Membership, waiver and check-in software for a boxing gym
VLO Labs rebuilt the software behind Nuveta Gym, a boxing gym, as one web application covering the public site, online memberships, digital waivers, door check-in and staff administration. Payments run through Stripe, and the backend runs on Cloudflare.
- Industry
- Fitness and boxing
- Project type
- Client project
- Status
- Live
- Platforms
- Web
The challenge
A gym's daily operations touch several things that have to agree: who has paid, who has signed a waiver, and who is allowed through the door right now.
Front desk staff also take cash, so card subscriptions alone could not decide who has access. Plans and branding also had to be changeable without disrupting people already subscribed.
Our approach
We kept the existing React front end and reworked it, and rewrote the API as a TypeScript service on Cloudflare Workers, with a D1 database and R2 file storage.
Stripe is treated as the source of truth for card billing. Webhooks, checkout and a scheduled job all call the same sync routine, which reads Stripe's current state, so a repeated or out-of-order event cannot produce a different answer. Only active or trialing subscriptions create access, which means a member whose payment is past due is not admitted.
What we built
Public site and membership purchase
Home, coaches, schedule and memberships pages. Price cards are generated from the plans currently on sale. Members choose adult, kids, day-use or private training options and pay through Stripe Checkout, as a monthly subscription or a one-time payment.
Digital waivers
Members sign on screen before buying. Each signature produces a PDF recording the waiver version, signer, date and time. Staff can see who has signed which version.
QR check-in at the front desk
Each member has a QR code in their account that refreshes automatically. A full-screen kiosk page works with a standard barcode scanner and shows staff the member's name and whether access is allowed.
Member accounts
Sign-up, sign-in, password reset by email, a personal check-in history and a view of the member's own membership.
Staff administration
Screens for members, payment history, plans, waivers, Stripe account linking, check-in activity, and members holding more than one subscription. A financial report shows gross, fees, refunds and net by day or week.
Plan management tied to Stripe
Staff create a plan from the admin portal and the matching Stripe product and price are created with it. Because Stripe prices cannot be edited, a price change is a new plan with the old one hidden, and existing subscribers stay on what they already pay.
Cash payments
Staff can record a cash payment at the desk, which grants access for the period paid and writes a receipt. Cash and card members go through the same access check.
Engineering highlights
One path from Stripe to the database
All billing updates pass through a single routine that decides membership status and paid periods. Payment periods are de-duplicated with one key everywhere, and tests replay the same webhook repeatedly to confirm nothing is counted twice.
A second chance before refusing a member
If a scan shows no paid period, the system checks Stripe once more before answering, so a member who has just paid is not turned away because of a delayed update.
Backstop for missed payment events
An hourly job re-checks the members least recently synced with Stripe. Failures are recorded against that member, so one bad record cannot hold up everyone behind it.
Protection against double charges
Checkout refuses a second subscription for the same person and plan. Cash entries carry a one-time key, so a double click or retry cannot record the payment twice.
Limits on who can see what
Signed waivers contain personal details, so they are not available by public link. Only the signer, the covered member, a guardian or an admin can fetch one. Every admin route is covered by an automated test that confirms anonymous visitors and ordinary members are refused.
Accountable admin actions and account security
Admin portal changes are written to an audit log, and nobody can remove their own admin access. Passwords are stored as salted hashes, sign-in sessions use short-lived tokens with rotating refresh tokens, login endpoints are rate limited, and Stripe webhook signatures are verified.
Deploy checks
The backend deploy runs type checks and the test suite first. Tests use a local database and a fake Stripe, so they never touch real payments.
Where it stands
- Public site
- Live at nuvetagym.com
- Membership options on sale
- 6
- Automated backend test definitions
- 52
Technology
Links
Related services
Have something similar in mind?
Tell us what you need to build and we will give you a straight answer on how to approach it.
Get a free consultation