App Updates

When two devices logged a payment within seconds of each other — before either had synced — the second device's save could overwrite the first on the server, silently erasing a payment everywhere. The sync endpoint now merges payments instead of replacing them: it unions what's already stored with what's incoming (keyed by timestamp, amount, and coin), skips anything that's been deleted, and saves the combined ledger newest-first. Payments are now add-only on the server except for genuine deletions, so no save order can ever lose one. Verified with simultaneous two-device logging.

Deleting a payment now records a permanent "tombstone" that syncs to every device. Previously, removing an entry on one device could be undone when another device pushed its older copy back up. The server keeps a grow-only list of deleted-payment keys and filters them out of every sync, so a removed entry never reappears — even if a stale device hasn't caught up yet. Detection and the history log remain fully separate; this affects only the manual history.

Installed as a home-screen app, OrangeTill has no browser reload button, and iOS keeps it suspended in memory — so it could show stale data on reopen with no obvious way to refresh. It now pulls fresh data automatically every time it returns to the foreground (reopening the home-screen app, or switching back to the browser tab), so the counter is always current with no manual step.

After a fresh sync pulled in payments from another device, the history screen could stay blank until you toggled the date filter. The sync routine updated the data but didn't redraw history in that path. It now re-renders the moment merged payments arrive, so the list is correct on first view.

A payment shown as "Confirming" whose on-chain transaction is later replaced (RBF / double-spend) now correctly reverts to unpaid instead of appearing settled. Detection had been checking a transaction-status endpoint that returns a success response even for transactions that no longer exist; it now checks the full-transaction endpoint, which correctly reports a replaced transaction as gone, and rolls the row back to awaiting.

The Mempool.space WebSocket that powers live on-chain detection could quietly drop and stay disconnected, leaving a payment undetected. It now sends a heartbeat every 30 seconds and automatically reconnects and re-subscribes to the watched address if the connection closes, so detection keeps working through network hiccups. The watcher is also properly stopped when the payment screen closes.

Awaiting on-chain payments on the Tracking screen now remain for 12 hours before expiring, up from 20 minutes — better suited to real on-chain confirmation times, so a slow payment isn't dropped from view.

Tapping Copy on a wallet address worked, but on iOS the button briefly flashed a failure message. It was reading the tap event after the event had already cleared; it now references the button directly, so the success state shows reliably.

The Copy button on the payment screen now copies the plain wallet address by itself, without the amount attached. Some exchange apps let you scan a QR but only accept a bare address when pasted, and were rejecting the full payment link as invalid. The QR code still carries the amount, so wallets that support it keep auto-filling as before — this just makes copy-and-paste work everywhere.

The optional tax-rate setting previously referenced New Hampshire's meals & rooms rate in its label and helper text — a leftover from OrangeTill's first deployment. The label is now simply "Sales Tax Rate" and the hint is generic, matching the 23 non-English translations that were already neutral. The rate has always been a free-form number each merchant enters themselves (defaulting to off); this removes a region-specific assumption from the wording.

A dedicated screen, reached from the bottom navigation, that shows the day's on-chain payments at a glance. Each charge is its own row with a plain-language status — Watching (waiting for the payment to appear), Confirming (seen in the mempool, not yet in a block), or Settled (confirmed on-chain) — grouped so anything needing attention sits on top, with the total settled today shown above. It is watch-only and stays completely separate from your History ledger: nothing here is recorded as a sale unless you tap the green “Payment Received” button.

While a payment has been seen but not yet confirmed, its row shows a gentle amber ripple around a clock icon. It is an honest “working on it” signal rather than a countdown, because the time until the next block genuinely cannot be predicted. The moment the transaction confirms on-chain, the row turns green and moves to Settled.

Each time you open the Tracking screen, OrangeTill quietly re-queries the blockchain for any payment still waiting and updates the row if it has arrived — even rescuing one that had aged out of view. So if a customer's payment landed while the app was closed, it is caught the next time you look. This is watch-only and never writes to your History.

You can now require an optional 4-digit PIN to open Settings — useful when the counter iPad is shared with staff or faces customers. Set, change, or remove it any time under Settings → Security. The PIN is stored only on the device and hashed, never kept in plain text.

A single toggle in Settings → Security extends that same PIN to the Tracking screen, so your daily totals stay private on a customer-facing iPad. It is off by default; when it is on, opening Tracking asks for the PIN and then takes you straight there.

If you ever forget the manager PIN, a “Forgot PIN?” link on the unlock screen emails a 6-digit code to your account email. Enter it and the PIN clears, so you can set a new one — no lockout, no support ticket. The code expires in 15 minutes, and OrangeTill only ever verifies control of your email; it never sees or stores the PIN itself.

Merchants can now paste an extended public key (xpub) from their hardware or software wallet instead of a single static Bitcoin address. OrangeTill derives a fresh receiving address for each payment automatically, so no two customers ever see the same address. Better for privacy, eliminates address reuse, and makes payment detection unambiguous when two customers pay the same amount. Private keys never leave your wallet. Compatible with any BIP-32/44/84 wallet that exposes an xpub, including Tangem, Coldcard, and most hardware wallets.

On the charge screen, the Bitcoin amount now also displays its value in sats — for example “≈ 0.00015931 BTC” with “15,931 sats” beneath it. Many Bitcoiners think in sats, so showing both makes the amount easier to read at a glance.

Tapping the amount keypad quickly on iPad could trigger the browser’s double-tap-to-zoom and nudge the screen. The keypad now suppresses that gesture, so fast entry stays steady and in place.

Removed all 7 altcoin entries from the PWA coin list. Swept the website and all 169 Learn articles to Bitcoin-only positioning. Stablecoin articles reworked. Refund policy templates updated. X header redesigned. Bitcoin + Lightning window sticker ordered. Logo suite updated to v4 with "We Accept Bitcoin" type treatment variations.

Merchant settings — Business Name, Tax Rate, shortcuts, receipt message, logo, and UI toggles — saved correctly but vanished when iOS evicted the PWA from memory and did not come back on reopen. Root cause: syncPull only restored the settings blob from cloud KV if a wallet address was already present, so a wallet-less or fresh device never re-applied its saved settings. The restore gate was loosened to run whenever the cloud blob contains settings at all, while still preserving auth-managed plan and subscriptionStatus fields. Critical for mobile merchants whose phones aggressively close backgrounded apps.

The Lightning field now accepts reusable BOLT 12 offers (lno1…) in addition to Lightning Addresses and LNURL. This is the static, set-once, scan-by-many identifier produced by self-custodial wallets like Phoenix — ideal for a fixed counter. Validation recognizes the offer, and the charge screen generates a clean Lightning QR from it (the offer is any-amount; the customer's wallet prompts for the amount). Tested live at Beef & Ski with a Phoenix reusable offer.

Generating a QR for Lightning threw a silent error and left the button unresponsive. Root cause: the QR modal looked up the coin's display icon from the standard coin list, but Lightning is handled separately and was not in that list, so the lookup returned nothing and failed before reaching the modal's dedicated Lightning rendering. Added a Lightning fallback so the modal always has a valid icon and name. The Bitcoin and other-coin paths were unaffected.

With the guided tour toggled off, the Step 1 / Step 2 helper boxes on the charge screen could still appear on a fresh load. Two compounding causes: the guide state was never re-synced to the toggle when the app loaded, and the show/hide check passed an undefined value that flipped the boxes on instead of forcing them off. Fixed by syncing the guide on app load and coercing the toggle value to a true boolean, so the boxes reliably reflect the setting from the first render — hidden when off, shown when on.

We briefly explored a self-serve "Subscribe with USDC" billing option and confirmed eligibility on the Stripe account. This was retired with the June 2026 Bitcoin-only pivot — OrangeTill is now Bitcoin and Lightning Network only. As always, subscription payments are processed by Stripe and are completely separate from customer payments, which always go directly to the merchant's own wallet.

Full plan-based feature gating implemented across the PWA. Starter plan: 30-day payment history, analytics upsell card, staff upsell card. Growth and Annual: full history, analytics dashboard, staff access. Cancelled subscribers see a full lockout screen with Annual resubscribe link. Past-due subscribers see a soft amber warning banner. Paused subscribers see the full lockout screen.

Three new Stripe webhook handlers added: customer.subscription.updated (handles plan upgrades/downgrades, trial conversions, past_due, paused, and canceled states), invoice.payment_failed (stores failure metadata, attempt count, next retry timestamp — does not change status), invoice.payment_succeeded (clears failure flags, confirms active, stores lastPaidAt). Two shared helpers extracted: fetchCustomerEmail() and updateSubscriberKV() for consistent, safe KV writes across all handlers. All five webhook events now registered in Stripe dashboard.

syncPush now strips plan and subscriptionStatus before pushing to cloud KV — these are auth-managed fields that should not live in the sync blob. syncPull now restores plan and subscriptionStatus after merging cloud settings, preventing cloud data from overwriting auth-fresh values. Logout now clears both fields and removes any status overlay.

OrangeTill deployed to a dedicated iPad Mini 6 at Beef & Ski Restaurant & Pub, North Conway NH. Hardware: iPad Mini 6 (GoRoostr/eBay, Excellent condition), Maclocks Core Stand with iPad Mini 6/7 Space Enclosure (Black), Ailun tempered glass screen protector. Apple ID created (hello@nhbeefandski.com) with Apple Support assistance. PWA installed as home screen app. Guided Access enabled — iPad locked to OrangeTill. Tangem hardware wallet ordered for on-chain Bitcoin. Phoenix wallet installed for Lightning. KV record added manually: subscriber:hello@nhbeefandski.com, plan: annual.

OrangeTill merch store (bonfire.com/store/orangetill) integrated into the marketing site. New homepage section with four product cards (ILLIQUID., Quietly Stacking., The Genesis Block Mug, Born into a Sound Money System onesie) and a teaser line featuring "Real Housewife of Bitcoin." and "This Meeting Could Have Been Decentralized." Merch nav link added to both desktop and mobile menus. 30+ products available on Bonfire including beanies, totes, mugs, and t-shirts.

New From the Founder article published: "Never sell your Bitcoin — but what about spending it?" Covers the distinction between selling Bitcoin (BTC → fiat, exits the system) vs. spending it (BTC → goods/services, activates the currency). Includes the Satoshi white paper opening quote, a comparison table, the store-of-value vs. medium-of-exchange debate, and an honest US tax treatment section. learn.html and sitemap.xml updated.

Ricorra is a non-custodial Bitcoin subscription billing platform — the second product under Sofia Brands LLC. Name from Italian ricorrere (to recur). Domains registered: ricorra.com and ricorra.io. Architecture: same stack as OrangeTill (Cloudflare Pages + Workers + KV + Resend). Thesis: merchants set a price and billing cycle, subscribers pay Bitcoin directly to the merchant's wallet, Ricorra detects payment via Mempool.space API and manages the renewal cycle. We never touch funds. Build not started — spec and architecture phase.

Stripe activated in live mode. All five subscription plans are live — Starter ($9.99/mo), Growth ($24.99/mo), Annual ($99/yr), Nonprofit Monthly ($5.99/mo), and Nonprofit Annual ($49.99/yr).

Critical fix: the customer.subscription.created webhook was returning 200 OK but never writing the KV subscriber record. Root cause: customer_email is not populated by Stripe on this event type. Fix: Worker now fetches customer.email directly from the Stripe API using the customerId. Worker bumped to v1.10. Verified live against a real subscription event.

Every "Join Waitlist" and "Get Early Access" CTA across the marketing site — 180+ files including 174 Learn articles — now links directly to Stripe. The Annual plan (60-day free trial) is the flagship CTA target across all pages.

The hero badge changed from "Now in Beta · Join the Waitlist" to "Now Live · 60-Day Free Trial". The email capture form was replaced with a direct Stripe CTA button. Social proof copy updated to "Small businesses are accepting Bitcoin today." The bottom waitlist section was rebuilt as a live CTA section.

Kit (formerly ConvertKit) set up on the free plan. Launch broadcast sent to the learn subscriber list. Founder welcome email saved as a draft template. OrangeTill branded email template saved. Learn welcome email built with Hodl mascot and Tabler icon article cards.

OrangeTill X account launched at @OrangeTill. Profile photo set to the OrangeTill circular seal. Custom banner designed with Lucky Cat mascot, OrangeTill wordmark, DM Sans tagline, and coin icon row with watercolor texture. Founder intro post published. X Premium subscription in progress.

orangetill-hodl-svg-III.html updated with a new "White Background Poses" section — Wise, Happy, Curious, and Lucky Cat poses on clean white cards for social and email use. Hodl Tip Boxes across the brand kit now render the actual Hodl SVG instead of cat emoji. Lucky Cat with/without tail added in white background variants.

Two new sections added to the logo suite: Business Variant with "THE SIMPLEST BITCOIN POS IN THE WORLD" in clean DM Sans uppercase (on white and black), and Nonprofit Variant with "YOUR MISSION, YOUR BITCOIN." Same treatment. Both available as alternatives to the Playfair Display italic tagline.

Full ARIA landmark, label, and live region support across every screen. The amount display, Bitcoin equivalent, rate badge, and toast notifications all announce updates automatically. Every button, input, toggle, and modal has a meaningful accessible label.

Keyboard and screen reader focus is now trapped inside every modal while it is open — QR modal, Split Payment, Invoice Builder, Confirm dialogs, Receipt, CSV Export, Setup Wizard, Wallet Onboarding, and the staff PIN change overlay. Focus returns to the triggering element when any modal closes.

Up from 88 on the prior build. All automated contrast failures resolved, viewport zoom restriction removed, 16 passed audits extended to cover landmarks, labels, ARIA states, and live regions.

Inactive pills, the rate badge, and the rate timestamp all now meet WCAG AA contrast ratios. The rate badge uses a dark overlay for readable white text against the orange background. Inactive pills use a dedicated accessible gray (#767670) that passes 4.57:1 on white.

Settings collapsible section headers now announce their expanded or collapsed state. Period filter buttons in History and Analytics announce their selected state. The More Options toggle on the Charge screen announces whether the panel is open or closed.

The user-scalable=no and maximum-scale=1.0 viewport restrictions — which prevented low-vision users from pinching to zoom — have been removed.

The entire app now translates instantly — every screen, every label, every button. Supported: English, Spanish, French, Portuguese, Chinese, German, Japanese, Korean, Hindi, Arabic, Italian, Dutch, Russian, Afrikaans, Czech, Swahili, Turkish, Ukrainian, Indonesian, Polish, Swedish, Filipino, Hebrew, and Greek.

Arabic and Hebrew automatically switch the entire layout to right-to-left. Numbers stay left-to-right within RTL layouts.

Language is saved on each device independently and intentionally excluded from cloud sync — a merchant can run English on one device and Spanish on another simultaneously.

Every card interior in Settings now translates — Display Currency, Public Profile fields and buttons, Integrations webhook description, Staff Tools toggle labels, Hardware Wallet card, Weekly Digest fields, Data section, and the wallet onboarding card.

All 8 Troubleshooting accordion items — questions and full answers — are now translated across all 24 languages.

Chevrons are now preserved correctly on all section headers when language changes. Display Currency is visible by default. The Wallets collapse group correctly stops at the Display section in all languages.

15 languages (Dutch, Italian, Russian, Afrikaans, Czech, Swahili, Turkish, Ukrainian, Indonesian, Polish, Swedish, Filipino, Hindi, Japanese, Korean) had Spanish strings in the Staff & Locations section and Account sign-out description. All corrected with proper translations.

A permanent, shareable payment page at orangetill.io/u/your-slug. Customers visit, enter any amount and scan a QR code — no app needed. Perfect for tip jars, donations, online stores, and printed signs.

New Public Profile section in Settings. Choose a custom slug, tap Save & Publish, and share your link. Wallet addresses are pulled automatically from your Settings.

The customer-facing payment page received a full brand refresh — Hodl mascot in the hero, Playfair Display keypad, card-based layout, and slide-up QR animation.

Add staff members with a custom Staff ID and 4-digit PIN. Staff can access the Charge screen and view their own payment history — Settings and Analytics stay owner-only.

Create and manage multiple locations, each with its own name and optional wallet override. Assign staff members to a location — payments are automatically stamped with their location at checkout.

A dedicated staff login flow — enter owner email, Staff ID, then a 4-dot PIN keypad. Wrong PIN shakes with haptic feedback. Successful login scopes the session to that staff member and location.

Staff can request a PIN reset from the login screen. The owner receives an email notification and sets a temporary PIN from Settings. On next login, staff are prompted to create their own new PIN before entering the app.

Staff can view their own payments but cannot delete, refund, generate invoices, or clear history. Owners see everything and retain full control.

Every payment confirmed in staff mode is stamped with the staff member's ID and location. Owner history shows the full picture across all staff and locations.

One tap to reload the exact amount, coin, and note from your most recent payment. Speeds up high-volume checkout when selling the same item repeatedly.

A built-in tax summary broken down by quarter — total revenue and payment count per period. Export-ready for your accountant or Bitcoin tax software.

Tips are now tracked separately in Analytics. See total tips collected, tip rate, and average tip amount alongside your regular revenue.

Log refunds directly from payment history. Refunded amounts are tracked separately and excluded from revenue totals — keeping your books clean.

Export your payment history filtered to any custom date range. Choose all time, this month, this quarter, or a custom window — then download as a clean CSV.

After a payment is confirmed, customers can optionally view a clean confirmation page with payment details — great for record-keeping and building trust.

Generate a personal referral link from Settings. Share it with other merchants — when they sign up through your link, you both get rewarded at launch.

The note field now suggests your most-used note chips as you type, speeding up checkout for recurring items.

Receipt emails now pull your business name, and the template is fully branded with OrangeTill colors. Sent via Resend for reliable delivery.

Your public profile page now supports a bio, business hours, and Bitcoin and Lightning badges — giving customers more context before they pay.

Generate a payment request and share it via text, email, or AirDrop. Customers open it on any phone and pay without a QR code at the counter. Perfect for order-ahead, delivery, and remote clients.

Full dark mode support across the entire app. Toggle in Settings or follow your system preference. Warm black tones with OrangeTill's signature orange accents.

A fifth tab with visual payment analytics — revenue over time, average transaction size, and weekly trends. All calculated locally from your payment history.

Divide any charge across multiple customers. Useful for tables splitting a bill or customers paying part-Bitcoin, part-cash.

Save your most common transaction amounts for one-tap charging. Perfect for fixed-price items like coffee, market goods, or standard service fees.

Share a daily or weekly payment summary as an image — useful for bookkeeping records, social proof, or showing your accountant.

Subtle vibration on key interactions — payment confirmation, keypad taps, and error states. Makes the app feel native on iOS and Android.

Display prices in any of 26 fiat currencies. All payments are still stored in USD internally — this is a display preference for merchants operating in other markets.

Set your local sales tax rate in Settings. OrangeTill automatically back-calculates the pre-tax subtotal, displays the breakdown on the QR modal, logs tax in History, and includes it in CSV and Koinly exports.

Send a formatted email receipt to a customer after any transaction. Includes amount, coin, exchange rate, date, and your business name.

Opt into a weekly summary email delivered every Monday — total revenue, payment count, average sale, and a day-by-day bar chart. Your business recap, automatically.

Session tokens now last 90 days. Added a fallback that trusts a valid local token when the API is temporarily unreachable — prevents false logouts on flaky connections.

Export your payment history in Koinly's exact format — every payment tagged as income with USD value at time of sale. Works with any Bitcoin tax software or accountant.

Filter payment history by Today, This Week, This Month, and This Year. Totals update dynamically with each filter.

Step-by-step prompts for staff who are new to Bitcoin. Walks through each transaction with plain-English instructions. Toggle on/off in the topbar.

Run through a simulated transaction without recording anything. Perfect for training staff or demonstrating OrangeTill to a curious customer.

Increases all text on the charge screen for visibility across a counter. Useful in bright environments or when showing the screen to customers from a distance.

Settings and payment history sync across all your devices automatically. Open OrangeTill on a new phone and everything is already there.

A guided first-run experience that walks new merchants through adding their wallet addresses, setting up Bitcoin and Lightning, and entering their business name. Replaces the blank Settings screen for new users.

Passwordless login via email magic link or 6-digit code. No password to forget. Works in both the standalone PWA and any browser.

Monthly and annual subscription plans via Stripe. Annual plan includes a free trial. Subscription status gates access to the authenticated PWA experience.

Bitcoin and the Lightning Network, paid straight to your wallet. Live exchange rates from blockchain.info.

Always enter the price in dollars. OrangeTill converts to the exact Bitcoin equivalent in real time. No Bitcoin math required.

Generates a standard BIP-21 QR code for each payment. Compatible with every major Bitcoin wallet app.

Installable to your home screen on iPhone, Android, tablet, and desktop. Works offline for charge screen and history. No App Store required.

Every transaction logged with date, time, amount, coin, rate, and notes. Export to CSV for your records or accountant.

OrangeTill never holds funds. Payments go directly from customer wallet to merchant wallet on the blockchain. OrangeTill is purely a display and QR generation tool.

In-app accordion FAQ covering the most common questions and issues. No need to leave the app to find answers.

iOS Safari suppresses native browser dialogs in standalone PWA mode. All confirm/alert UI uses custom in-app modals that work correctly.