What a loyalty scope has to settle first
A loyalty or membership app is a connected sequence, not a feature list. A member is identified, a transaction is qualified, a reward is earned or spent, something occasionally goes back, and the record has to reconcile afterwards. Two states run alongside each other and are routinely muddled. Membership access is an entitlement, the thing someone may use because of who they are. A reward balance is a separate total that moves with events. Plan the customer screen, the counter workflow and the backend together.
Four states people merge into one
Editorial framework. Collapsing these into one field is where most balance disputes are born.
Basis: Stripe: Subscriptions overview. Reviewed .
Read the graphic as text
- Membership access. What a person may use, by who they are
- Tier status. Earned over time, and able to fall
- Benefit eligibility. A tier holder can still be ineligible
- Reward balance. A ledger total that moves with events
What sits inside the app, and what is a shared system concern
The minimum boundary here is six things: member identity, access entitlement, tier and benefit state, the transaction source that triggers an event, the staff roles that may act, and who owns support when a member disputes a balance. Broader membership administration, meaning plans, renewals, joining and leaving, is a separate planning task. Keep the two apart so a rewards rule change does not quietly become a membership policy change.
Whether this needs an installed app at all is answered on the parent page, mobile app development. The short version for loyalty: offline use, notifications and device access should be explicit requirements rather than assumptions. If members only ever check a balance at a counter with staff present, a web page does that. Platform choice follows the workflow.
Points and tiers people can actually understand
Member identity, tiers and benefits
Start with identity, because every later rule depends on it. Decide which identifiers are permitted, such as a phone number, a scannable code or an account sign-in, and how a transaction is associated with one of them at the moment it happens. Then decide what occurs when the association fails: a shared household number, a typo, a walk-in who signs up after paying. Those go to a named support owner, not to a silent failure.
Keep four states distinct: membership access, tier status, benefit eligibility and reward balance. A member can hold a tier and still be ineligible for a benefit, and can be eligible while holding a zero balance. Write down who may read each state, who may change it and who approves an exception. Where a paid recurring membership is in scope, subscription status is a third thing again. Stripe's subscription documentation, read on 18 September 2026, describes a lifecycle covering trial, active, past due, unpaid, paused and cancelled states, monitored through webhook events. That is Stripe's model for its own product, not your membership policy, but it is a useful reminder that a membership has more states than joined and left.
Earning, redemption and the ledger behind them
Treat the balance as a ledger, not a number in a column. A qualified event creates an entry, which may be pending before it is confirmed, and which can later expire, be redeemed or be reversed. If you cannot replay the entries and arrive at today's total, you cannot answer a member who says it is wrong, and that conversation happens more often than the rewards you hand out.
Odoo's loyalty documentation, read on 18 September 2026, is a useful catalogue of the shapes a programme can take. It documents loyalty cards where a customer accumulates points to exchange for rewards on current or future orders, alongside coupons, promotions and discount codes, with conditional rules such as a minimum quantity or a product and category filter, and rewards configured as free products, discounts or free shipping. That is one vendor's product, not a universal model. Read it as a menu of decisions rather than a recommendation.
Our VITALE build is a concept prototype rather than client work. It is relevant here because it shows a tier ladder beside an itemised statement where every line traces back to the volume and rate that produced it. It runs as a web platform. Nothing we have built is published on the App Store or Google Play yet.
| Workflow step | Assumed actor | Proposed system response | Exception | Acceptance evidence to collect |
|---|---|---|---|---|
| Identify a member | Customer | Link the transaction to the permitted loyalty identity | Shared or unmatched identities go to support review | Identity and access tests, including a deliberate mismatch |
| Earn or redeem a reward | Checkout operator | Apply the approved points rule to the identified transaction | A repeated event must not award or spend twice | Rule inputs, ledger entries and duplicate-event observations |
| Return a purchase | Support owner | Apply the agreed reversal rule and reconcile the balance | A reward already redeemed needs an explicit exception policy | Refund-to-reward ledger reconciliation |
The expensive part is the policy, not the points screen
An unredeemed point is a promise you will have to honour. The software does whatever the policy says, so the policy is where the money and the argument sit. Decide what a point is worth in ringgit, whether points expire and on what clock, whether a transaction or a member can be capped, how rounding works, whether points transfer, and what happens to a balance when an account closes. Retrofitting expiry onto a live balance is a customer-relations exercise, not a code change.
How the outstanding balance is treated in your accounts is a question for your accountant, worth asking before launch rather than at year end. Our part is making the ledger explain itself.
An unredeemed point is a promise
Illustrative calculation. Hypothetical figures: decide the value, the expiry and the caps before launch, because retrofitting them onto live balances is not a code change.
Basis: Perfect Design: business systems explained. Reviewed .
Read the graphic as text
- Points outstanding: 1,000,000. A round figure chosen for the example
- Value per point: RM 0.01. A hypothetical rate you would set yourself
- Promise on the books: RM 10,000. 1,000,000 multiplied by RM 0.01
- If a tenth expires: RM 9,000. The same promise under a hypothetical expiry
Notifications, corrections and disputes
Notifications worth a member interruption
Notifications here mean member events: a confirmed earning, an expiry coming up, a redemption status, a reversal notice. For each, decide whether it is worth an interruption, when permission is requested and what preferences a member can set. Decide the fallback too, because delivery is never guaranteed: an in-app status and a support route that works when a message never arrives.
Corrections, abuse signals and disputes
Five exception classes need an owner before launch. A duplicate earning or spending event. An unmatched or shared identity. A refund arriving after the reward was redeemed. A manual adjustment by staff. A member who disputes their balance. Each needs a reviewer, a reason code, an auditable history, wording the member receives and a reconciliation record. On abuse signals, be careful what you promise: define what the system observes, who reviews it and what action a reviewer may take. Detecting a pattern is not preventing it, and a programme that punishes anomalies automatically will eventually punish a good customer.
Sharing moved into the chat
Published statistic. Private messaging nearly doubled in two years. The link somebody forwards to one friend is now almost as common as a public post, and it never appears in your analytics as a share.
Source: MCMC: Internet Users Survey 2024, online content sharing platform. Reviewed .
Read the graphic as text
- Social media: 71.1%.
- Group chat: 50.1%.
- Private message: 48.6%. Was 29.4% in 2022
- Email: 12.1%.
Chart scale: Where Malaysian internet users share content, 2024.
Connecting the till, the shop and the CRM
Map member identity, transaction qualification, reward posting, redemption, refund and reconciliation across every system involved: the app, the online store, the point of sale and the CRM. For each record, ask which system is authoritative when two disagree. Then ask the mechanical questions. Does every event carry an identifier that survives a retry, how is a duplicate prevented, and who may issue a manual correction. Feasibility depends on four things outside the app: whether an interface exists, who grants access, whether the data is clean enough to rely on, and what the vendor terms allow.
Where general CRM work takes over
Customer records, field mapping, triggers, permissions, duplicate handling and error recovery are a broader subject. This page applies those concerns only to member, transaction and reward events. When the connection carries more, CRM and integrations is where the wider planning lives.
QR went from novelty to default
Published statistic. Small businesses adopted QR faster than anyone, because acceptance costs less than a card. A counter, a stall and a delivery rider all take it.
Source: Bank Negara Malaysia Annual Report 2025, and PayNet 2025 results. Reviewed .
Also: PayNet: 8.44 billion transactions processed in 2025.
Read the graphic as text
- DuitNow QR payments in 2025: 3bn. Double the 1.5 billion of 2024
- Registered touchpoints: ~3m. Up from 2.6 million, mostly small businesses
- Added in 2025 by MSMEs: 267k. Of 681,250 new acceptance points
When a card in the phone beats plastic, and when it does not
The case for an app is that the phone is already in the member's hand. Plastic gets left at home, replacements cost counter time, and a stamped card cannot show why a balance is what it is. An app carries the identity, the tier and the reason behind each entry, and can warn someone their points expire while they can still use them. The case against is just as real. A saved web page or a wallet pass covers much of that with nothing to install. If your point of sale already runs a scheme your staff know, using it well is cheaper than replacing it.
What Malaysians actually carry
Published statistic. There are roughly five e-money accounts and two debit cards for every credit card in the country. A checkout designed around credit cards is designed around the smallest group.
Source: Bank Negara Malaysia: Payment Statistics, Table T2.2 Cards and Users, end-2025. Reviewed .
Read the graphic as text
- E-money accounts: 188m. Wallets, card and network based
- Debit cards: 55m.
- Credit cards: 12m.
Chart scale: In circulation at the end of 2025, in millions.
Delivery, acceptance and who owns the policy afterwards
Before a build starts, settle the roles and permissions, the approved reward policy, who owns the member data, privacy and retention rules, the integrations whose access is confirmed, the acceptance criteria and who handles support. Acceptance evidence here is specific: identity and access tests, rule inputs checked against ledger entries, a duplicate-event check and a refund-to-reward reconciliation. A launch can show that the workflow completes and the data reconciles. Whether the programme changes retention or revenue is a business result measured over time, not something a build can promise.
What to bring to a scoped conversation
Four inputs make a first discussion useful: how members and transactions flow today, the benefits and reward rules you want, the systems involved and their owners, and any constraint you already know about. Send that as a scoped enquiry and we will tell you which parts look solid, which need confirming, and whether the honest answer is to improve what you already run.



