Privacy Policy

Last updated: 30 September 2026

This is a plain-language description of what this application actually stores and why — written to be accurate to the code, not a substitute for legal advice. If you're deploying this for real users beyond a student project, have this reviewed against the privacy law that applies where your users are (for example Lesotho's Data Protection Act, 2011, POPIA or GDPR) before relying on it.

The short version

We store your account, your games and your tournament results.
We record page views and IP addresses (with an approximate city and country) for everyone who visits, signed in or not.
Your display name and win/loss record are public — anyone can see them, even without an account.
We set no cookies and run no advertising or third-party analytics.
You can delete your account, but a few records stay behind (see "Deleting your account").

What we collect

If you create an account

Your display name and email address
A bcrypt hash of your password — we never store or can recover your actual password
Whether you've verified your email, when you joined, and when you were last seen
Your games (players, board state, moves in progress, result, score) and your wins and losses
Tournaments you joined, your matches, results, placings and any prize recorded against you
Challenges you send or receive

Presence ("online now")

While a signed-in page is open, your browser pings the server about every 25 seconds. You show as online if we've heard from you in the last two minutes.

What other people can see

The leaderboard is public. Anyone, including visitors without an account, can see your display name, wins, losses, win rate, rank, when you joined, and whether you're online.
Once a tournament has started, every signed-in account can see its bracket, including participants' names, results, scheduled times, who has joined a match, and who was eliminated for being late or absent. Before it starts, only participants and administrators can see the list of entrants.
The "Recent Wins" list on the game page shows winner names and times to everyone.
Other players never see your email address.

Activity log (visible to administrators only)

Notable actions — signups, logins, failed logins, logouts, profile changes, password resets, email verification, games started and finished, challenges, tournament activity and admin actions — are logged with a timestamp and the IP address the request came from. A failed login records the email address that was typed, even if no such account exists. This exists to investigate abuse and account problems.

Page-view and usage analytics (first-party)

On every page except the admin panel we record:

the page visited, the referring page, and how long the page was open
your IP address, and the approximate country and city derived from it
a random session identifier kept in your browser's local storage (not a cookie)
named clicks such as "Play now" or "Sign in", and — if you're signed in — a link to your account

This is used to understand how the site is used. Guests are included: playing without an account does not stop page views or IP addresses being recorded.

Guest games

A game started without an account is counted in an anonymous "guest games" tally (a game ID and a timestamp). The game itself, and the activity and analytics records described above, can still carry the IP address of the request.

Emails we send

We email you to verify your address, to reset your password when you ask, and about tournaments you've entered: match scheduled, automatic advancement, elimination for lateness, and final placing or prize. We don't send marketing email. If outgoing mail isn't configured on the server, these messages — including password-reset and verification links — are written to the server's console log instead, where the site operator can read them.

Server logs

The web server logs each request (including IP address and path) and keeps error and operational logs. These are accessible to the site operator, and errors can be viewed by administrators in the admin panel.

What's stored in your browser

We don't set cookies. We use your browser's localStorage for: your session token and basic account info (so you stay signed in), the random analytics session ID, whether sound effects are muted, and the player names you last used on the game setup screen. Clearing site data removes all of it.

Third parties

Google Fonts. Pages load fonts from Google, so your browser contacts Google's servers and Google sees your IP address.
ipwho.is. To work out a visitor's approximate country and city, the server sends the visitor's IP address to this geolocation service. The result is cached alongside the IP address in our database.
Hosting and database provider. The site and its database run on infrastructure operated by a hosting provider, which processes the data on our behalf and may be located in another country.
Email provider. If SMTP is configured, the emails listed above pass through that provider.

We don't sell your data or share it for advertising.

How it's used

To run the features you'd expect: sign-in, stats and rank, challenges, tournaments and their notifications, and keeping the service secure. Analytics and activity logs are used to understand usage and investigate abuse.

How long we keep it

Sessions expire after 30 days (or when you sign out). Password-reset links expire after 60 minutes and verification links after 24 hours.
Account data and game history are kept until you delete your account.
Activity-log entries, page views, analytics events, the IP-geolocation cache and server log files have no automatic expiry at present.
Database backups are kept for 14 days by default, so deleted data can remain in a backup for up to that long.

Deleting your account

Settings → Danger zone → Delete account removes your profile, sessions, challenges, tournament entries and pending tokens, and takes you off the leaderboard. Some records are unlinked from you rather than erased:

Finished games remain as records, still showing the player names used at the time, but no longer count towards anyone's stats.
The "Recent Wins" list may keep the winner's name.
Tournament brackets keep the match slots, with your name removed.
Activity-log entries and page views stay, no longer linked to an account, but descriptions may contain your name and rows contain IP addresses.

If you'd like any of these scrubbed as well, contact the site administrator.

Security

Passwords are hashed with bcrypt; session and reset tokens are stored only as SHA-256 hashes; sign-in and API requests are rate-limited. Your session token lives in your browser's local storage, so protect your device and use the site over HTTPS. No system is perfectly secure, and we can't guarantee absolute security.

Children

Morabaraba isn't aimed at young children and we don't verify ages. If you believe a child's account exists, contact the site administrator and we'll remove it.

Your choices

Change your display name, email or password in Settings.
Sign out of every device from Settings → Danger zone → Sign out everywhere.
Delete your account from the same page.
Play as a guest without an account (page views and IP logging still apply).
Ask the administrator for a copy of your data or for a correction.

Changes

We'll update the date at the top when this policy changes. Continued use after a change means you accept the updated policy.

Contact

Questions about this policy or your data can be sent to the site administrator listed on the project's repository.