perfectdesign.

App use cases

Loyalty, rewards and membership app development

A loyalty app is a promise you have to honour later. We scope the member identity, the earning rules and the ledger behind them before anyone designs a points screen.

In short

Scope a loyalty or membership app as one journey: identify the member, qualify the transaction, add or spend a reward, reverse it when something goes back, and reconcile the record so any balance can be explained months later. Keep two states apart throughout, because they get confused constantly. Membership access is an entitlement, meaning what someone may use because of who they are. A reward balance is a separate running total. Most of the cost sits in the policy and the exceptions, not in the screen that shows a number.

Written for a business owner or operations lead deciding whether and how to scope a loyalty or membership app · 7 min read

What a loyalty scope has to settle first

A loyalty or membership app is a connected sequence, not a feature list. A member is identified, a transaction is qualified, a reward is earned or spent, something occasionally goes back, and the record has to reconcile afterwards. Two states run alongside each other and are routinely muddled. Membership access is an entitlement, the thing someone may use because of who they are. A reward balance is a separate total that moves with events. Plan the customer screen, the counter workflow and the backend together.

Four states people merge into one. Collapsing these into one field is where most balance disputes are born. A full text version follows.

Four states people merge into one

Editorial framework. Collapsing these into one field is where most balance disputes are born.

Basis: Stripe: Subscriptions overview. Reviewed .

Read the graphic as text
  • Membership access. What a person may use, by who they are
  • Tier status. Earned over time, and able to fall
  • Benefit eligibility. A tier holder can still be ineligible
  • Reward balance. A ledger total that moves with events
Download this infographic (SVG)

What sits inside the app, and what is a shared system concern

The minimum boundary here is six things: member identity, access entitlement, tier and benefit state, the transaction source that triggers an event, the staff roles that may act, and who owns support when a member disputes a balance. Broader membership administration, meaning plans, renewals, joining and leaving, is a separate planning task. Keep the two apart so a rewards rule change does not quietly become a membership policy change.

Whether this needs an installed app at all is answered on the parent page, mobile app development. The short version for loyalty: offline use, notifications and device access should be explicit requirements rather than assumptions. If members only ever check a balance at a counter with staff present, a web page does that. Platform choice follows the workflow.

Points and tiers people can actually understand

Member identity, tiers and benefits

Start with identity, because every later rule depends on it. Decide which identifiers are permitted, such as a phone number, a scannable code or an account sign-in, and how a transaction is associated with one of them at the moment it happens. Then decide what occurs when the association fails: a shared household number, a typo, a walk-in who signs up after paying. Those go to a named support owner, not to a silent failure.

Keep four states distinct: membership access, tier status, benefit eligibility and reward balance. A member can hold a tier and still be ineligible for a benefit, and can be eligible while holding a zero balance. Write down who may read each state, who may change it and who approves an exception. Where a paid recurring membership is in scope, subscription status is a third thing again. Stripe's subscription documentation, read on 18 September 2026, describes a lifecycle covering trial, active, past due, unpaid, paused and cancelled states, monitored through webhook events. That is Stripe's model for its own product, not your membership policy, but it is a useful reminder that a membership has more states than joined and left.

Earning, redemption and the ledger behind them

Treat the balance as a ledger, not a number in a column. A qualified event creates an entry, which may be pending before it is confirmed, and which can later expire, be redeemed or be reversed. If you cannot replay the entries and arrive at today's total, you cannot answer a member who says it is wrong, and that conversation happens more often than the rewards you hand out.

Odoo's loyalty documentation, read on 18 September 2026, is a useful catalogue of the shapes a programme can take. It documents loyalty cards where a customer accumulates points to exchange for rewards on current or future orders, alongside coupons, promotions and discount codes, with conditional rules such as a minimum quantity or a product and category filter, and rewards configured as free products, discounts or free shipping. That is one vendor's product, not a universal model. Read it as a menu of decisions rather than a recommendation.

Our VITALE build is a concept prototype rather than client work. It is relevant here because it shows a tier ladder beside an itemised statement where every line traces back to the volume and rate that produced it. It runs as a web platform. Nothing we have built is published on the App Store or Google Play yet.

A fictional retailer with a fictional points policy, worked through three steps
Workflow stepAssumed actorProposed system responseExceptionAcceptance evidence to collect
Identify a memberCustomerLink the transaction to the permitted loyalty identityShared or unmatched identities go to support reviewIdentity and access tests, including a deliberate mismatch
Earn or redeem a rewardCheckout operatorApply the approved points rule to the identified transactionA repeated event must not award or spend twiceRule inputs, ledger entries and duplicate-event observations
Return a purchaseSupport ownerApply the agreed reversal rule and reconcile the balanceA reward already redeemed needs an explicit exception policyRefund-to-reward ledger reconciliation

The expensive part is the policy, not the points screen

An unredeemed point is a promise you will have to honour. The software does whatever the policy says, so the policy is where the money and the argument sit. Decide what a point is worth in ringgit, whether points expire and on what clock, whether a transaction or a member can be capped, how rounding works, whether points transfer, and what happens to a balance when an account closes. Retrofitting expiry onto a live balance is a customer-relations exercise, not a code change.

How the outstanding balance is treated in your accounts is a question for your accountant, worth asking before launch rather than at year end. Our part is making the ledger explain itself.

An unredeemed point is a promise. Hypothetical figures: decide the value, the expiry and the caps before launch, because retrofitting them onto live balances is not a code change. A full text version follows.

An unredeemed point is a promise

Illustrative calculation. Hypothetical figures: decide the value, the expiry and the caps before launch, because retrofitting them onto live balances is not a code change.

Basis: Perfect Design: business systems explained. Reviewed .

Read the graphic as text
  • Points outstanding: 1,000,000. A round figure chosen for the example
  • Value per point: RM 0.01. A hypothetical rate you would set yourself
  • Promise on the books: RM 10,000. 1,000,000 multiplied by RM 0.01
  • If a tenth expires: RM 9,000. The same promise under a hypothetical expiry
Download this infographic (SVG)

Notifications, corrections and disputes

Notifications worth a member interruption

Notifications here mean member events: a confirmed earning, an expiry coming up, a redemption status, a reversal notice. For each, decide whether it is worth an interruption, when permission is requested and what preferences a member can set. Decide the fallback too, because delivery is never guaranteed: an in-app status and a support route that works when a message never arrives.

Corrections, abuse signals and disputes

Five exception classes need an owner before launch. A duplicate earning or spending event. An unmatched or shared identity. A refund arriving after the reward was redeemed. A manual adjustment by staff. A member who disputes their balance. Each needs a reviewer, a reason code, an auditable history, wording the member receives and a reconciliation record. On abuse signals, be careful what you promise: define what the system observes, who reviews it and what action a reviewer may take. Detecting a pattern is not preventing it, and a programme that punishes anomalies automatically will eventually punish a good customer.

Sharing moved into the chat. Private messaging nearly doubled in two years. The link somebody forwards to one friend is now almost as common as a public post, and it never appears in your analytics as a share. A full text version follows.

Sharing moved into the chat

Published statistic. Private messaging nearly doubled in two years. The link somebody forwards to one friend is now almost as common as a public post, and it never appears in your analytics as a share.

Source: MCMC: Internet Users Survey 2024, online content sharing platform. Reviewed .

Read the graphic as text
  • Social media: 71.1%.
  • Group chat: 50.1%.
  • Private message: 48.6%. Was 29.4% in 2022
  • Email: 12.1%.

Chart scale: Where Malaysian internet users share content, 2024.

Download this infographic (SVG)

Connecting the till, the shop and the CRM

Map member identity, transaction qualification, reward posting, redemption, refund and reconciliation across every system involved: the app, the online store, the point of sale and the CRM. For each record, ask which system is authoritative when two disagree. Then ask the mechanical questions. Does every event carry an identifier that survives a retry, how is a duplicate prevented, and who may issue a manual correction. Feasibility depends on four things outside the app: whether an interface exists, who grants access, whether the data is clean enough to rely on, and what the vendor terms allow.

Where general CRM work takes over

Customer records, field mapping, triggers, permissions, duplicate handling and error recovery are a broader subject. This page applies those concerns only to member, transaction and reward events. When the connection carries more, CRM and integrations is where the wider planning lives.

QR went from novelty to default. Small businesses adopted QR faster than anyone, because acceptance costs less than a card. A counter, a stall and a delivery rider all take it. A full text version follows.

QR went from novelty to default

Published statistic. Small businesses adopted QR faster than anyone, because acceptance costs less than a card. A counter, a stall and a delivery rider all take it.

Source: Bank Negara Malaysia Annual Report 2025, and PayNet 2025 results. Reviewed .

Also: PayNet: 8.44 billion transactions processed in 2025.

Read the graphic as text
  • DuitNow QR payments in 2025: 3bn. Double the 1.5 billion of 2024
  • Registered touchpoints: ~3m. Up from 2.6 million, mostly small businesses
  • Added in 2025 by MSMEs: 267k. Of 681,250 new acceptance points
Download this infographic (SVG)

When a card in the phone beats plastic, and when it does not

The case for an app is that the phone is already in the member's hand. Plastic gets left at home, replacements cost counter time, and a stamped card cannot show why a balance is what it is. An app carries the identity, the tier and the reason behind each entry, and can warn someone their points expire while they can still use them. The case against is just as real. A saved web page or a wallet pass covers much of that with nothing to install. If your point of sale already runs a scheme your staff know, using it well is cheaper than replacing it.

What Malaysians actually carry. There are roughly five e-money accounts and two debit cards for every credit card in the country. A checkout designed around credit cards is designed around the smallest group. A full text version follows.

What Malaysians actually carry

Published statistic. There are roughly five e-money accounts and two debit cards for every credit card in the country. A checkout designed around credit cards is designed around the smallest group.

Source: Bank Negara Malaysia: Payment Statistics, Table T2.2 Cards and Users, end-2025. Reviewed .

Read the graphic as text
  • E-money accounts: 188m. Wallets, card and network based
  • Debit cards: 55m.
  • Credit cards: 12m.

Chart scale: In circulation at the end of 2025, in millions.

Download this infographic (SVG)

Delivery, acceptance and who owns the policy afterwards

Before a build starts, settle the roles and permissions, the approved reward policy, who owns the member data, privacy and retention rules, the integrations whose access is confirmed, the acceptance criteria and who handles support. Acceptance evidence here is specific: identity and access tests, rule inputs checked against ledger entries, a duplicate-event check and a refund-to-reward reconciliation. A launch can show that the workflow completes and the data reconciles. Whether the programme changes retention or revenue is a business result measured over time, not something a build can promise.

What to bring to a scoped conversation

Four inputs make a first discussion useful: how members and transactions flow today, the benefits and reward rules you want, the systems involved and their owners, and any constraint you already know about. Send that as a scoped enquiry and we will tell you which parts look solid, which need confirming, and whether the honest answer is to improve what you already run.

What you get

What is actually delivered

01

Member and state model

Permitted identities, how a transaction is associated, and membership access, tier status, benefit eligibility and reward balance defined as separate states with named owners.

02

Written reward policy

Earning rules, point value, expiry clock, caps, rounding, transferability and what happens on account closure, agreed before the build rather than during it.

03

An auditable reward ledger

Pending, confirmed, expired, redeemed and reversed entries, each attributable to an event, a rule and an actor, so any balance can be explained later.

04

Member app and counter workflow

The customer screen and the staff side scoped together, with the permissions and states each role can act on.

05

Exception and dispute handling

Duplicate events, unmatched identity, refund after redemption, manual adjustment and member disputes, each with a reviewer, a reason code and a reconciliation record.

06

Integration scope you can confirm

Point of sale, store and CRM mapped by authoritative record, with event identity, duplicate prevention and correction routes checked against real access and terms.

07

Notification plan with fallbacks

The member events worth an interruption, permission timing, preferences and what the member sees when delivery fails.

08

Acceptance evidence pack

Identity and access tests, rule-input and ledger observations, duplicate-event checks and a refund-to-reward reconciliation, agreed in the scope and collected before sign-off.

How it runs

Settle the policy, then build the ledger

Loyalty projects rarely fail on the interface. They fail on a rule nobody wrote down and a balance nobody can explain, so we front-load both.

  1. 01

    Qualify the programme

    We look at how often members actually return and what your current system can already tell you. If an app is not the first thing to buy, we say so before anything is scoped.

  2. 02

    Policy and member model

    We write down permitted identities, tiers, benefits, earning and expiry rules, caps and reversal policy, and separate membership access from reward balance.

  3. 03

    Prototype you can click

    You get the member journey and the counter workflow working on a live link, so the rules are judged from something real rather than a document.

  4. 04

    Build the ledger and connect the sources

    We build the approved scope, connect the point of sale, store or CRM whose access and terms are confirmed, and make every entry traceable to an event and a rule.

  5. 05

    Test the exceptions

    Duplicate events, unmatched identities, refunds after redemption and manual corrections are tested deliberately, because that is where balances go wrong.

  6. 06

    Hand over and maintain

    Accounts and code go to you, and we keep the app current against operating-system changes, crashes and dependency updates, scoped per project.

Proof

Work you can click through

PantryCue is our own React Native app, with live camera scanning, local notifications, an offline pantry and a Cook Mode that reads steps aloud. You can try the web build, and there is an installable Android build; it is not on the App Store or Google Play. VITALE is a concept prototype, not client work. It is shown here because it demonstrates a tier ladder, an itemised statement and a deterministic, re-runnable ledger process, which are the same mechanics a rewards balance needs. It runs as a web platform.

Concept prototypes are labelled as prototypes everywhere they appear. They demonstrate what we can build, not work delivered for that named client. More client work is going live and will be added as it does.

How we work

The parts people ask about before they commit

How we build

React first, other languages when a project needs them

We build in React by preference, on both web and mobile, and we work in other languages when a project genuinely calls for it.

App stores

The accounts stay in your name

Your business owns the Apple Developer and Google Play accounts. We set them up in your name, prepare certificates and signing, and submit builds for you.

  • Apple Developer and Google Play account setup in your name
  • Certificates, signing and provisioning
  • TestFlight and internal test tracks for review builds
  • Store listing preparation and submission on your behalf

Timeline

Project dependent, and often quicker than expected

Timelines are project dependent. A focused build can go live in about a week, while a larger platform takes longer once scope is agreed.

Ongoing care

Quoted with the project, not bolted on

For a more complex website or a system with a real backend, ongoing care starts from RM 250 a month, with the plan confirmed against what was actually launched. Care is quoted with the project, not bolted on afterwards.

Getting hold of us

Normally under one working day

We normally respond to a support request in under one working day, and we work to solve problems as fast as we can. That is how we normally work rather than a contractual guarantee, and responding is not the same as resolving. If your operation needs a formal response or resolution commitment, we can write one into your scope.

Ownership

Everything belongs to your business

You own everything we build for you: the code, the content, the domain, the hosting account and every third-party account opened for the project. There is no lock-in. If you move to another provider, everything goes with you and we help with the handover.

  • Source code, handed over in your own repository
  • Domain and DNS, registered to your business
  • Hosting and every service account, in your name
  • Analytics, search and ad accounts, with us as a manager you can remove
  • All content, media and data in the system

Questions

Asked about loyalty & membership apps

Straight answers to what people ask before they commit. Anything else, message us.

What does a loyalty app cost?

Website packages are published openly on the pricing page, but a loyalty app is quoted against its scope rather than sold as a package. The number moves with how many identities and tiers you support, how many systems feed the ledger, how much of the work is the staff side, and how many exception paths have to be tested. A scoped conversation is the quickest route to a real figure.

Do we need an app, or would a card in a wallet do?

Often the simpler option is enough, and we would rather say so. A saved web page or a wallet pass can carry an identity and a balance with nothing to install. An app earns its place when you need notifications members actually receive, a saved identity across visits, or a staff-side workflow that a browser tab handles badly. If your members return rarely, neither is the right first purchase.

Can it connect to our point of sale?

Sometimes, and it depends on four things we check before anything enters a scope: whether an interface exists, who can grant access, whether the transaction data is clean enough to base a rule on, and what the vendor terms allow. If the till cannot emit a reliable transaction event, the honest answer is that the balance will not reconcile, and we would design around that rather than promise the connection.

Who decides the points rules?

You do, and it is worth deciding them in writing before the build. Point value, expiry, caps, rounding, transferability and what happens when an account closes are commercial decisions with a cost attached, not settings we should be choosing for you. We will tell you where a rule will be hard to reverse later.

Can you stop people gaming the programme?

We can make abuse visible and reviewable. We will not promise prevention. The system can flag duplicate events, unmatched identities and unusual patterns, and route them to a named reviewer with an auditable history and a reason code. Deciding what action is permitted stays with you, because an automatic punishment will eventually land on a good customer.

Is it on the App Store yet?

Nothing we have built is published on the App Store or Google Play, and we would rather say that plainly. Our VITALE build is a concept prototype running as a web platform. When an app does ship, your business owns the Apple Developer and Google Play accounts and we submit the builds on your behalf.

How long does it take?

Timelines are project dependent. A focused build can go live in about a week, while a larger platform takes longer once scope is agreed. For loyalty specifically, the slow part is usually agreeing the reward and reversal policy rather than building the screens.

Where to go next

Sources

Tell us what you need built

We will show you the closest thing we have already built, then scope the real version against your requirements.