Training Module 15 — Security Settings & Account Management

GoClubPro User Training | Area: Security / Account

---

What Users Need to Learn

Security settings protect each user's account. Users need to understand:

• How to change their password
• How to set up and manage MFA (multi-factor authentication)
• How to manage active sessions
• How to delete their account
• What data is retained after account deletion
• How to handle a compromised account

---

1. Step-by-Step Walkthrough

Changing Your Password

1. Go to your Player Profile (click your name/avatar in navigation).
2. Click the Security tab.
3. Click Change Password.
4. Enter:

• Current password
• New password (minimum 8 characters)
• Confirm new password

5. Click Save — password changes immediately.
6. You remain logged in; other sessions are not affected unless you choose to sign out all devices.

Setting Up MFA (Multi-Factor Authentication)

1. Go to Profile → Security tab.
2. Click Enable MFA.
3. Download an authenticator app if you haven't already:

• Google Authenticator (iOS/Android)
• Authy (iOS/Android)
• Microsoft Authenticator (iOS/Android)

4. Scan the QR code shown on screen with your authenticator app.
5. Enter the 6-digit code from your authenticator to verify the setup.
6. Save your backup codes — copy them to a secure location (password manager, printed paper in a safe).
7. Click Confirm — MFA is now active.
8. On future logins: after entering your password, you'll be prompted for the 6-digit authenticator code.

Using a Backup Code

If you can't access your authenticator app:

1. On the MFA prompt screen, click Use backup code.
2. Enter one of your saved backup codes.
3. You're logged in — use this session to re-set up MFA with a new authenticator.
4. Each backup code is single-use — cross it off your list once used.

Disabling MFA

1. Go to Profile → Security tab.
2. Click Disable MFA.
3. Enter your current authenticator code (or a backup code) to confirm.
4. MFA is disabled.
5. Note: If your Club Admin has set MFA as mandatory, you will need to re-enable it.

Viewing and Managing Active Sessions

1. Go to Profile → Security tab.
2. Scroll to Active Sessions.
3. You'll see a list of all devices/browsers currently logged in with:

• Device type (mobile, desktop)
• Browser
• Last active timestamp
• Location (approximate, based on IP)

4. Click Sign Out next to any suspicious session to terminate it remotely.
5. Click Sign Out All Other Devices to terminate all sessions except your current one.

Deleting Your Account

⚠️ This is permanent and irreversible.

1. Go to Profile → Security tab.
2. Scroll to the bottom — Delete Account section.
3. Click Delete My Account.
4. Read the warning carefully — it explains what data will be deleted.
5. Enter your password to confirm.
6. Click Confirm Delete.
7. Your account, personal data, and club memberships are permanently deleted.
8. Financial records may be retained for a statutory period per your jurisdiction's requirements.

---

2. Simple Explanation (Beginners)

Security settings protect your GoClubPro account from unauthorised access. The two most important things:

1. Strong password — hard to guess, unique to this app.
2. MFA — a second check (like a code from your phone) that blocks anyone who steals your password from getting in.

Think of MFA as a deadbolt on top of your door lock — the regular lock (password) is good, but the deadbolt (MFA) makes it much harder to break in.

---

3. Advanced Explanation (Power Users)

MFA implementation: GoClubPro uses TOTP (Time-based One-Time Password) — the industry standard. Compatible with any TOTP authenticator app. Codes are valid for 30 seconds; the system accepts codes from the current and adjacent time windows to account for clock skew.

Session management: Sessions are JWT-based with configurable expiry. Active sessions list shows all current valid tokens. Signing out a session revokes the token immediately — that device is logged out on next API call.

Backup codes: GoClubPro generates 8 single-use backup codes at MFA setup. Each code is a 16-character alphanumeric string. Once all backup codes are used, new ones can be generated from the Security tab (requires MFA authentication to do so).

Admin-enforced MFA: Club Admins can require MFA for specific users or all users with a certain role (e.g., all Treasurers must have MFA). If enforced, users cannot access the app without completing MFA setup.

Password policies: Minimum 8 characters. No maximum. All characters accepted. Passwords are hashed with bcrypt — not stored in plain text. GoClubPro staff cannot see your password.

Account deletion compliance: Account deletion triggers a GDPR/Australian Privacy Act compliant deletion process:

• Personal data (name, email, DOB, phone) is immediately deleted.
• Profile data (avatar, custom fields) is deleted.
• Club memberships are removed.
• Financial records are anonymised (amounts retained, PII stripped) for statutory record-keeping.

---

4. Visual Description (Text-Based)

┌─────────────────────────────────────────────────────────┐
│ PLAYER PROFILE → SECURITY │
│ │
│ ─── PASSWORD ─────────────────────────────────────── │
│ Last changed: 45 days ago │
│ [ Change Password ] │
│ │
│ ─── MULTI-FACTOR AUTHENTICATION ─────────────────── │
│ Status: ✅ ENABLED │
│ Authenticator app: Google Authenticator │
│ │
│ Backup codes: 6 remaining (2 used) │
│ [ View Backup Codes ] [ Regenerate Codes ] │
│ [ Disable MFA ] │
│ │
│ ─── ACTIVE SESSIONS ──────────────────────────────── │
│ 📱 iPhone 15 · Safari · Melbourne, VIC · 2 min ago │
│ [current] │
│ 💻 MacBook Pro · Chrome · Melbourne, VIC · 1 day ago │
│ [ Sign Out ] │
│ 💻 Unknown · Firefox · Sydney, NSW · 8 days ago ⚠ │
│ [ Sign Out ] │
│ │
│ [ Sign Out All Other Devices ] │
│ │
│ ─── ACCOUNT DELETION ─────────────────────────────── │
│ ⚠ Permanently delete your account and all data │
│ [ Delete My Account ] │
└─────────────────────────────────────────────────────────┘

---

5. Tooltips & Hints

---

6. FAQ — Security Settings

Q: I lost my phone and can't access my authenticator. What do I do? A: Use one of your saved backup codes to log in. Once in, go to Security → Disable MFA, then re-enable it with a new authenticator on your new phone.

Q: I used all my backup codes and lost my phone. I'm completely locked out. A: Contact your Club Admin — they can raise a support request to reset your MFA. Identity verification will be required.

Q: Should I enable MFA even if my club doesn't require it? A: Yes — strongly recommended. Especially for Treasurers, Club Admins, and anyone with access to financial or personal data.

Q: What counts as a "suspicious session" I should sign out? A: Any session from an unfamiliar device, browser, or location that you don't recognise as your own activity. If in doubt, sign it out and change your password.

Q: Can someone else delete my account? A: No — account deletion requires your password. Even Club Admins and Platform administrators cannot delete a user's account (they can only remove them from the club).

Q: If I delete my account, do my payment records disappear? A: Personal data (name, contact info) is deleted. Financial records are anonymised (the payment amounts and dates remain for accounting purposes, but your identity is removed from them).

Q: I changed my password but someone is still logged in on another device. A: Changing your password alone doesn't terminate other sessions. Go to Active Sessions → Sign Out All Other Devices to terminate all existing sessions after changing your password.

---

7. Common Mistakes & How to Avoid Them

---

8. Short Onboarding Script

Security Settings — Protect Your Account

Two things to do right now:

1. Enable MFA — takes 2 minutes, protects your account permanently.
2. Save your backup codes — emergency access if you lose your phone.

Check Active Sessions occasionally to see where your account is logged in. Sign out anything you don't recognise.

---

9. Long Training Guide

Why MFA Matters for Club Members

Sports club apps hold real financial data (your payment records), personal information (your DOB, phone, emergency contacts), and operational data (squad selections, fixture details). This makes them more valuable to attackers than a typical social media account.

MFA eliminates the most common account attack vector: password compromise. Even if someone obtains your password (via phishing, data breach, or guessing), they cannot log in without the rotating code from your physical device.

Setting Up MFA Step by Step (Expanded)

1. Download Authy (recommended) or Google Authenticator from your app store.
2. In GoClubPro: Profile → Security → Enable MFA.
3. A QR code appears on screen.
4. Open your authenticator app → tap the + button → Scan QR code.
5. Point your phone camera at the QR code — a new entry appears in the app for "GoClubPro".
6. Enter the 6-digit code shown in the app into GoClubPro's verification field.
7. GoClubPro shows your 8 backup codes.
8. Write them down or save to a password manager — screenshot is risky if your phone is stolen.
9. Click Confirm — MFA is active.

Authy advantage: Unlike Google Authenticator, Authy backs up your authenticator accounts to the cloud (encrypted). If you lose your phone, Authy can restore your codes on a new device. Recommended for users who frequently change phones.

Recovering from a Compromised Account

If you suspect your account has been accessed by someone else:

1. Immediately: Change your password.
2. Then: Go to Active Sessions → Sign Out All Other Devices.
3. Check: Review your payment history for unauthorised transactions.
4. If payments are suspicious: Contact your Treasurer immediately.
5. If contact info was changed: Contact your Club Admin — they can verify your identity and restore access.
6. Consider: Enable MFA if not already done.

Account Deletion — What You Need to Know

Before deleting your account:

• Pay all outstanding fees (they become harder to resolve after deletion)
• Note that your statistics and match history will be removed
• Inform your Club Admin you're leaving
• If you're a Coach or Admin: ensure responsibilities are handed to another member first
• If you want a copy of your data: request a download (Profile → Download My Data) first

Account deletion cannot be undone. If you're just leaving a club (not GoClubPro entirely), ask your Admin to remove you from the club rather than deleting your full account.

---

10. Micro-Training (Quick Tips)

⚡ QUICK TIPS — Security

✅ Enable MFA immediately — it takes 2 minutes
✅ Save backup codes offline (not just on your phone)
✅ Use Authy if you frequently change phones
✅ Review Active Sessions monthly for unfamiliar devices
✅ Change password if you see anything suspicious
✅ Never share your login credentials with anyone

---

11. Troubleshooting

---

Module 15 of 15 — Core Training Complete

---

Training Index — GoClubPro