How it works
Follow a five-dollar tip all the way to a bank account
Six stages, no mystery. Here is exactly what happens between a guest holding their phone up to a QR code and money arriving in your bartender's account.
Scan
The guest's camera opens a web page. No app, no store, no account. The code on the card is a short, unambiguous string — it deliberately excludes the letters that get misread as digits, so a guest typing it off a table tent in a dark bar can't get it wrong.
Identify
Their device is issued a real, anonymous identity in the background. Nothing to fill in, nothing to remember. This is what lets every payment endpoint stay properly authenticated instead of being left open — more on that below.
Choose
Your suggested amounts, or a custom one within the floor and ceiling you set. They can tick to cover the processing fee, and they see the exact total before they authorise anything.
Capture
Apple Pay, Google Pay, or a card. The tip is recorded before the charge is attempted and reconciled after, so a connection dropped mid-payment leaves a row to resolve rather than a mystery.
Settle
The tip rests a rolling two-business-day window. Direct tips accrue to the individual immediately; pooled tips accrue to the pool and are divided at close.
Pay out
Settled funds are drafted into a payout run on the venue's schedule — one ACH line per person, not one per tip. A human presses send.
Stages four to six happen without anyone touching anything, which is rather the point.
The interesting part
How a stranger tips without an account — and without an open door
A guest about to tip a bartender is not going to create an account. The lazy solution is to make the payment endpoints public. We didn't do that.
What we avoided
Un-gated tipping endpoints. Once a payment route accepts unauthenticated requests, every protection downstream — who owns this record, who may read it, who may refund it — has to be reinvented at that one route, and something will eventually be missed.
What we did instead
The guest's browser generates a random device id and exchanges it for genuine identity tokens. From that point they are an ordinary authenticated user with the default role — they can create a tip and read their own receipt, and nothing else. Every gate stays exactly where it was.
Rate limited
A device id is self-asserted, so it proves nothing. Minting is capped per device and per network, which stops the endpoint becoming an identity fountain.
Claimable later
If that guest ever signs in properly, their anonymous identity folds into the real one and the tips they left stay attributed to them.
Cleaned up
Unclaimed identities that never produced a tip are retired on a schedule. Ones attached to real money are kept — they're part of a receipt.
The arithmetic
Why the split always adds up
Divide $1.00 three ways and you get 33.333… each. Somebody has to receive the odd cent, and "close enough" is not a thing when the number is somebody's wages.
Every split uses the largest-remainder method: floor each share, then hand out the leftover cents to the largest fractional parts, breaking ties on a stable key. Two consequences follow, and both matter more than they sound.
- The parts equal the whole Exactly. Not within a cent. Nothing is dropped, rounded off, or quietly kept.
- The same inputs give the same answer Including which person gets the odd cent — so re-running a close changes nothing, and "why did she get a cent more" has a real answer.
Money is held in whole cents throughout. No floating-point number ever touches a
currency value, because 0.1 + 0.2 ≠ 0.3 is how a payroll complaint
starts.
$1.00 split three ways
- Exact share
- 33.33¢
- Ann
- 34¢
- Bob
- 33¢
- Cyd
- 33¢
- Total
- 100¢
Ann takes the odd cent this time, and will take it every time these exact inputs recur — deterministic, not arbitrary. Try it yourself with the toggle on the home page.
Fees, in detail
Who pays the processor
Card processing has a real cost. Somebody carries it, and the honest thing is to say which of the three options you've chosen.
The guest covers it
The default offer, with the box unticked — a pre-ticked upcharge is a dark pattern. Most guests, asked once, say yes. Your person nets the whole number the guest chose, and every rounding remainder lands on their side.
The venue absorbs it
Turn the option off and fees come out of the gross. A $5.00 tip arrives as $4.84. Cleaner for the guest, costlier for the tip.
Nobody gets a surprise
Whichever you pick, the guest sees the exact total before authorising, and the recipient sees gross, fees, and net on every tip. There is no third number hiding anywhere.
One rule we enforce regardless: if processing would cost as much as the tip itself, the charge is refused rather than collected. Taking a dollar to hand somebody nothing is worse than declining it.
Where a code can live
- Check presenter
- QR
- Table tent
- QR + code
- Bar rail
- NFC tag
- Lanyard card
- QR
- Show program
- Link
- Kiosk / tablet
- Hosted page
A code names a destination, not a person — so a manager repoints it from an individual to a pool without reprinting a single sticker.
What you don't have to change
It sits beside your POS. On purpose.
There is no integration project here. Tip Tip Hooray! never touches your point of sale, your terminals, or your processor contract — which means no vendor negotiation, no certification cycle, and no waiting on someone else's roadmap.
Hours can be punched in the app or pushed from whatever scheduler you already run. Bank accounts are linked through Plaid, so we hold a processor token and the last four digits — never a full account number, never credentials.
That's the whole thing. Shall we get you collecting?
Set up in an afternoon. First tip before last call.