Terminal

Two ways to run it

• Kiosk — a fixed tablet or reader at the door. Donors tap an amount, tap their card, done. Preset amounts, optional custom amount, nothing else on screen.
• Attended — a volunteer holds the device and walks the rows after Jumu'ah. Their PIN signs them in, so the shift total and every donation ties back to a name afterwards.

Hardware

• Android phone/tablet with Tap to Pay — the cheapest option; nothing to buy. The donor taps their card or phone on the back of yours.
• Stripe S700 / WisePad reader — a dedicated reader that pairs with the app over Bluetooth or Wi-Fi, for a counter or wall.
• Volunteers' own Android phones — attended mode, paired with the same code.

Tap to Pay has its own rules, set by Stripe and Google: Android 13 or newer with recent security patches, NFC and Google Mobile Services, an unmodified, locked bootloader (no rooted devices or custom ROMs), a screen lock set, and a stable internet connection. Developer options must be switched off while taking payments — Stripe checks and refuses to collect otherwise. Emulators can't run Tap to Pay at all; the app greys the option out and offers a sandbox reader instead.

Install the app

The app is distributed through Google Play internal testing during the pilot — your onboarding email has the opt-in link; once accepted, install “WeMasjid Terminal” from the Play Store like any other app and it updates automatically. Sideloading the release APK still works if a device can't reach Play. Kiosk devices can be pinned with Android's screen-pinning / lock-task; full lockdown needs the device provisioned as device owner (see Kiosk lockdown below).

Set up

• In the admin: Terminals → Add terminal, pick kiosk or attended, a default fund, amounts and prompts.
• On the device: open the app, type the 6-character pairing code — same idea as pairing a TV — then choose Tap to Pay, a Wi-Fi reader or a Bluetooth reader.
• Pairing codes expire 15 minutes after they're created or rotated — the admin Terminals list shows the live countdown, and the Generate button rolls a fresh code.
• Re-pairing: use Unpair on the terminal's page to free the code for a new device.

Who's on shift — terminal PINs

In Admin → People → Terminal PINs everyone gets their own 4–6 digit PIN. Volunteers tap their PIN on the terminal to start an attended session — no email, no password — and the session is recorded under their name so the shift total lines up with who held the device. Committee members appear automatically; add name-only volunteers with Add volunteer. Two per-person switches control what a PIN can do: Attended lets the PIN start an attended session and take refunds; Kiosk setup & unlocklets it open the terminal's Settings and exit kiosk mode. Starting a session or a refund without an Attended PIN is refused; Settings always asks for a PIN too.

• PINs must be unique within a masjid — reusing another person's PIN is refused when you save it, so the terminal can always tell who tapped.
• Wrong-PIN lockout — five wrong attempts inside a minute locks the pad for a minute and writes to the audit log; correct PINs don't count towards the limit.
• Auto sign-out — attended mode signs the person out after 15 minutes without a touch, or if the app sat in the background for over 5 minutes. The next person re-enters their PIN.
• PINs are stored as a hash — the masjid can reset one but never read it back.

The session flash pad shows the donation count only — the running £ total is deliberately hidden while a session is live (volunteers shouldn't announce it). It appears in the end-of-session summary, in Recent transactions, and on the hub'sRecent sessions card.

A typical Friday

• Volunteer opens the app, taps their PIN, and starts an attended session.
• Donors tap a preset amount (or the volunteer enters one) and tap their card — receipts and Gift Aid happen afterwards by QR, so the queue keeps moving.
• End the session: the admin Terminals page shows the shift's count and total, exportable to CSV.

Receipts and Gift Aid

After a payment the device can show a QR the donor scans on their own phone — that opens the receipt page where they can save or print the receipt, have it emailed (the page shows only a masked address, e.g. t•••@gmail.com, never the full stored one) or add a Gift Aid declaration. Volunteers can also take an email on the spot and send the receipt straight from the device — handy for anyone without a phone. The link works for 30 days; refunded donations show the refund (and when it happened) on the same page. If the donor covered the card fee the receipt shows the breakdown (“Includes £0.24 to cover card processing; the masjid receives £10.00”).

Help with fees

Before paying, donors can tick “Help cover card fees” — off by default. In-person card fees are Stripe's standard 1.4% + 10p, so a £10 gift becomes £10.24 and the masjid still receives the full £10. When the masjid claims Gift Aid/GASDS the cover is capped so gift + cover stays within the £30 small-donation limit:

• a £10 gift gets the full 24p cover;
• a £29.90 gift gets only the 10p headroom — the card copy explains it's “kept at £30 so it still counts as a small donation for Gift Aid”;
• a £30 gift has no headroom — the tick box greys out with “Fee cover isn't offered at £30”, which keeps the gift eligible for GASDS.

Covered donations carry the covered_fees flag and the receipt shows what was given and what the masjid receives. “Raised” totals everywhere are net of covered fees — the cover is the donor's, not the masjid's.

Give monthly

Offer monthly giving is a per-terminal switch under Terminals → Edit — off by default (it can be switched on per terminal when you want it). When it's on, donors see “Give once” or “Give monthly” after the amount. Monthly asks for an email (name optional) and shows a consent line the donor must tick — in effect: “I agree to the masjid taking this amount from this card every month, starting one month from today, until I cancel.” Fee cover is never applied to monthly gifts.

The first payment is the card tap they just made; Stripe saves a reusable card for the monthly subscription, which starts charging one month later. Stripe emails a receipt each month. The donor can cancel any time at wemasjid.com/give/your-slug/manage — the same self-serve page as online recurring gifts — or by asking the masjid to cancel it from the Giving dashboard.

Recent transactions, sessions and the activity log

The terminal's Recent list shows the last 24 hours of its own donations — amount, fund, time, status, and who took it. Anything succeeded within the last 30 minutes can be refunded straight away (attended Undo last uses the same path; it records who reversed it in the audit log). Older or bigger corrections go through the Giving dashboard like any donation.

The terminal's admin page (Admin → Terminals → pick one) has a Sessions card — every shift with who ran it, the count and total, with an Export CSV — and anActivity card: the terminal's own event feed (pairing, PIN failures and lockouts, session start/end, payment results, reader connect/disconnect), also with anExport CSV.

Limits

• Maximum per donation — £500 by default, set per terminal under Terminals → Edit and enforced on the server, so it can't be bypassed from the app.
• Refunds are limited to that terminal's own succeeded donations from the last 30 minutes and need an Attended PIN.

Kiosk lockdown

A kiosk tablet should only ever show the giving screen. Two levels:

• Screen pinning — Android's app pinning (Settings → Security → App pinning) keeps the app on top, with immersive-sticky nav hiding on top of that; a volunteer exits with a Kiosk PIN. Works on any device, no setup beyond the OS toggle — but the unpin gesture can still get out.
• Device owner — real lockdown. On a factory-reset device with no Google account added yet, run adb shell dpm set-device-owner app.wemasjid.terminal/.DeviceAdminReceiver. The app then whitelists itself for lock-task: no status bar, nav, notifications or recents, and it survives restarts. If the device already has an account you'll need to reset it or stick with pinning. Settings shows which mode is active.

If something goes wrong

• “No internet — card donations are paused.” Tap to Pay can't take cards offline at all, and neither can the terminal app — the banner blocks the Give buttons until the device is back online. (Offline queuing exists only on Stripe's S700 reader and isn't wired up yet.)
• “Reader disconnected” — tap the banner to reconnect; the app also reconnects by itself when a saved reader is nearby on launch.
• Card declined / not read — the app offers Retry the card (same payment, no duplicate) or Cancel.
• Refund — a succeeded donation from the last 30 minutes can be reversed from the terminal's Recent list or attended Undo last with an Attended PIN. Anything older is refunded from the Giving dashboard like any donation.

Gift Aid and GASDS

After paying, the device can show a QR code. The donor scans it to add a Gift Aid declaration or get an emailed receipt on their own phone — the link works for 30 days. If they skip it, card donations of £30 or under may still qualify for GASDS top-up automatically; a Gift Aid declaration replaces that (you can't claim both on one donation). That £30 ceiling is also why fee cover is capped — see Help with fees.

What you need first

• The masjid verified and its Stripe account connected with charges enabled — the same onboarding as online giving.
• Terminal card payments run in Stripe's live mode; test/simulated readers work in sandbox but real cards need live keys and a live connected account.