Running the door at a church event in a hall with no signal

Why does the church hall break every check-in app?

Thick walls, a metal roof, a kitchen in the way, and forty phones all reaching for the same weak cell at once. The connection that worked when you tested it alone on Thursday is not the connection you have at 6:55pm on Saturday with a queue at the door.

So the door device in bindro does not need one. It downloads a manifest — the list of who is expected, with the names, because congregations check in by name rather than by scanning — and every decision after that is made on the device with no network call at all.

What is on the manifest, and what is deliberately not?

Only what the door needs. The manifest carries names for a name-list vertical like this one and the credential each place resolves to, and nothing else — no prices, no amounts chosen, no medical notes.

That is a privacy decision with a practical edge: this list ends up on a volunteer's personal phone, which may be left on a trestle table or in a field. Anything not needed to say "yes, come in" is not on it.

• Download the manifest while you still have signal — before you leave the office if need be.
• Anyone whose guardian consent is unsigned is simply not on the list.
• Places nobody has named are not on it either.
• Amounts chosen under pay-what-you-can never appear.
• Re-entry is allowed, so somebody coming back in at the door that welcomed them is admitted again rather than read as a duplicate.

What if two volunteers check the same family in on two phones?

Both scans are kept, one wins, and the clash appears in a conflict list afterwards rather than one silently overwriting the other. When the devices get signal again they replay what they recorded; a replay applied twice counts once, so a volunteer re-uploading out of anxiety does not double-count anyone.

The practical rule for the door: put one volunteer on each half of the alphabet rather than two on the same queue. The conflict list is a safety net, and it is much nicer to review an empty one.

What do we do about people who turn up without having signed up?

Take them at the door through the office rather than turning them away. Someone in the office with the right role can enter the booking directly and record it as paid by cash or cheque, and it goes through the same questions as a public sign-up — an incomplete one is refused rather than half-created. If the person cannot pay, a free place can be issued the same way; it consumes a real place and checks in normally but writes no income, so it never inflates what you report as taken.

What you should not do is admit someone as a name on a scrap of paper. At an event involving children, the unrecorded attendee is the whole problem.

What happens the morning after?

Sync every device, review the conflict list, and look at attendance against bookings. The gap between the two is the most useful number a church event produces: it tells you what a sign-up on your form is actually worth as a prediction, which is what you will size the next hall booking and the next food order against.

Money reaches the church two days after the event finishes, so the reconciliation you do the next morning is against a ledger that has not moved yet, and the board report drawn from it later counts free places separately from paid ones.