Accounts and Roles

Accounts and Roles

hailsDotGO accounts unlock the community features: shiny tracking, the trainer directory, the raid finder, and the store. Registration is invite-driven by default, sessions last 30 days, and a small role ladder (user, tester, moderator, admin, superadmin) plus a few independent flags control what each account can do. This page covers registration, login, profile settings, the role system, and the weather boost perk.

Registration

• Closed by default. The registration_open site setting ships as off; an admin can open public registration from the admin panel (see Admin Guide).
• Invite links work even while registration is closed: /register?invite=TOKEN. Tokens are 8 characters from an unambiguous alphabet (no 0/O or 1/I/L), expire after 7 days, and can be single-use or multi-use (up to 50 uses).
• An invite can carry a granted role. Multi-use invites can only grant the plain user role, and staff invites (moderator, admin) must be single-use. A tester invite applies the role immediately; moderator and admin invites only set a pending role, which an existing admin must confirm or reject before it takes effect.
• Registration requires a username, an email address, and a password. Posting to /register is rate limited to 5 attempts per minute per IP.

Username and password rules

Field	Rule
Username	2 to 32 characters; letters, digits, _, and - only; unique
Email	Required, unique
Password	Minimum 8 characters; stored as a bcrypt hash (cost 13)

Login and sessions

Logging in (rate limited to 10 attempts per minute per IP) creates a server-side session: a 64-character hex token in the sessions table with a 30-day expiry, delivered as the hgo_session cookie (HttpOnly, Secure, SameSite=Lax). Logging out deletes the session server-side. Disabled accounts cannot log in; the login page shows the suspension reason if staff recorded one, and disabling an account also revokes all of its active sessions.

Profile settings

Everything below lives on /settings:

Setting	Notes
Trainer name	Your in-game name, up to 16 characters, unique across the site. Required (along with the trainer code) to use the Raid Finder.
Trainer code	Your 12-digit friend code (spaces are stripped), unique across the site. Only shared through the raid lobby flow, never shown publicly.
Avatar	Pick a trainer class sprite: classic Showdown classes or the GBA-style Dreamstone set (see Data Sources).
Pronouns	Preset choices or a custom value up to 32 characters.
Favorite Pokemon	Any known species, optionally in shadow, shiny, or primal form; shown on your directory card.
Location	City, region, and country. Powers the weather boost feature below.
Location privacy	none (default, never shown), country, or full. Controls what the Trainer Directory displays; the raw values stay private.
Public profile	All non-hidden accounts appear in the directory; this toggle controls whether your card shows the full rich details.
Shiny collection hidden	Hides your personal shiny collection from public view. Other users can still see your Shiny Dex entries, but cannot browse which specific shinies you have caught.
Language	Your preferred locale for the whole site (see Localization).

Role ladder

Roles are stored in users.role; the superadmin is special-cased by username.

Role	How it is assigned	What it adds
user	Default	All member features
tester	Invite or admin role change	A tester badge; fixed "PKMN Scientist" raid rank; slightly higher trust report weight
moderator	Admin-confirmed invite or admin role change	Admin panel (moderation subset): user management, tag assignment, tag request review, awards and trust inspection, lobby moderation. Counts as staff everywhere.
admin	Admin-confirmed invite or admin role change	Everything moderators have plus site settings, invites, role changes, store and award catalog management, translation review, trust adjustment
superadmin	The account whose username matches the SUPERADMIN_USER environment variable	Everything, always; plus superadmin-only actions (tag catalog create/edit/delete, granting api_access and translator flags, forced data refresh)

Notes:

• "Staff" checks (IsMod) include moderators, admins, and the superadmin.
• Other admins cannot target the superadmin: no rename, password reset, disable, role change, special rank change, or pending-role edits. The superadmin can reset their own password, rename their own account, and set their own special rank from the panel. Staff members in general cannot be raid-banned or hidden from the directory (see Admin Guide).
• Demoting an admin away from the admin role automatically revokes their api_access flag.

Additional flags

These are independent of the role ladder:

Flag	Granted by	Effect
translator	Superadmin (direct toggle in Users tab), or any Admin+ by accepting a translator application	Access to the /translate workspace (see Translator Workspace). The superadmin is always a translator.
api_access	Superadmin only	Access to the private API tier and POST /api/refresh (see API Reference). Can be granted to any account; the superadmin always has it. Demoting an admin to a lower role automatically revokes the flag.
special_rank	Admins	Either trusted or content_creator. Both unlock custom raid lobbies and show a badge (a check mark for Trusted, a clapperboard for Content Creator).

Badges around the site

Wherever usernames appear (directory cards, raid lobbies), the site shows:

• Staff icons: a crown for the superadmin, a gem for admins, a medal for moderators, and a test tube for testers.
• Special rank badges: Trusted and Content Creator, as above.
• Trust tier: Trusted, Neutral, or Caution, from the trust engine (see Trust and Awards).
• Raid rank: the XP ladder title (Youngster through League Master). Staff get fixed titles instead: PKMN Scientist (tester), PKMN Researcher (moderator), PKMN PROF (admin and superadmin). See Raid Finder.
• Tags: colored label pills assigned by staff or earned through the Store custom tag flow.
• Awards: community recognitions visible from the profile modal (see Trust and Awards).

Social relationships

Logged-in users can build a friends list and manage blocked accounts. Both are managed through trainer profile pages (/trainer/{username}) and the Settings page.

Friends

Friendship is directional: adding someone as a friend means you see notifications when they host a raid. They do not see your raids unless they also add you. Add and remove friends from the Add Friend / Remove Friend button on a trainer's profile page. View your full list at /friends.

Blocked users

Blocking a user removes any existing friendship in both directions and prevents them from adding you as a friend. Manage your blocked list under Settings > Blocked Users, which includes a live search by username or trainer name. You can also block directly from a trainer's profile page.

Notifications

When a friend opens a raid lobby, a toast notification appears across all pages and the 🔔 badge in the nav increments. The dedicated /notifications page lists all currently active raids from friends. See Social Features for the full picture.

Weather boost

Logged-in users who saved a location get live in-game weather on the trainers page via GET /api/weather. The server geocodes the city through Open-Meteo, reads the current WMO weather code and wind speed, and maps them to a Pokemon GO condition; wind of 36 km/h or more upgrades clear, partly cloudy, or overcast skies to Windy, while rain, snow, and fog always win. Results are cached until the next half-hour boundary, when in-game weather rolls over. The boosted types follow the in-game table:

Condition	Boosted types
Clear	Fire, Grass, Ground
Partly Cloudy	Normal, Rock
Overcast	Fairy, Fighting, Poison
Rainy	Water, Electric, Bug
Snow	Ice, Steel
Fog	Dark, Ghost
Windy	Dragon, Flying, Psychic