Accounts and Roles

Accounts and Roles

hailsDotGO accounts unlock the community features: shiny tracking, the trainer directory, the raid finder, and the store. Registration is invite-driven by default, sessions last 30 days, and a small role ladder (user, tester, moderator, admin, superadmin) plus a few independent flags control what each account can do. This page covers registration, login, email confirmation, password reset, profile settings, the role system, and the weather boost perk.

Registration

• Closed by default. The registration_open site setting ships as off; an admin can open public registration from the admin panel (see Admin Guide).
• Invite links work even while registration is closed: /register?invite=TOKEN. Tokens are 8 characters from an unambiguous alphabet (no 0/O or 1/I/L), expire after 7 days, and can be single-use or multi-use (up to 50 uses).
• An invite can carry a granted role. Multi-use invites can only grant the plain user role, and staff invites (moderator, admin) must be single-use. A tester invite applies the role immediately; moderator and admin invites only set a pending role, which an existing admin must confirm or reject before it takes effect.
• Registration requires a username, an email address, and a password. Posting to /register is rate limited to 5 attempts per minute per IP.
• Signing up sends a confirmation email to the address (see Email confirmation below). Registration never fails because of mail problems; the email is best-effort.

Username and password rules

Field	Rule
Username	2 to 32 characters; letters, digits, _, and - only; unique
Email	Required, unique; validated server side (bare address form, 254 characters max)
Password	Minimum 8 characters; stored as a bcrypt hash (cost 13)

Login and sessions

Logging in (rate limited to 10 attempts per minute per IP) creates a server-side session: a 64-character hex token in the sessions table with a 30-day expiry, delivered as the hgo_session cookie (HttpOnly, Secure, SameSite=Lax). Logging out deletes the session server-side. Disabled accounts cannot log in; the login page shows the suspension reason if staff recorded one, and disabling an account also revokes all of its active sessions.

Email confirmation

New accounts receive a confirmation email with a link valid for 24 hours. Until it is clicked, a small banner on every page reminds you to confirm, with a one-click resend button (rate limited to 2 per minute per IP, plus a 5 minute per-account cooldown that quietly reuses the outstanding link instead of issuing a new one). This is a soft verify: nothing is gated on it, and every feature keeps working while unconfirmed. Accounts created before the feature existed are treated as already confirmed. Requesting a new link invalidates older unused ones, and links are single-use.

Password reset

Lost passwords are self-service. The login page links to /forgot-password, where you enter your account email; if it matches an account, a reset link valid for one hour arrives by email. Requests are rate limited to 3 per minute per IP, and the page shows the same response whether or not the address matched, so account existence cannot be probed. The link opens a form for the new password (minimum 8 characters, same rule as registration).

Reset links are single-use and stored only as SHA-256 hashes, so a database leak exposes nothing usable. Completing a reset retires every other outstanding reset link for the account and signs it out of all devices. Staff can still reset a user's password from the admin panel as before (see Admin Guide); the transactional email settings live in Configuration.

Profile settings

Everything below lives on /settings:

Setting	Notes
Trainer name	Your in-game name, up to 16 characters, unique across the site. Required (along with the trainer code) to use the Raid Finder.
Trainer code	Your 12-digit friend code (spaces are stripped), unique across the site. Only shared through the raid lobby flow, never shown publicly.
Avatar	Pick a trainer class sprite: classic Showdown classes or the GBA-style Dreamstone set (see Data Sources).
Pronouns	Preset choices or a custom value up to 32 characters.
Favorite Pokemon	Any known species, optionally in shadow, shiny, or primal form; shown on your directory card.
Location	City, region, and country. Powers the weather boost feature below.
Location privacy	none (default, never shown), country, or full. Controls what the Trainer Directory displays; the raw values stay private.
Public profile	All non-hidden accounts appear in the directory. Rank badge, staff/special rank/donator badges, trust tier, user tags, and awards are always visible regardless of this toggle. Turning this off hides your trainer name, pronouns, and location from your directory card. Trainer code and shiny collection visibility are controlled by their own separate toggles.
Shiny collection hidden	Hides your personal shiny collection from public view. Other users cannot see the collection on your trainer profile page or browse which specific shinies you have caught.
Language	Your preferred locale for the whole site (see Localization).

Role ladder

Roles are stored in users.role; the superadmin is special-cased by username.

Role	How it is assigned	What it adds
user	Default	All member features
tester	Invite or admin role change	A tester badge; fixed "PKMN Scientist" raid rank; slightly higher trust report weight
moderator	Admin-confirmed invite or admin role change	Admin panel (moderation subset): user management, tag assignment, tag request review, awards and trust inspection, lobby moderation. Counts as staff everywhere.
admin	Admin-confirmed invite or admin role change	Everything moderators have plus site settings, invites, role changes, store and award catalog management, translation review, trust adjustment
superadmin	The account whose username matches the SUPERADMIN_USER environment variable	Everything, always; plus superadmin-only actions (tag catalog create/edit/delete, granting api_access and translator flags, forced data refresh)

Notes:

• "Staff" checks (IsMod) include moderators, admins, and the superadmin.
• Other admins cannot target the superadmin: no rename, password reset, disable, role change, special rank change, or pending-role edits. The superadmin can reset their own password, rename their own account, and set their own special rank from the panel. Staff members in general cannot be raid-banned or hidden from the directory (see Admin Guide).
• Demoting an admin away from the admin role automatically revokes their api_access flag.

Additional flags

These are independent of the role ladder:

Flag	Granted by	Effect
translator	Superadmin (direct toggle in Users tab), or any Admin+ by accepting a translator application	Access to the /translate workspace (see Translator Workspace). The superadmin is always a translator.
api_access	Superadmin only	Access to the private API tier and POST /api/refresh (see API Reference). Can be granted to any account; the superadmin always has it. Demoting an admin to a lower role automatically revokes the flag.
special_rank	Admins	Either trusted or content_creator. Both unlock custom raid lobbies and show a badge (a check mark for Trusted, a clapperboard for Content Creator).

Badges around the site

Wherever usernames appear (directory cards, raid lobbies), the site shows:

• Staff icons: a crown for the superadmin, a gem for admins, a medal for moderators, and a test tube for testers.
• Special rank badges: Trusted and Content Creator, as above.
• Trust tier: Trusted, Neutral, or Caution, from the trust engine (see Trust and Awards).
• Raid rank: the XP ladder title (Youngster through League Master). Staff get fixed titles instead: PKMN Scientist (tester), PKMN Researcher (moderator), PKMN PROF (admin and superadmin). See Raid Finder.
• Tags: colored label pills assigned by staff or earned through the Store custom tag flow.
• Awards: community recognitions visible on trainer profile pages (see Trust and Awards).

Social relationships

Logged-in users can follow other trainers and manage blocked accounts. Follows are managed through trainer profile pages (/trainer/{username}); blocked users are also managed from the Settings page.

Following and Friends

Follow is one-directional, following someone means you see their raid notifications, but they do not automatically follow back. When two users both follow each other they become Friends (mutual follows).

• Follow / Unfollow buttons appear on /trainer/{username}
• View your social connections at /social/{username}, three tabs: Friends (mutual), Followers, Following
• The old /friends URL redirects to your own Connections page
• Your own trainer profile shows a Following preview (5 most recent) linking to the full Connections page

Blocked users

Blocking a user removes any existing friendship in both directions and prevents them from adding you as a friend. Manage your blocked list under Settings > Blocked Users, which includes a live search by username or trainer name. You can also block directly from a trainer's profile page.

Notifications

When someone you follow opens a raid lobby, a toast notification appears across all pages and the notification badge in the nav increments. The dedicated /notifications page lists all currently active raids from trainers you follow. See Social Features for the full picture.

Weather boost

Logged-in users who saved a location get live in-game weather on the trainers page via GET /api/weather. The server geocodes the city through Open-Meteo, reads the current WMO weather code and wind speed, and maps them to a Pokemon GO condition; wind of 36 km/h or more upgrades clear, partly cloudy, or overcast skies to Windy, while rain, snow, and fog always win. Results are cached until the next half-hour boundary, when in-game weather rolls over. The boosted types follow the in-game table:

Condition	Boosted types
Clear	Fire, Grass, Ground
Partly Cloudy	Normal, Rock
Overcast	Fairy, Fighting, Poison
Rainy	Water, Electric, Bug
Snow	Ice, Steel
Fog	Dark, Ghost
Windy	Dragon, Flying, Psychic