UPDATED 2 NOVEMBER 2026 · MORSO v0.9.6.1

Privacy and player data

MORSO has a ladder and tournaments for player-hosted 1v1 and 2v2 matches. Since v0.8.3 every player's own game client confirms each result directly with this website. That makes forged results much harder, but player-hosted games cannot be fully verified: the host's computer runs the match.

Who runs this

MORSO and morsomid.com are run by MORSO's developer, who decides how this data is used (the data controller; see the end of this page).
Contact: show email address.

Visiting the website

This website has no advertising, analytics trackers or optional cookies. If you sign in, one strictly necessary sign-in cookie is stored (see below). Cloudflare hosts it and processes network information, including IP addresses, to deliver pages and limit abusive requests.

Playing a ladder match

When the host chooses the ladder, the game sends your Steam account number, current display name, team, result, match duration, kills, deaths, last hits, denies, hero damage, tower damage and number of ability changes. Your own game client also contacts this website during the match: it joins the match (saying whether it is the lobby host and which player's game hosts the lobby), confirms the start, sends a heartbeat about every 90 seconds and confirms the winner. When a MORSO lobby opens, in every mode, the game also asks this website once for the ratings of the players in it (by Steam account ID) so rank medals show in the lobby, and each game checks whether it is Steam-linked; these requests record nothing. The pre-game chat stays inside the game and is not sent to this website. We do not collect your Steam password, email address, chat messages, voice chat or normal Dota matchmaking rating.

To tell apart real opponents from one player controlling both sides, the service stores a keyed one-way digest of the network address each game client used for that match (for IPv6, the shared /64 network prefix). The digest cannot be reversed into your IP address, differs between matches, is only compared between opposing players of the same match, and is deleted after two days. Since v0.9.6, during the open beta, a shared network no longer stops a match from changing MMR; the digest is still stored so the check can be switched back on after the beta. To limit abuse, the number of ladder matches registered from one network address per day is counted under a similar keyed digest that changes daily; these counters are deleted after two days.

Your display name, MORSO rating and aggregate game statistics are public on the website and in the game. A player page shows up to 20 recent results with the date, duration, win condition, the MMR change, the names and Steam account numbers of the teammates and opponents, the tournament name for games of public tournaments, and whether a player left the match. Games of private tournaments appear there too, without the tournament's name. Steam account numbers in the API identify those records and can be linked to Steam profiles. If the service has a Steam Web API key configured, display names are read from your public Steam profile instead of being taken from the host. Since v0.9.4 each player's Steam name is checked again about once a day, also after you stop playing, so a new Steam name replaces the old one within about a day; your 1v1 entry in a tournament that has not finished follows the new name unless you typed a different name for it.

Idle games

Since v0.9.3.1, when MORSO closes a game because nobody played it, each player's own game tells morsomid.com. We store your Steam account number, the time and a keyed digest of the network the report came from (the same kind as for reports below), so an account whose games close for inactivity 3 times within 24 hours sits out for 24 hours, on that network only. Your game learns about the wait through the server status check it already makes every few minutes. Idle closes older than three days are deleted whenever a new idle close is recorded. Idle closes are never rated or shown publicly.

Optional Steam sign-in

At morsomid.com/link you can sign in through Steam. Steam only tells us your Steam account number; we never see your password. You then type a one-time code into the game. That stores a strictly necessary cookie in the game's built-in browser so the ladder can recognise your game client; we keep only a one-way digest of it. Linking protects your account so that matches only accept your linked client; you can turn protection off or remove all links at any time by signing in again. The cookie lasts 180 days and is renewed whenever your linked game joins a ladder match. Linked clients unused for a year are deleted.

If you turn MORSO's own music on or off in the game, or switch tracks off in its playlist, the game's built-in browser keeps those settings (on or off, and which tracks are switched off) in a small cookie (morso_music, one year) set by this website. The website stores nothing about it.

When the game shows you a new trophy or award, the game's built-in browser remembers that it was shown, so it is not shown again: a small cookie (morso_awards, one year) set by this website keeps your Steam account number and the time of the newest award shown, for at most four accounts on that computer. The website stores nothing about it.

Signing in on the website

Since v0.9 you can sign in on morsomid.com through Steam to see your own record and to create or enter tournaments. Steam only tells us your Steam account number. Signing in stores a strictly necessary cookie (morso_session) for 30 days (during the Steam redirect, a second one, morso_login, checks for 10 minutes that the sign-in started on this site); we keep only a one-way digest of it, delete it when you sign out and delete expired sign-ins daily. Your account page shows your statistics, your match history with the time each match started, the players you played with and against, your tournaments and your trophies.

Tournaments

When you create or enter a tournament, we store your Steam account number, the name you register under (a player or team name), your team, the series results and which ladder games belonged to each series. A public tournament's page, entries, standings and results are visible to everyone. A private tournament is shown to its organiser, its players and anyone the organiser or a captain gives the invitation or team code. The organiser can see the series codes, make new ones, remove entries before the start and set series results by hand.

Creating a tournament may show a Cloudflare Turnstile check, which protects the form from automated sign-ups. Cloudflare processes your IP address and browser signals for the check; morsomid.com only learns whether it passed and stores nothing from it.

Organisers can upload trophy images (PNG, JPEG or WebP). They are shown on the tournament page and on the winners' profiles. Do not upload images of people or anything you do not have the right to share; we remove reported images. Cancelling a tournament deletes its images at once; its entries and results are deleted 90 days after it was cancelled. An organiser who deletes a tournament before it starts deletes its registrations and images at once, and the tournament itself goes with the 90-day clean-up; after the start, deleting cancels it. Images that no tournament uses any more are deleted daily. Finished tournaments stay as the record of the tournament and its trophies; contact us to have your name removed from one.

Your trophies of public tournaments, season awards, season rank medals and other awards we grant are shown on your public player record, next to your name on the leaderboard and on your player card in game. Trophies of private tournaments show only on your own account page. Hidden players show no awards publicly. Contact us to have an award removed.

Since v0.9.3 a 2v2 team captain can upload a square team icon (PNG, JPEG or WebP). It is reviewed by the site admin against the community rules before anyone else sees it; an approved icon is shown in the tournament's bracket and in its 2v2 tournament games. A rejected icon is deleted at once. Each tournament also has a chat and every series an arrangement chat: the tournament chat can be read by anyone who can see the tournament, a series chat only by its players and the organiser. Messages are deleted after 90 days; the writer or the organiser can remove a message earlier. A side can forfeit a series it cannot schedule; every player of that side must agree, and the result is shown as a forfeit.

Find opponent

While you search for a ladder opponent, morsomid.com keeps your Steam account number, your MMR, your teammate (2v2) and your continent as Cloudflare reports it from your connection, so it can pair players who can play together. The players you are paired with see your Steam name, rank and a link to your Steam profile, and the lobby name and password. Queue records are deleted after two days at the latest. Who searched when is kept only as counts per hour (no player data) for 60 days, for the "when people search" chart. If you turn on notifications, we store your browser's push address and keys with your account and modes until you turn them off or the browser cancels them; the messages are sent through your browser maker's push service (Google, Mozilla, Apple or Microsoft). A short queue pause after a missed match is kept until it ends.

Reports and match summaries

After every MORSO game (Ladder, Tournament and Unranked) the lobby host's game puts together a match summary: the players' Steam account numbers and names, teams, heroes, abilities, items and statistics, how the match was drafted (since v0.9.7.5: the bans and who banned what, the drafted abilities and, in a Shared draft, the pool and who picked what in which order), ping and disconnects, everything written in the game's chat channels (all chat, team chat and the lobby chat before the game), and integrity indicators measured from each player's orders (for example orders aimed at enemies the player's team could not see, very fast reactions to enemy spells, and unusually even timing of orders and last hits). Each player's own Steam-linked game sends this summary, or only a fingerprint of it when we already have it, to morsomid.com. Games that are not Steam-linked send nothing.

After a game you can report another player or, in 2v2, the other team, in the game's After Action Review or from your account page for 7 days. A report stores your Steam account number, the game, the reported players, the reason, your optional note and a keyed digest of your network. Reports and summaries are read only by the MORSO admins to decide on moderation; nothing happens automatically because of a report or an indicator, and a reported player is not told who reported them. As a reporter you are told that the report was received; since v0.9.4, when action was taken against a player you reported, your account page or the After Action Review of your Steam-linked game also says so once, never who, what or in which game (we store only up to when you have seen this, and delete that record after 180 days). Admin sign-ins and everything admins view or change are logged.

Since v0.9.4 an admin can give a reported player a warning. We store the account, the time, the reason (a report category), which admin gave it, the reports it concerns and when you saw it. Only you and the admins see it: you are shown it once, in the After Action Review of your Steam-linked game or on your account page. Warnings are kept for a year; older ones are deleted when the next warning is given. When a player is reported by at least two different players, or a cheating or scripting report of a confirmed game meets flagged integrity indicators, the developer gets an alert in a private MORSO Discord channel with the player's name, Steam account number and the number of reports per reason, never who reported. We keep the time of the last alert per player and how many reporters it counted, so the same alert is not repeated within a day; records older than 30 days are deleted whenever an alert is sent.

Summaries of games nobody reported are deleted after 30 days, or after 7 days when only one player's game sent the summary. Reports, and the summaries of reported games, are deleted 180 days after the report was handled; the moderation log entry of an action described below stays.

Since v0.9.7.5, finished games that two players' Steam-linked games confirmed are also added to anonymous hero and ability statistics, shown on the Hero stats page to signed-in players. They hold only totals per hero and ability (games, wins, kills, deaths, gold per minute, picks, bans and pick order) by mode, team size, draft type and version. No player or game is named in them, and they stay after the summaries are deleted. So that a game is counted only once, its game number is kept for 60 days. The same games also add to your own totals, kept with your Steam account number: per hero and ability you played, drafted or banned yourself, the games, wins, kills, deaths, gold per minute and pick order, by mode, team size, draft type and version. Only you see them, on My stats while you are signed in. They are deleted when your account has had no counted game for a year, or earlier when you ask us.

MORSO Discord

Since v0.9.3 you can link a Discord account on your account page (optional). Discord tells us your Discord user ID and username; we keep only those two with your Steam account number, so the MORSO bot can give you access to the Discord channels of the tournaments you are in. Linking also adds you to the MORSO Discord server. The access token Discord gives us is used once and revoked at once. Unlinking deletes the link; it also goes when your MORSO player record is deleted. A tournament's Discord channels, and the messages in them, are deleted 48 hours after the tournament ends. Discord processes what you do on Discord under its own privacy policy.

Supporters

Since v0.9.4, if you buy the developer a coffee on Buy Me a Coffee and write your MORSO ID (your Steam account number) in the message, the developer turns on your supporter rewards by hand. morsomid.com then keeps only that your Steam account number has the MORSO Supporter award and since when; it shows publicly with your player record and in game, and the MORSO bot gives a linked Discord account the Supporter role. For the role we keep which Discord user has it and whether the bot's one-time thank-you was posted; that thank-you mentions your Discord account in a channel of the MORSO Discord. The bot takes the role away when the award is removed or you unlink Discord, and this record goes once you no longer have the award. A removed award keeps a dated record that it was removed. No payment details, amounts or e-mail addresses are stored on morsomid.com; Buy Me a Coffee processes the payment and your message under its own privacy policy. Ask through the Contact link to have the award removed.

Why we use this data

We use these records to run the requested leaderboard, keep scores consistent and stop forged or duplicate results. Our processing basis is legitimate interests under GDPR Article 6(1)(f): operating and protecting this community game and its ranking service. We do not use player records for advertising, sell them or combine them with information from other games.

If you object to this processing, contact us or play Unranked. Unranked and solo matches send no results to the ladder; only the lobby's rating and link check described above is made, and, when your game is Steam-linked, the match summary described under Reports below.

Automatic ratings

Ratings start at 1000 and use an Elo formula: beating a higher-rated player gives more, and in 1v1 the loser loses the same amount. A match changes ratings only when the game clients confirmed the same winner, or one confirmed after another stopped responding mid-match. In 2v2 each player's change is calculated from their own rating against the average rating of the other team, with their own rating factor (larger for players with fewer than 10 rated matches), so teammates can gain or lose different amounts; a player who left also pays the departure penalty below. Tournament games change ratings only when the organiser made the tournament ranked. Matches shorter than two minutes, matches where a player's game was not Steam-linked and matches with conflicting or missing confirmations are recorded without a rating change. After 3 rated games within 7 days between two players who were opponents, each further result between them counts half. A short tournament game still counts for its series, without a rating change. The public leaderboard lists Steam-linked players with at least 3 rated matches. Ratings run in seasons of one year (Season 0, the open beta, ends on 31 December 2026). When a season ends, ratings and the season's ladder record reset, and each player's final rank (for the top 3, their placing and a season award) is kept permanently on their public profile as the record of that season; contact us to have it removed. When we act on a report (hiding a player, removing an image, correcting a result or cancelling a tournament), we keep a short moderation log entry with the affected account or tournament and the reason, so decisions can be reviewed later. Contact us for review or removal of an incorrect record.

The complete ladder rules are in one place on the front page: how results are checked, how MMR changes and seasons.

Leaving ladder matches

If a player stays disconnected from a started ladder or tournament match for two minutes, that player has left the match. In 1v1 the other player wins. In 2v2 the match continues two against one, and the team that left only loses when both of its players are gone. When the leaving player's own game stopped responding, the departure is recorded: the leaving player pays an extra 25 MMR on top of the team's result, and repeated departures within 7 days add a ladder cooldown (first a warning, then 15 minutes, 1 hour, 6 hours and 24 hours). If all games stop responding without a result, the lobby host's departure is recorded without an MMR change, because the host's computer runs the match; in 1v1, a host who leaves a started match after at least 5 minutes for the second time within 7 days loses that match like any other departure. Cooldowns only block the ladder; Unranked stays open. A moderation ban blocks every mode. Departure records are deleted after 30 days; the lifetime count of departures stays on the player record. The rules for leaving a match: What happens if I disconnect?

How long records are kept

Match records are scheduled for deletion after 90 days; network digests after 2 days; sign-in codes and page tokens within two days; idle closes after 3 days; moderation warnings after a year; reporter feedback records after 180 days; the game numbers of games counted in the hero and ability statistics after 60 days; your own hero, ability and ban totals a year after your last counted game. Player totals are removed after a year without matches, except for players of a tournament: they stay with that tournament's record (contact us to have your name removed). Cleanup runs daily; an interruption may delay it. Ratings may be reset if the ladder rules change. Results from the v0.8.1–0.8.2 open beta are no longer shown and are deleted 90 days after the match.

Hosting recovery copies can retain deleted data for the provider's recovery period. Any recovery must reapply deletion requests.

Hosting and other services

Cloudflare processes data on our behalf. The database is configured in the European Union, but Cloudflare's global network may process requests outside the EEA. Cloudflare describes its transfer safeguards, including standard contractual clauses, in its Data Processing Addendum and privacy policy. A regional database setting is not a promise that all network processing remains in the EU.

Steam sign-in and Steam display names are provided by Valve under Steam's own privacy policy. If you email us, Proton Mail processes the correspondence so we can respond.

Your rights

You can ask for access to your records, correction, deletion or restriction of processing, and you can object to processing based on legitimate interests. Data portability applies where its legal conditions are met. Email the contact above and include your Steam profile link and the request. We may ask you to demonstrate control of that profile, for example by signing in through Steam; do not send passwords or identity documents.

We normally respond within one month. If a request needs more time or cannot be fully granted, we will explain why and the applicable rights. You may complain to the Finnish Office of the Data Protection Ombudsman or your local data protection authority.

Data controller: Antti Ravelin, the developer of MORSO. Contact: show email address.