Bowler profile claiming (Pro)

Bowlers can claim their profile page, giving you a verified email relationship with them, and giving them a manage link to set email preferences and submit their own profile photo. Pro feature.

How a claim gets approved

• Claim slips (instant). On the Bowlers page, pick a league and click Print Claim Slips, one QR slip per unclaimed bowler. Hand each slip to its bowler in person. Scanning lands them on their claim page with the code pre-applied; they enter their email, confirm a 6-digit code we email them, and the claim approves instantly. Handing over the slip in person is the identity check.
• Without a slip (reviewed). Every public profile has an “Is this you?” link. Claims made there still verify the email, then wait in the Profile Claims queue on the Bowlers page for your approve/reject, you know your bowlers.

You can also print a single bowler’s claim slip from their edit modal, and revoke any claim there too. Codes are one-time and expire after 90 days.

What the bowler sees

Scanning the QR on their slip takes them to their own profile, where they enter an email address and can add a photo. We send a six digit code, they type it in, and the claim is done.

The screen that confirms it has a button straight through to their profile settings, so adding a nickname or saying which hand they bowl with is the next thing they do rather than something they have to come back for. Their personal link is emailed to them as well, for whenever they want to change something later.

What a claimed bowler can change

From their personal manage link, a claimed bowler can set their nickname (shown in quotes under their name on their profile card) and whether they bowl right or left handed. These apply immediately. Nicknames are limited to 30 characters with any HTML or links stripped out, and you can always correct or clear them from Bowlers → edit, or revoke the claim entirely.

Everything else on the profile stays operator-controlled, and a bowler’s edits never affect score imports: name matching runs off the league roster names, not the nickname.

Nicknames are checked before they appear

A nickname is the one piece of free text a member of the public can put on a public page of your site, so PinPortal checks it. Profanity and slurs are refused, including the obvious ways round a word list: spacing a word out, punctuating it, swapping digits for letters, or stretching it. The bowler is told to pick another and asked to speak to you if they think it is wrong.

Just as much care goes into not refusing real nicknames. A team called Thorpedo contains a blocked word, so does the league Spicy Seniors, and so do surnames like Cockburn and Fagan. Long unmistakable words are matched anywhere; short ones only as whole words, so Thorpedo is fine and Pedo is not. Surnames whose offensiveness depends on context, like Lynch and Dyke, are not blocked at all.

Add your own words under Settings, Nickname word list, one per line. They are matched anywhere inside a nickname, so keep them long enough not to catch ordinary words.

You can always overrule it. Set or clear any nickname yourself from Bowlers, edit, which is not filtered: somebody who knows the bowler is a better judge than a word list, and that is the way out if a real nickname is ever refused.

Affiliations

Set up the organisations your bowlers belong to under Bowlers, Affiliations: USBC, a state association, a travelling league, whatever applies at your center. Bowlers pick from your list when they set up their profile and it shows as a badge on their profile card. They cannot add their own, which is the point of the list.

You can confirm a bowler’s membership. A confirmed one is marked as such; one nobody has checked is still shown, because it is the bowler’s own statement about themselves.

About logos

PinPortal does not supply any logos. Naming an organisation to describe a real membership needs nobody’s permission, and a name on its own is all most centers will want. Shipping a governing body’s trademark inside software sold to every center is a different matter, and not a risk we think belongs to you.

If your center has permission to display an organisation’s logo, upload it against that affiliation. Confirming that you have permission is a required step rather than a warning you can click past: without it the file is not stored at all, and your confirmation is recorded with your name and the date.

A logo only ever appears beside a bowler whose membership you have confirmed. An unchecked claim never carries a logo, because a governing body’s mark next to an unverified claim of membership is exactly the thing a governing body would object to.

Removing an affiliation from your list deletes its logo and every bowler’s claim to it, which is what you want if you are ever asked to stop using a mark.

None of this is legal advice, and whether you may use a particular logo is between your center and that organisation. Many governing bodies run a badge programme for certified centers with artwork and written terms, which is worth an email before you upload anything.

Photos from bowlers

Claimed bowlers can submit a profile photo from their claim or manage page. Photos never appear until you approve them in the Profile Claims queue; rejecting deletes the file and emails the bowler.

Keeping bots out

Both of these forms are open to anybody on the internet, so both are protected. Before a submission is accepted, the visitor’s browser has to complete a small piece of work: a calculation that takes a fraction of a second and starts the moment the page loads, so it is finished long before anybody has typed their email address.

Your bowlers see nothing. There is no puzzle, no pictures of traffic lights to identify, and nothing extra to click. There is also nothing for you to set up: no accounts, no API keys, and no third-party service, which means nothing about the people visiting your website is sent anywhere else.

What it changes is the arithmetic for somebody trying to flood you. Every single attempt costs them that same fraction of a second, and an answer can only be used once, so a thousand submissions cost a thousand times as much as one. Combined with the emailed code, which already means nothing reaches your queue until the address is confirmed, that turns an unlimited flood into a slow trickle.

It cannot stop a determined person filling your queue in by hand, and no CAPTCHA on the market stops that either. If it ever happens, decline the lot and speak to us.

Safety notes

• Email verification alone never approves a claim: only a slip or your review does.
• Youth-league bowlers have no public profiles and can never be claimed.
• Claim endpoints are rate-limited and answer generically, so outsiders can’t probe which profiles exist or are claimed.
• Erasing a bowler from the privacy tools also deletes their claim, email, and any pending photo.

If verification emails don’t arrive

Claim emails are sent by your WordPress site. Gmail (and increasingly other providers) silently discards mail from domains with no email authentication, it won’t even reach spam. If bowlers with Gmail addresses aren’t getting codes, your domain is almost certainly missing SPF/DKIM records:

• In cPanel, open Email Deliverability and click Repair, it installs the SPF and DKIM records for you. (Your host’s support can do this in minutes if you ask for “SPF and DKIM for my domain”.)
• Alternatively, install an SMTP plugin such as WP Mail SMTP and send through an authenticated mailbox on your domain.

Test with a Gmail address after fixing, if Gmail delivers, everything will.