of the sessions to see what happened.

Cookies, Responsible Gambling and Time-Outs

Your session cookie also enforces restrictions. When you start a time-out or a self-exclusion, the server ends all of your active sessions straight away, in the browser and in the app. A cookie that remains on the device is useless after that moment, because the session record behind it has been deleted. Session reminders, which appear at intervals that you choose, are driven by the session as well.

Data Protection and Retention

Sign-in cookies and the logs of your sessions are personal data. We use them to run the service, to protect your account and to comply with legal duties. Login logs are kept for up to twelve months, unless an investigation requires a longer period. You may ask for a copy of your login history under the Data Protection Act, 2012 (Act 843), and you may ask us to correct information that is wrong. The privacy policy describes the full list of rights.

Frequently Asked Questions