Privacy Policy

Effective 12 Nov 2026.

This policy explains what the Morse Code One trainer at morsecodeone.com collects and how that information is used. The trainer is the whole site. It is operated by Morse Code One LLC ("we", "us"). Contact is by email only, at [email protected]. There is no postal address.

The short version

• You don't need an account. Without one, practice stays in this browser. Nothing about that practice is sent to the server.
• If you choose to sign in, the server stores your email address, your practice history, your My Course progress, your settings, and a list of signed-in devices, so they can show up on each device you sign in on. That is what they are used for.
• Sign-in is an emailed code, not a password. The code is stored only as a hash and expires after 10 minutes. After it is accepted, this browser keeps a bearer token and sends it with later requests.
• Online Jeopardy rooms hold the name or call sign you type, the answers you send, and chat, only while the room exists. A room and everything in it is deleted 2 hours after it was last used.
• There are no ads. Visit counts come from Cloudflare Web Analytics. They are cookieless and aggregate, and they are not a profile of you. We do not sell or share your account.
• You can download or delete your account data from Settings, then Account.

What we collect if you sign in

• Your email address, to send the sign-in code and to identify the account. The message comes from [email protected]. Replies go to [email protected].
• A one-time code. The server stores a SHA-256 hash of the code together with the email, not the code itself, so a copy of the database cannot be typed back in as the code. The code expires after 10 minutes. It is deleted 24 hours after it expires. Five wrong tries and it stops working. Asking for a new code replaces the old one.
• A bearer token for this device. When the code is right, the server makes a random token, stores only a SHA-256 hash of it, and sends the token to the browser. The browser keeps it in local storage and sends it as Authorization: Bearer. It is not stored in a cookie. Signing out deletes that device's row, which makes the token stop working.
• Your practice history: the date, length, and type of each practice session, the speeds you practiced at, how many characters you copied or sent correctly (overall and character by character), measurements of your sending (speed and spacing), and summaries of practice QSOs.
• Your QSO station details, if you enter them: call sign, name, and QTH.
• Your My Course progress, if you use My Course: the course and level you picked, your class days, times, and first class date (and your Pre-Class dates, if you have one), and for each homework task the dates you ticked it done or played, how many times you redid it, and the speed you picked.
• Your settings: the choices you make in each tool, such as speeds, tone pitch and volume, key type, and each tool's own options (for example the characters you practice and how well you've done on each in Instant Character Recognition). The adapter, the key input, and radio sidetone stay on that device. A practice session still in progress stays on that device.
• A list of the devices you've signed in on. Each row has a short label built in the browser (for example "Windows · Edge", with " (app)" if you are in the installed app), the date it signed in, and when it was last used. The full browser string is not stored. "Last used" is written at most once an hour.

The server does not ask for your name, location, or anything else unless you type it into the QSO station details or an online Jeopardy room yourself.

Sign-in checks, and the hits log

Starting sign-in uses Cloudflare Turnstile, the "I'm human" check. The check sends the network (IP) address to Cloudflare along with Turnstile's own token.

To slow down abuse, the server keeps a hits log: a counter of recent requests, one row per event. Sign-in rows are keyed by network address and by email address. Checking a code is counted by network address. Creating an online Jeopardy room is counted by network address. Each row is a key and a time. It is not your practice.

A hits row is deleted once it is 24 hours old (at is more than 24 hours ago). A sign-in code is deleted 24 hours after it expires (expires is more than 24 hours ago), not 24 hours after it was created. That cleanup is forgetOld, and it runs when someone starts sign-in.

Online Jeopardy rooms

You don't need an account to host or join an online Jeopardy game. While the room exists, the rooms service keeps:

• The name or call sign you enter, shown to the other players in that room.
• The game itself: the board, whose turn it is, the group score, and the answers players send (what the app decoded from each player's keying). Other players see the group result. Each player's own answer is shown to that player.
• Chat messages you type, shown to the other players with your name and the time. The room keeps the last 50 messages. They are deleted with the rest of the room.
• A short-lived hits row when a room is created, including the network address it came from, in the same log as sign-in. Those rows are deleted once they are 24 hours old, by the same forgetOld cleanup.

A room is deleted, with everything in it, 2 hours after anyone last used it. Rooms are not linked to accounts, and nothing from a room is added to your practice history.

Visit counts

Page views and visits are counted with Cloudflare Web Analytics. A small script sends a beacon when a page loads and when you leave it. The script does not use cookies or local storage, and it does not build a profile of you.

The counts are aggregate. They include the page address, the referring site, and coarse labels: country, browser, operating system, and device type (such as desktop, phone, or tablet), plus page-speed measurements (Core Web Vitals). As with any website, your network address reaches Cloudflare as part of the request. Web Analytics does not use it to identify or track you, and the counts are not tied to your account.

How we use it

Only to sign you in, keep your practice history, My Course progress, and settings in sync across your devices, run Jeopardy rooms, and limit abuse. The trainer does not use this information for advertising. It does not email you anything except the sign-in codes you ask for.

Who can see it

You can. Individual accounts are not browsed for curiosity. They are opened only to fix a problem you reported, to protect the service from abuse, or when the law requires it.

The site, the database, sign-in email, and visit counts are handled by Cloudflare, Inc. Cloudflare also provides Turnstile and Web Analytics. Cloudflare handles this information under its own privacy policy: Cloudflare's Privacy Policy.

The trainer does not sell, rent, or share your account with anyone else.

How long we keep it

The account and the practice stored with it stay until you delete them. You can:

• Download your data (Settings, then Account, then Download my data) as a JSON file. It includes the account, device labels and dates, practice sessions, My Course, and settings. It does not include the bearer token or the sign-in code.
• Clear your practice history on every signed-in device (Progress, then Clear history, while signed in). That removes the stored sessions. It does not delete the account, the course, or the settings.
• Sign out one device, or this device (Settings, then Account). That deletes the device row, so its token stops working.
• Delete your account (Settings, then Account, then Delete account). This removes the account, practice history, My Course progress, settings, every device row, and unused sign-in codes for that email. Practice already saved in a browser stays in that browser until you clear it there.

Deleting the account does not instantly erase the hits log. A hits row can still contain the email address or the network address until it is 24 hours old and forgetOld runs on a later sign-in.

Security

Sign-in uses one-time codes instead of passwords. Codes and bearer tokens are stored only as SHA-256 hashes. Sign-in and new rooms are rate-limited. Traffic uses HTTPS. No system is perfectly secure.

Children

The trainer isn't directed to children under 13, and it doesn't knowingly collect personal information from them. If you believe a child under 13 has created an account, write to [email protected] and the account will be deleted.

Changes to this policy

If this policy changes, the date at the top changes with it. If a change materially affects how your information is used, the app says so in its "What's new" note.

Contact

Questions or requests by email only: [email protected]. There is no postal address.

The terms of use are at /terms/.