Cookie Policy
Last updated 2026-09-16
This page lists every cookie zencarauction.com sets, what each one is for, and how long it lasts. It is short because the list is short: the site uses cookies to sign you in and keep you safe, and for nothing else.
1. What cookies are
A cookie is a small file a website asks your browser to store and to send back on the next request. Without them a website cannot tell one request from another, which is why signing in is impossible without at least one.
Cookies marked httpOnly below cannot be read by any script running on the page, including ours. They exist only to be handed back to our server on the next request.
2. The cookies we set
Every cookie in the table is set by zencarauction.com itself. There are no third-party cookies on this site: no advertising network, no tag manager, no analytics provider, no embedded social media widget sets anything in your browser here.
| Cookie | Purpose | Category | Lifetime |
|---|---|---|---|
| better-auth.session_token | Keeps you signed in between requests. httpOnly. Deleting it signs you out. | Strictly necessary | 24 hours, extended while you are active |
| zca_device | Recognises a browser you have signed in from before, so we can email you when your account is used from a new one. httpOnly, and holds a random value tied to nothing else about you. | Strictly necessary | 1 year |
| zca_2fa_method | Remembers whether to ask you for an email code or your authenticator app first, so the sign-in screen opens on the right one. Holds that single choice and nothing more. | Functional | 1 year |
| zca_impersonator | Set only while a ZCA support member is viewing a dealer account on that dealer's behalf, so the session can be returned to the staff account afterwards. Never set during ordinary use. | Strictly necessary | Only while a support session is open |
| zca_anon_id | Counts the free market-price lookups a visitor without an account has used. Stored against the lookup only as a salted hash, so the record cannot be traced back to the cookie. | Functional | 1 year |
3. What we do not do
We do not use cookies for advertising, retargeting, cross-site tracking, audience building or profiling, and we do not share cookie data with anyone for those purposes.
This is also why you are not asked to accept a cookie banner. Under the ePrivacy rules a banner is required for cookies that are not strictly necessary; the two functional cookies we set — the one that remembers which second factor to ask you for, and the one that counts free market-price lookups — exist to make the service work as you asked, hold no profile and follow you nowhere. If that ever changes, a consent gate will land in the same release as the cookie that needs it, before it is set.
We do not currently respond to browser "Do Not Track" signals, because there is no tracking here for the signal to switch off.
4. Managing cookies
Every browser lets you view, block and delete cookies for a given site, usually under Privacy or Site settings. Deleting ours is safe and costs nothing but convenience.
Two consequences worth knowing before you do. Blocking the session cookie makes signing in impossible — the platform has no other way to recognise you between requests. Deleting the device cookie makes your next sign-in look like a new device, so you will receive a security email about yourself; that is the system erring in the right direction rather than a fault.
5. Changes to this policy
The table above is maintained alongside the code that sets these cookies, and the date at the top of the page is the date of the current version. A new cookie is added to this page in the same change that introduces it.