Skip to content
- Scheduled enrollment opening: each session has a window (opens / closes) enforced on the server, with the day and time shown and a countdown in the public catalog. Nobody can enroll early.
- Age check: minimum and maximum age per activity, checked against the birth date.
- Family accounts: email verification at signup (confirmed on a page with a button), password reset by email (signed, expiring, single-use link), editing and deleting children, cancelling unpaid enrollments and deleting the account.
- Health data: explicit consent in a separate checkbox, and only the fields monitors need.
- Real Redsys payments: redirect to the bank’s payment page, HMAC-SHA256 signature and the bank’s server notification as the source of truth. Still being validated with the first pilot town’s real TPV. One open payment order per enrollment; overcharges or late captures appear in the “payments to refund” list and are refunded from the town’s TPV.
- Waitlist: a periodic sweep guarantees promotion whenever a place is free.
- Discounts: supporting document required; who reviewed each discount, and when, is recorded.
- Backoffice: archiving of activities and sessions with enrollments (they are not deleted), cancelling paid enrollments with a refund flag, audit view with CSV export, TPV settings page (the secret key is stored encrypted), and the whole backoffice in Catalan, Spanish and English.
- Emails in the family’s language, sent through a queue with retries.
- Security: signup protected with Cloudflare Turnstile, Tor exit blocking and a honeypot field; login rate limiting.
- New legal pages on the website: legal notice, privacy, app privacy and accessibility statement.
- Public catalog per town with live free places (UI in ca/es/en).
- Family account with child profiles.
- Enrollment with concurrency-safe allocation and a timestamped receipt.
- Discounts (registered residence, large family) with document upload and one-screen review.
- Payment flow holding the place during payment (at the time with a simulated TPV, no real Redsys connection).
- Ordered waitlist with automatic promotion and payment deadline.
- Backoffice: activities and sessions, cancellations, monitor list, CSV exports and allocation audit.
- Automatic deletion of discount documents at season end, encryption and off-site backup.
- Two-factor authentication (2FA) and roles for municipal staff.
- Automatic translation of activity descriptions, with a visible indicator.
- Single-parent families, income brackets and sibling discounts.
- Auditable lottery mode as an alternative to first-come order.
- Payment in instalments.
- Indicator dashboard with a season report.