A members-only app for STARR KL: what's on tonight, a table held in two taps, a card that opens the door, and a points ledger the member can trust. Every screenshot in this document is the real build running against the live database — no mockups.
A nightclub app fails when it is a menu with a logo on it. This one is built around the four moments that actually decide whether a member comes back: choosing the night, holding the table, walking through the door, and getting home. Everything else is removed.
Five tiers from NOVA to BLACK STAR. The card changes with the tier, the earn rate rises with it, and BLACK STAR can only be given — never bought. Members see exactly where they stand and what the next rung is worth.
The QR on the card is a random single-use token that rotates every 30 seconds and dies the moment it is read. A screenshot passed to a friend will not scan twice, and the code carries no member identity at all.
Balances are computed on the server from a ledger, never sent up by the phone. A member who modifies the app still cannot add a point, change a tier or make a reward free. Tested, and refused, eleven different ways.
Rooms, minimum spends and add-on prices come from your catalogue, not the app. Change a price or open a room and every phone sees it on the next pull — no app update, no reprint.
"RM18,600 to go — that is four nights on The Vault." Members are shown the distance to the next tier in the currency they think in: nights out, not abstract points.
A discounted Grab code, one per night, opening the app with the pickup already set at the Star Door. The member's home address never leaves their phone — the club never receives it.
The night nearest first, sized like a poster. Members can register interest or jump straight into a booking from the same card — resident nights, international guests and members-first releases all read differently.


Date, room, party size, arrival. Add-ons — bottles, shisha, a photographer — are priced from your catalogue and the deposit is calculated server-side, so the number the member pays is always the number you set.





A member card that tilts with the phone, the tier written on its face, and beneath it the rotating door code. One scan covers entry, bar tabs and redemptions — the terminal reads it in under a second.





Points earn at the tier rate — 5 per ringgit at NOVA up to 15 at BLACK STAR — and redeem at 100 points to RM1 against a catalogue that runs from a signature cocktail to a leather jacket and an hour in The Vault.





The name on the card, the default way to pay, notification preferences, upcoming reservations, and the ride-home shortcut. No settings maze.


Loyalty apps get attacked from the inside — by members with a patched app, not by strangers. The app is therefore built so the phone can ask for things but never assert them. Prices, balances, tiers and vouchers are decided by the database.
| What was tested | Result |
|---|---|
| Someone reads the app package for keys | Every member table returns zero rows and all ten operations are refused. Nothing leaks. |
| A signed-in member asks for another member's data | Ledger, bookings, vouchers, stars, cards, door codes — all empty. Isolation held on all eleven tables. |
| A member tries to award themselves points or a tier | Refused. Eleven escalation attempts, including forging a booking and making a reward free — all blocked, balance unchanged. |
| A table booked beyond its capacity | Refused server-side. |
| A reward redeemed without the points | Refused, with the shortfall stated. |
| The same door code scanned twice | Second scan rejected as unknown. |
| Deposit and points arithmetic | Exact to the ringgit and the point across the full booking → earn → redeem path. |
Ten checks of ten passed on the live database, and the money paths were re-run with three real member sessions before this document was written.
Under it: Supabase (managed Postgres) with row-level security on 18 tables, one codebase for iOS and Android, and an Android build already distributed for testing. Adding a member costs nothing — the platform scales with the guest list, not with a server bill.
| Capability | Status |
|---|---|
| Member sign-in by emailed code (or password) | Live |
| Events, promos, interest registration | Live |
| Table booking, server-side pricing, capacity, cancellation window | Live |
| Points earning, ledger, tier ladder and the climb | Live |
| Reward redemption and voucher codes | Live |
| Rotating single-use door QR | Live |
| Ride-home code, one per night, Grab hand-off | Live |
| Host requests, preferences, default payment method | Live |
| Card payment gateway (deposits actually charged) | Phase 2 — the booking flow is complete and waiting behind it |
| Door terminal that scans the code at the entrance | Phase 2 — the verification the terminal calls is already built and tested |
| Push notifications for table drops and door alerts | Phase 2 — preferences already captured per member |
| Awarding constellation stars automatically | Phase 2 — arrives with the door terminal that observes the night |
| Apple / Google Wallet passes | Phase 2 |