From 17ba8d16dfd215fab23c20d2f78767555aba751c Mon Sep 17 00:00:00 2001 From: shum Date: Tue, 25 Aug 2026 11:19:35 +0000 Subject: [PATCH] plan: add the Pay button under the payment method --- badges-flow-mvp.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/badges-flow-mvp.svg b/badges-flow-mvp.svg index 0d42ecb9bb..4dd62ec7ef 100644 --- a/badges-flow-mvp.svg +++ b/badges-flow-mvp.svg @@ -1 +1 @@ -Supporter badges - every screen, in the app and on the webone tree per surface, left to right - blue is the normal path, orange a variant, grey a platform difference, and the dashed pair is everything that crosses between the app and the siteplans/2026-08-21-badges-web-checkout.mdeditable SVGIn the appiOS idiom shown; Android and desktop differ only in chromeFor the operatorthe CLI behind the codesChoosing a badgeRedeeming a code, and what it gives youWhen something goes wrongSupport SimpleXSimpleX is built by people who believe privatemessaging should not depend on advertising.A badge helps pay for it.iWhy SimpleX is built this wayChoose your levelRedeem badge codeA1. Where it startsBoth actions ship today. On iOS and Play, 'Redeem badge code' is nota secondary path - it is the only one, because store evidence is notverified and the store purchase was removed rather than leftcharging for nothing.Choose your level‹SupportYour levelBoth levels send bigger files and keepthem on the servers for longer.Supporter$7 / month2 GB files7 days storageLegend$70 / month5 GB files21 days storagePerks are app constants, not catalog data -the catalog carries prices only.ContinueA2. Choose your levelPrices come from CRBadgeCatalog, never the store products. Onesource, so the app and the site cannot disagree about what a badgecosts.Continue‹Your levelLegendPrepaid months. Nothing renews by itself.1 month$703 months$140save 33%12 months$420save 50%3 months is 2x the monthly price, 12 is 6x. Thesaving compares against the undiscounted totaland is never sent anywhere - the server pricesevery charge it makes.Continue in browserRedeem badge codeA3. How long - desktop and Android fossThe only builds with more than one way to pay, and the only onesthat link out. 'Continue in browser' carries the answers so far asURL parameters.Continue‹LegendHow to payCheckout happens in your browser.Nothing is charged in the app.PAY WITHBitcoinMoneroCardContinue in browserOpens badges.simplex.chat with tier, monthsand method already chosen.A4. Only where there is a choiceDesktop and Android foss only. The store builds have no methods atall and never reach this screen. The choice is a hint: the site asksagain if the parameter is unusable.The catalog fetch fails, or the operator disabled the price.‹SupportYour levelBoth levels send bigger files and keepthem for longer.Supporter—price unavailableLegend—price unavailableCould not reach the badge serviceinternalContinueDisabled, not hidden - a level that exists butcannot be priced still exists.A2b. The service is unreachableEvery option renders disabled and nothing crashes. The same statecovers a tier whose price was disabled by the operator - the appcannot tell the two apart, and does not need to.On iOS and Play there is nothing to link out to, so the screen endsat redemption.‹Your levelLegendPrepaid months. Nothing renews by itself.1 month$703 months$140save 33%12 months$420save 50%Buy a code at badges.simplex.chat from anybrowser, then redeem it here.Redeem badge codeno purchase button on this buildA3b. How long - iOS and PlaySame screen, different ending. The store purchase action is removedfor the whole of this plan, and no link out replaces it: Apple andGoogle reject steering to outside purchase for digital goods, so thescreen simply ends at redemption.Redeem badge code - and the only route on a store build‹SupportRedeem codePaste the code from your receipt.SXB-9K2M4-7QRT1-XZ5WPasteRedeemFormats as you type and folds I and L to 1,O to 0 - the same normalisation the servicedoes, so a code read off a screen cannot failon ambiguity alone.A5. RedeemingTwenty Crockford characters in five groups. The check character isverified before anything is sent, so a mistyped code never reachesthe service and never costs a throttle token.a valid code‹SettingsSupporter perksLegendshown on your profileENDS24 August 2027Prepaid months have no billing date. The badgeis reissued each month from the balance youalready paid for, and ends when it runs out.Add more monthsA6. After redeeming'Ends', never 'renews' - nothing recurs and the copy must not implyit does. The date is the paid-through date from the ledger balance,not the credential's expiry, which is a week-aligned internal theuser never sees.on the profile‹ChatsAliceAAliceLegendlast seen recentlyIN GROUPSAAliceLegendBBobSupporterCCarolThe badge travels with the profile, so it showswherever a profile does - in chats, in a memberlist, on a contact card.A7. How everyone else sees itThe point of the whole flow. The badge is a signed credentialcarried in the profile and verified by the recipient's own clientagainst the issuer key it already ships - not a flag the serverasserts, and not something a client can set for itself.Any error the service returns: code_invalid, code_used, code_expiredor rate_limited.‹SupportRedeem codeThis code isn't validcode_invalidThis code has already been usedcode_usedThis code has expiredcode_expiredToo many attempts. Try again in 4 minutes.rate_limited - retryAfter 240Could not verify the credentialinternalOne message per error the service can return.Anything else, including a credential that failsto verify locally, shows the service's own textrather than a blank screen.A5b. Every redemption errorA revoked code is deliberately indistinguishable from an unknown one- both say 'isn't valid', so a guesser learns nothing from arevocation. Support tells them apart with codes status; the wiredoes not.The last paid month has been issued and the balance is zero.‹SettingsSupporter perksLegendended 24 August 2027Your badge has endedThe months you paid for have all been issued.The badge stopped showing on your profile;nothing was cancelled and nothing is owed.Add more monthsA6b. The balance runs outAn exhausted balance is not an error: the service returns nocredential and a zero-balance statement, and the app says soplainly. Prepaid means it simply stops.simplex-badge-service$simplex-badge-service codes issue \--type legend --months 12 --count 3 \--batch conf-2026 --expires 2027-08-24SXB-9K2M4-7QRT1-XZ5WB-3NHD8SXB-2W7XP-4LMQ8-9DKR3-6TVZ5SXB-8HYNC-1FGJ6-5PBW2-7QSXD3 codes issued. Printed once; only hashes stored.OP1. Minting codesCompensation and promotional codes have no orderbehind them, so they are random rather thanderived. Printed once to stdout and never again -the database holds only SHA-256 hashes, which iswhat makes a stolen copy useless.support$simplex-badge-service codes status \--ref K7M2Qorder 8f3a...c21e paid 24 Augbadge legend, 12 monthscode redeemed 2 Sep--reveal refused: code already redeemedOP2. Resolving a referenceThe customer quotes the five-character referencefrom their receipt - never the order id, never thecode. --reveal is refused once a code is redeemedor revoked, on the same reasoning that stops theweb page disclosing it.On the webbadges.simplex.chat - one centred column, max-width 560, the logo the only imageBuying, start to finishThe other ways it endsRefused at checkoutbadges.simplex.chatSupport SimpleXSimpleX has no ads, no user accounts and nothing to sell.A supporter badge helps pay for the people who build it.Supporter $7 / month - 2 GB files, 7 days storageLegend $70 / month - 5 GB files, 21 days storageChoose your levelAlready bought a code?Redeem it in the app: Settings, Supporter perks.The badge shows on your profile. Nothing renews byitself, and no account is created.simplex.chat/contactB1. The landing pageNot in the plan, and it should be. D3 specifies four screens starting at thetier question, which assumes everyone arrives from the app. Someone reaching thesite from a link or a search needs to know what this is before being asked tochoose a level - and someone who already has a code needs telling thatredemption happens in the app, not here.Choose your levelbadges.simplex.chat/#/tierChoose your levelBigger files, and longer for people to collect them.Supporter$7 / month2 GB files7 days storageLegend$70 / month5 GB files21 days storageContinuesimplex.chat/contactB2. Question one: the levelThe wizard proper starts here. One centred column at max-width 560, generouswhitespace, accent #0053D0 - deliberately not the app's chrome, because it isnot the app. One question per screen, and a tier with no active price rendersdisabled rather than hidden.Continuebadges.simplex.chat/#/monthsHow long?Prepaid months. Nothing renews by itself.1 month$703 months$140save 33%12 months$420save 50%Continuesimplex.chat/contactB3. How longEvery figure comes from GET /api/catalog, the same totals the RPC catalog givesthe app. The browser formats minor units and computes the comparison only - itnever multiplies a price by a month count.Continuebadges.simplex.chat/?tier=legend&months=12&pay=xmrCheck your orderLevelLegendDuration12 monthsTotal$420.00PAY WITHBitcoinMoneroCardCard is handled by Stripe. Bitcoin and Monero areon-chain, through BTCPay.simplex.chat/contactB4. Check your order, and payTwo screens in the plan, one here. The summary and the method are the samedecision - what am I buying and how do I hand over the money - and splittingthem made the buyer confirm a choice they had not made yet. POST /api/checkoutstill carries priceId, offerId and method and nothing else: badge type andmonths are derived server-side from the ids, so a tampered request cannot buy aLegend badge at a Supporter price. A buyer arriving from the app skips B1 to B3entirely - ?tier=legend&months=12&pay=xmr answers every question and marks whichbutton is primary.Pay with Monerobadges.simplex.chat/?order=8f3a...c21eSend 1.482 XMR$420.00 - this rate is held for 58:12MONERO ADDRESS48HqK2...9fRtWcCopyWaiting for the payment to confirmREFERENCEK7M2QBookmark this page - the address and the countdownboth live on this URL.simplex.chat/contactB5. Paying in cryptoPolls GET /api/order every 2s for the first minute then every 10s, and stopswhile the tab is hidden. A partial payment stays 'pending' - partials are thenormal first event of a multi-transaction payment, not a failure.it confirmsbadges.simplex.chat/?order=8f3a...c21e✓Paid. Here is your code.SXB-9K2M4-7QRT1-XZ5WB-3NHD8Copy codescan to carry itto your phoneREDEEM IT IN THE APPSettings -> Supporter perks -> Redeem codeThe code is shown here only.This page works until 23 September, andstops the moment the code is redeemed.The link is the code - treat it so.simplex.chat/contactB6. The code, onceDerived from the order id rather than stored, so a reload recomputes it whileonly its hash is ever at rest. Disclosure stops at redemption, at revocation, or30 days after settlement - whichever comes first.Redeemed, revoked, or thirty days after settlement.badges.simplex.chat/?order=8f3a...c21eThis code has been redeemedThe code is no longer shown hereIt was redeemed on 2 September. If that was not you,get in touch.Legend, 12 monthspaid 24 AugustThe order stays; the capability does not.simplex.chat/contactB6b. The page outlives the codeDisclosure ends at redemption, at revocation, or 30 days after settlement. Theorder is still here because support resolves a reference against it - but theURL stops being equivalent to the code, which is the whole point.The provider's section is missing from badge_service.ini.badges.simplex.chat/#/checkoutCheck your orderLevelLegendDuration12 monthsTotal$420.00Monero is temporarily unavailableTry another method, or come back later.PAY WITHBitcoinMonerounavailableCardsimplex.chat/contactB4b. A provider is not configured503 provider_unavailable from /api/checkout. The method is shown and disabledrather than omitted, so an operator who forgot a section sees it immediatelyinstead of wondering why nobody pays in Monero.Pay by card - Stripe returns herebadges.simplex.chat/?order=51c7...9d02Payment receivedWaiting for the card network to confirm.Still processingThis usually takes a few seconds. The page updates itself.If nothing happens for 15 minutes, we stop waitingand show you what to do next.simplex.chat/contactB5b. Coming back from the card flowStripe's success_url returns here with ?order=. The return is NOT proof ofpayment - only the webhook settles an order, so this screen polls rather thancelebrating. The cancel URL deliberately carries no order reference at all.The invoice expired with less than the full amount received.badges.simplex.chat/?order=8f3a...c21eThis invoice expired0.734 XMR arrived, which is not the full amountThe rate window has closed, so the shortfall is no longermeaningful. Quote the reference below and we will sort it out.REFERENCEK7M2QStart a new invoiceNever shows the code, and never the ?order= URL.simplex.chat/contactB5c. Expired, and underpaidThe one state that needs a human. An expired-but-paid invoice still settleslater - late on-chain settlement is routine and moves the order to paid - but anunderpaid one stops here with the reference support resolves by.The price was disabled while the buyer was deciding.badges.simplex.chat/#/checkoutThese prices have changedStart again with the current pricesThe badge you chose was repriced while you were deciding.Nothing was charged.Start againprice_disabled / offer_disabled / offer_mismatchsimplex.chat/contactB4c. The catalog moved underneathPrices are checked at checkout and only there. A deprecated price is stillhonoured for someone mid-flow; a disabled one is refused. Repricing appends anew price rather than editing the old, so this is rare but reachable.Five checkout requests inside one minute, from one IP.badges.simplex.chat/#/checkoutToo many attemptsTry again in 46 secondsThe Pay button is disabled until then.Pay with Monero429, with Retry-After. The polling loop backs off tothat value rather than treating it as a failure.simplex.chat/contactB4d. Rate limitedFive checkout requests a minute per IP, because each one reaches a paymentprovider. Order polling gets sixty. The redemption path has no IP at all - itruns over SimpleX RPC and is throttled per signer instead.On the web, on a phonethe same site at 390 px - what stays in columns, and what has to stackThe same six screens at 390 pxbadges.simplex.chatSupport SimpleXSimpleX has no ads and nothing to sell.A badge helps pay for the people who build it.Supporter $7 / month - 2 GB files, 7 days storageLegend $70 / month - 5 GB files, 21 days storageChoose your levelAlready bought a code?Redeem it in the app: Settings, Supporter perks.simplex.chat/contactM1. Nothing to reflowThe landing page was already a single column ofone thing after another, so the phone gets thesame page with a smaller hero. This is what themax-width 560 rule buys: on a phone the columnsimply becomes the viewport.Choose your levelbadges.simplex.chat/#/tierChoose your levelBigger files, and longer to collect them.Supporter$7 / mo2 GB files7 days storageLegend$70 / mo5 GB files21 days storageContinuesimplex.chat/contactM2. Two tiers still fit side by side169 px each at 390, and 134 at 320. Two things abuyer is comparing must stay comparable: stackingthem would put the second below the fold and turna comparison into a scroll. The badge art shrinks;nothing else changes.Continuebadges.simplex.chat/#/monthsHow long?Prepaid months. Nothing renews.1 month$703 months$140save 33%12 months$420save 50%Continuesimplex.chat/contactM3. Three durations still fit across110 px each at 390, 87 at 320. They are threevalues of one number, so they belong on one linewhere the prices can be read against each other;the saving pill sits under its price rather thanbeside it.Continuebadges.simplex.chat/?tier=legend&months=12&pay=xmrCheck your orderLevelLegendDuration12 monthsTotal$420.00PAY WITHBitcoinMoneroCardCard by Stripe. Bitcoin and Moneroon-chain, through BTCPay.simplex.chat/contactM4. The widest thing on the siteThe summary and the three ways to pay are thetightest fit in the document: 110 px per button at390 and 87 at 320, which still holds a 24 px markabove a 47 px word. This is the screen D2's 320 pxcheck is really about, and the reason the markscarry no text beside them.Pay with Monerobadges.simplex.chat/?order=8f3a...c21eSend 1.482 XMR$420.00 - rate held for 58:12MONERO ADDRESS48HqK2...9fRtWcCopyWaiting for the paymentREFERENCEK7M2Qsimplex.chat/contactM5. Here the columns have to stackThe QR and the payment details cannot sit side byside at this width, so they stack - and the QRgoes first, because a phone paying from a walletapp on the same device needs the address, while aphone being scanned by another device needs thecode. Both are one thumb apart.it confirmsbadges.simplex.chat/?order=8f3a...c21e✓Paid. Here is your code.SXB-9K2M4-7QRT1-XZ5WB-3NHD8Copy codescan to carry it to another deviceREDEEM IT IN THE APPSettings -> Supporter perks -> Redeem codeThe code is shown here only.This page works until 23 September, andstops the moment the code is redeemed.simplex.chat/contactM6. The code stays the heroEverything stacks, in the order it is needed: thecode, the button that copies it, the QR thatcarries it to another device, then where to putit. The warning stays last and stays red - it isthe only place the code is shown, and on a phoneit is the easiest to lose.Continue in browsertier, months and method as URL parametersthe code is pasted into A5the only thing that crosses from the site back to the appDesign document. The app and the site are each one tree read left to right, and the third band is the same site at phone width. In a tree: a screen is always to the left of everything it leads to, each lane is labelled for what its screens have in common, and the cause of a branch is written above the screen it produces, in the colour of the line that reaches it.App screens are drawn in the iOS idiom; Android and desktop differ only in chrome. The site is drawn in its own idiom - one centred column at max-width 560, accent #0053D0 from website/tailwind.config.js - and is deliberately not a copy of the app's. Badge artwork is the shipped art, verbatim from MR/images/badge_{supporter,legend}.svg, and the hero on A1 and B1 is phone-supporter.png from simplex-chat-art, the same asset PhoneSupporterHero draws on that screen today. D2 asks for the logo alone, and the tier cards carrying the badges are the one deliberate deviation. The Bitcoin and Monero marks are the official ones from simple-icons (CC0-1.0) in their registered brand colours; the card glyph is Lucide's credit-card (ISC).Built today: the service schema, the pricing catalog, the ledger, code derivation and classification, credential signing, the RPC dispatcher and the operator CLI. Design, not yet built: every screen above, the web listener and its endpoints, both payment providers, and the client redeem path. Store purchase is removed on iOS and Play for the duration of this plan. \ No newline at end of file +Supporter badges - every screen, in the app and on the webone tree per surface, left to right - blue is the normal path, orange a variant, grey a platform difference, and the dashed pair is everything that crosses between the app and the siteplans/2026-08-21-badges-web-checkout.mdeditable SVGIn the appiOS idiom shown; Android and desktop differ only in chromeFor the operatorthe CLI behind the codesChoosing a badgeRedeeming a code, and what it gives youWhen something goes wrongSupport SimpleXSimpleX is built by people who believe privatemessaging should not depend on advertising.A badge helps pay for it.iWhy SimpleX is built this wayChoose your levelRedeem badge codeA1. Where it startsBoth actions ship today. On iOS and Play, 'Redeem badge code' is nota secondary path - it is the only one, because store evidence is notverified and the store purchase was removed rather than leftcharging for nothing.Choose your level‹SupportYour levelBoth levels send bigger files and keepthem on the servers for longer.Supporter$7 / month2 GB files7 days storageLegend$70 / month5 GB files21 days storagePerks are app constants, not catalog data -the catalog carries prices only.ContinueA2. Choose your levelPrices come from CRBadgeCatalog, never the store products. Onesource, so the app and the site cannot disagree about what a badgecosts.Continue‹Your levelLegendPrepaid months. Nothing renews by itself.1 month$703 months$140save 33%12 months$420save 50%3 months is 2x the monthly price, 12 is 6x. Thesaving compares against the undiscounted totaland is never sent anywhere - the server pricesevery charge it makes.Continue in browserRedeem badge codeA3. How long - desktop and Android fossThe only builds with more than one way to pay, and the only onesthat link out. 'Continue in browser' carries the answers so far asURL parameters.Continue‹LegendHow to payCheckout happens in your browser.Nothing is charged in the app.PAY WITHBitcoinMoneroCardContinue in browserOpens badges.simplex.chat with tier, monthsand method already chosen.A4. Only where there is a choiceDesktop and Android foss only. The store builds have no methods atall and never reach this screen. The choice is a hint: the site asksagain if the parameter is unusable.The catalog fetch fails, or the operator disabled the price.‹SupportYour levelBoth levels send bigger files and keepthem for longer.Supporter—price unavailableLegend—price unavailableCould not reach the badge serviceinternalContinueDisabled, not hidden - a level that exists butcannot be priced still exists.A2b. The service is unreachableEvery option renders disabled and nothing crashes. The same statecovers a tier whose price was disabled by the operator - the appcannot tell the two apart, and does not need to.On iOS and Play there is nothing to link out to, so the screen endsat redemption.‹Your levelLegendPrepaid months. Nothing renews by itself.1 month$703 months$140save 33%12 months$420save 50%Buy a code at badges.simplex.chat from anybrowser, then redeem it here.Redeem badge codeno purchase button on this buildA3b. How long - iOS and PlaySame screen, different ending. The store purchase action is removedfor the whole of this plan, and no link out replaces it: Apple andGoogle reject steering to outside purchase for digital goods, so thescreen simply ends at redemption.Redeem badge code - and the only route on a store build‹SupportRedeem codePaste the code from your receipt.SXB-9K2M4-7QRT1-XZ5WPasteRedeemFormats as you type and folds I and L to 1,O to 0 - the same normalisation the servicedoes, so a code read off a screen cannot failon ambiguity alone.A5. RedeemingTwenty Crockford characters in five groups. The check character isverified before anything is sent, so a mistyped code never reachesthe service and never costs a throttle token.a valid code‹SettingsSupporter perksLegendshown on your profileENDS24 August 2027Prepaid months have no billing date. The badgeis reissued each month from the balance youalready paid for, and ends when it runs out.Add more monthsA6. After redeeming'Ends', never 'renews' - nothing recurs and the copy must not implyit does. The date is the paid-through date from the ledger balance,not the credential's expiry, which is a week-aligned internal theuser never sees.on the profile‹ChatsAliceAAliceLegendlast seen recentlyIN GROUPSAAliceLegendBBobSupporterCCarolThe badge travels with the profile, so it showswherever a profile does - in chats, in a memberlist, on a contact card.A7. How everyone else sees itThe point of the whole flow. The badge is a signed credentialcarried in the profile and verified by the recipient's own clientagainst the issuer key it already ships - not a flag the serverasserts, and not something a client can set for itself.Any error the service returns: code_invalid, code_used, code_expiredor rate_limited.‹SupportRedeem codeThis code isn't validcode_invalidThis code has already been usedcode_usedThis code has expiredcode_expiredToo many attempts. Try again in 4 minutes.rate_limited - retryAfter 240Could not verify the credentialinternalOne message per error the service can return.Anything else, including a credential that failsto verify locally, shows the service's own textrather than a blank screen.A5b. Every redemption errorA revoked code is deliberately indistinguishable from an unknown one- both say 'isn't valid', so a guesser learns nothing from arevocation. Support tells them apart with codes status; the wiredoes not.The last paid month has been issued and the balance is zero.‹SettingsSupporter perksLegendended 24 August 2027Your badge has endedThe months you paid for have all been issued.The badge stopped showing on your profile;nothing was cancelled and nothing is owed.Add more monthsA6b. The balance runs outAn exhausted balance is not an error: the service returns nocredential and a zero-balance statement, and the app says soplainly. Prepaid means it simply stops.simplex-badge-service$simplex-badge-service codes issue \--type legend --months 12 --count 3 \--batch conf-2026 --expires 2027-08-24SXB-9K2M4-7QRT1-XZ5WB-3NHD8SXB-2W7XP-4LMQ8-9DKR3-6TVZ5SXB-8HYNC-1FGJ6-5PBW2-7QSXD3 codes issued. Printed once; only hashes stored.OP1. Minting codesCompensation and promotional codes have no orderbehind them, so they are random rather thanderived. Printed once to stdout and never again -the database holds only SHA-256 hashes, which iswhat makes a stolen copy useless.support$simplex-badge-service codes status \--ref K7M2Qorder 8f3a...c21e paid 24 Augbadge legend, 12 monthscode redeemed 2 Sep--reveal refused: code already redeemedOP2. Resolving a referenceThe customer quotes the five-character referencefrom their receipt - never the order id, never thecode. --reveal is refused once a code is redeemedor revoked, on the same reasoning that stops theweb page disclosing it.On the webbadges.simplex.chat - one centred column, max-width 560, the logo the only imageBuying, start to finishThe other ways it endsRefused at checkoutbadges.simplex.chatSupport SimpleXSimpleX has no ads, no user accounts and nothing to sell.A supporter badge helps pay for the people who build it.Supporter $7 / month - 2 GB files, 7 days storageLegend $70 / month - 5 GB files, 21 days storageChoose your levelAlready bought a code?Redeem it in the app: Settings, Supporter perks.The badge shows on your profile. Nothing renews byitself, and no account is created.simplex.chat/contactB1. The landing pageNot in the plan, and it should be. D3 specifies four screens starting at thetier question, which assumes everyone arrives from the app. Someone reaching thesite from a link or a search needs to know what this is before being asked tochoose a level - and someone who already has a code needs telling thatredemption happens in the app, not here.Choose your levelbadges.simplex.chat/#/tierChoose your levelBigger files, and longer for people to collect them.Supporter$7 / month2 GB files7 days storageLegend$70 / month5 GB files21 days storageContinuesimplex.chat/contactB2. Question one: the levelThe wizard proper starts here. One centred column at max-width 560, generouswhitespace, accent #0053D0 - deliberately not the app's chrome, because it isnot the app. One question per screen, and a tier with no active price rendersdisabled rather than hidden.Continuebadges.simplex.chat/#/monthsHow long?Prepaid months. Nothing renews by itself.1 month$703 months$140save 33%12 months$420save 50%Continuesimplex.chat/contactB3. How longEvery figure comes from GET /api/catalog, the same totals the RPC catalog givesthe app. The browser formats minor units and computes the comparison only - itnever multiplies a price by a month count.Continuebadges.simplex.chat/?tier=legend&months=12&pay=xmrCheck your orderLevelLegendDuration12 monthsTotal$420.00PAY WITHBitcoinMoneroCardPay $420.00 with MoneroCard is handled by Stripe. Bitcoin and Monero areon-chain, through BTCPay.simplex.chat/contactB4. Check your order, and payTwo screens in the plan, one here. The summary and the method are the samedecision - what am I buying and how do I hand over the money - and splittingthem made the buyer confirm a choice they had not made yet. POST /api/checkoutstill carries priceId, offerId and method and nothing else: badge type andmonths are derived server-side from the ids, so a tampered request cannot buy aLegend badge at a Supporter price. A buyer arriving from the app skips B1 to B3entirely - ?tier=legend&months=12&pay=xmr answers every question and picks themethod. The three marks are a choice, not three actions: D7 has one Pay button,it carries the total, and it is the last thing anyone presses - so the amount ison screen at the moment of paying and the site keeps the choose-then-continuerhythm of B2 and B3.Pay with Monerobadges.simplex.chat/?order=8f3a...c21eSend 1.482 XMR$420.00 - this rate is held for 58:12MONERO ADDRESS48HqK2...9fRtWcCopyWaiting for the payment to confirmREFERENCEK7M2QBookmark this page - the address and the countdownboth live on this URL.simplex.chat/contactB5. Paying in cryptoPolls GET /api/order every 2s for the first minute then every 10s, and stopswhile the tab is hidden. A partial payment stays 'pending' - partials are thenormal first event of a multi-transaction payment, not a failure.it confirmsbadges.simplex.chat/?order=8f3a...c21e✓Paid. Here is your code.SXB-9K2M4-7QRT1-XZ5WB-3NHD8Copy codescan to carry itto your phoneREDEEM IT IN THE APPSettings -> Supporter perks -> Redeem codeThe code is shown here only.This page works until 23 September, andstops the moment the code is redeemed.The link is the code - treat it so.simplex.chat/contactB6. The code, onceDerived from the order id rather than stored, so a reload recomputes it whileonly its hash is ever at rest. Disclosure stops at redemption, at revocation, or30 days after settlement - whichever comes first.Redeemed, revoked, or thirty days after settlement.badges.simplex.chat/?order=8f3a...c21eThis code has been redeemedThe code is no longer shown hereIt was redeemed on 2 September. If that was not you,get in touch.Legend, 12 monthspaid 24 AugustThe order stays; the capability does not.simplex.chat/contactB6b. The page outlives the codeDisclosure ends at redemption, at revocation, or 30 days after settlement. Theorder is still here because support resolves a reference against it - but theURL stops being equivalent to the code, which is the whole point.The provider's section is missing from badge_service.ini.badges.simplex.chat/#/checkoutCheck your orderLevelLegendDuration12 monthsTotal$420.00Monero is temporarily unavailableTry another method, or come back later.PAY WITHBitcoinMonerounavailableCardPay $420.00 with Bitcoinsimplex.chat/contactB4b. A provider is not configured503 provider_unavailable from /api/checkout. The method is shown and disabledrather than omitted, so an operator who forgot a section sees it immediatelyinstead of wondering why nobody pays in Monero.Pay by card - Stripe returns herebadges.simplex.chat/?order=51c7...9d02Payment receivedWaiting for the card network to confirm.Still processingThis usually takes a few seconds. The page updates itself.If nothing happens for 15 minutes, we stop waitingand show you what to do next.simplex.chat/contactB5b. Coming back from the card flowStripe's success_url returns here with ?order=. The return is NOT proof ofpayment - only the webhook settles an order, so this screen polls rather thancelebrating. The cancel URL deliberately carries no order reference at all.The invoice expired with less than the full amount received.badges.simplex.chat/?order=8f3a...c21eThis invoice expired0.734 XMR arrived, which is not the full amountThe rate window has closed, so the shortfall is no longermeaningful. Quote the reference below and we will sort it out.REFERENCEK7M2QStart a new invoiceNever shows the code, and never the ?order= URL.simplex.chat/contactB5c. Expired, and underpaidThe one state that needs a human. An expired-but-paid invoice still settleslater - late on-chain settlement is routine and moves the order to paid - but anunderpaid one stops here with the reference support resolves by.The price was disabled while the buyer was deciding.badges.simplex.chat/#/checkoutThese prices have changedStart again with the current pricesThe badge you chose was repriced while you were deciding.Nothing was charged.Start againprice_disabled / offer_disabled / offer_mismatchsimplex.chat/contactB4c. The catalog moved underneathPrices are checked at checkout and only there. A deprecated price is stillhonoured for someone mid-flow; a disabled one is refused. Repricing appends anew price rather than editing the old, so this is rare but reachable.Five checkout requests inside one minute, from one IP.badges.simplex.chat/#/checkoutToo many attemptsTry again in 46 secondsThe Pay button is disabled until then.Pay $420.00 with Monero429, with Retry-After. The polling loop backs off tothat value rather than treating it as a failure.simplex.chat/contactB4d. Rate limitedFive checkout requests a minute per IP, because each one reaches a paymentprovider. Order polling gets sixty. The redemption path has no IP at all - itruns over SimpleX RPC and is throttled per signer instead.On the web, on a phonethe same site at 390 px - what stays in columns, and what has to stackThe same six screens at 390 pxbadges.simplex.chatSupport SimpleXSimpleX has no ads and nothing to sell.A badge helps pay for the people who build it.Supporter $7 / month - 2 GB files, 7 days storageLegend $70 / month - 5 GB files, 21 days storageChoose your levelAlready bought a code?Redeem it in the app: Settings, Supporter perks.simplex.chat/contactM1. Nothing to reflowThe landing page was already a single column ofone thing after another, so the phone gets thesame page with a smaller hero. This is what themax-width 560 rule buys: on a phone the columnsimply becomes the viewport.Choose your levelbadges.simplex.chat/#/tierChoose your levelBigger files, and longer to collect them.Supporter$7 / mo2 GB files7 days storageLegend$70 / mo5 GB files21 days storageContinuesimplex.chat/contactM2. Two tiers still fit side by side169 px each at 390, and 134 at 320. Two things abuyer is comparing must stay comparable: stackingthem would put the second below the fold and turna comparison into a scroll. The badge art shrinks;nothing else changes.Continuebadges.simplex.chat/#/monthsHow long?Prepaid months. Nothing renews.1 month$703 months$140save 33%12 months$420save 50%Continuesimplex.chat/contactM3. Three durations still fit across110 px each at 390, 87 at 320. They are threevalues of one number, so they belong on one linewhere the prices can be read against each other;the saving pill sits under its price rather thanbeside it.Continuebadges.simplex.chat/?tier=legend&months=12&pay=xmrCheck your orderLevelLegendDuration12 monthsTotal$420.00PAY WITHBitcoinMoneroCardPay $420.00 with MoneroCard by Stripe. Bitcoin and Moneroon-chain, through BTCPay.simplex.chat/contactM4. The widest thing on the siteThe summary and the three ways to pay are thetightest fit in the document: 110 px per button at390 and 87 at 320, which still holds a 24 px markabove a 47 px word. This is the screen D2's 320 pxcheck is really about, and the reason the markscarry no text beside them.Pay with Monerobadges.simplex.chat/?order=8f3a...c21eSend 1.482 XMR$420.00 - rate held for 58:12MONERO ADDRESS48HqK2...9fRtWcCopyWaiting for the paymentREFERENCEK7M2Qsimplex.chat/contactM5. Here the columns have to stackThe QR and the payment details cannot sit side byside at this width, so they stack - and the QRgoes first, because a phone paying from a walletapp on the same device needs the address, while aphone being scanned by another device needs thecode. Both are one thumb apart.it confirmsbadges.simplex.chat/?order=8f3a...c21e✓Paid. Here is your code.SXB-9K2M4-7QRT1-XZ5WB-3NHD8Copy codescan to carry it to another deviceREDEEM IT IN THE APPSettings -> Supporter perks -> Redeem codeThe code is shown here only.This page works until 23 September, andstops the moment the code is redeemed.simplex.chat/contactM6. The code stays the heroEverything stacks, in the order it is needed: thecode, the button that copies it, the QR thatcarries it to another device, then where to putit. The warning stays last and stays red - it isthe only place the code is shown, and on a phoneit is the easiest to lose.Continue in browsertier, months and method as URL parametersthe code is pasted into A5the only thing that crosses from the site back to the appDesign document. The app and the site are each one tree read left to right, and the third band is the same site at phone width. In a tree: a screen is always to the left of everything it leads to, each lane is labelled for what its screens have in common, and the cause of a branch is written above the screen it produces, in the colour of the line that reaches it.App screens are drawn in the iOS idiom; Android and desktop differ only in chrome. The site is drawn in its own idiom - one centred column at max-width 560, accent #0053D0 from website/tailwind.config.js - and is deliberately not a copy of the app's. Badge artwork is the shipped art, verbatim from MR/images/badge_{supporter,legend}.svg, and the hero on A1 and B1 is phone-supporter.png from simplex-chat-art, the same asset PhoneSupporterHero draws on that screen today. D2 asks for the logo alone, and the tier cards carrying the badges are the one deliberate deviation. The Bitcoin and Monero marks are the official ones from simple-icons (CC0-1.0) in their registered brand colours; the card glyph is Lucide's credit-card (ISC).Built today: the service schema, the pricing catalog, the ledger, code derivation and classification, credential signing, the RPC dispatcher and the operator CLI. Design, not yet built: every screen above, the web listener and its endpoints, both payment providers, and the client redeem path. Store purchase is removed on iOS and Play for the duration of this plan. \ No newline at end of file