Children's check-in

Sunday-morning kids check-in — rooms, workers, two-secret pickup, and an auditable record of every alert raised at the point of contact.

Children's check-in lives next to Event check-in in the admin sidebar but is a different surface: event check-in is a member self-service QR for any gathering, while children's check-in is a worker-led flow purpose-built for the safety of minors. A church may use one, the other, or both.

What the feature gives you

Rooms for the age groups you serve (nursery, 2–3s, 4–5s, K–2, etc.) with capacity and age-range guidance shown to workers at check-in time.
A worker rota per room per service date — admin schedules who's on, and the system surfaces the rota in the live check-in view.
A two-secret pickup code generated at check-in: half goes on the child's name label, half on the guardian's receipt. Both halves must match before a child can leave a room. Codes are 4 characters, uppercase, and skip ambiguous glyphs (no I/O/1/0) so they read cleanly off a printed label.
Alert capture at check-in — any allergy, medical note, or pickup restriction recorded on the child's household profile shows up in large type to the worker, who must acknowledge it before the check-in is recorded. The acknowledgment is logged for after-the-fact review.
A safety log of every alert raised, with the worker who acknowledged it and when. This is the record a pastor or insurance reviewer asks for after an incident.

Who can do what

The platform's standard four-role model applies. The child-safety guarantees live at pickup (two-secret codes + authorized-pickup overrides), not in a screening gate:

Admins / owners manage rooms, schedule workers, and can do anything a worker can (including the rare admin-override pickup — see "What if a guardian isn't on the authorized pickup list?").
Workers assigned to a room on a given service date can check children into and out of that room. Screening is advisory, not a gate — a worker does not need a volunteer_screening row to be scheduled or to run check-in. Admins vet their own people; Psalmly can't run background checks, so it doesn't pretend to enforce one. (Screening records are still useful context — see "Screening" below.)
Guardians (adult members of a household) can see their own household's children's check-in records — useful for confirming a child was picked up, or pulling up the guardian-half code on a phone at pickup time.
Other members cannot see check-in records for households other than their own.

A scheduled worker can always run check-in for their room. If someone isn't appearing where you expect, confirm they have an active church membership and are assigned to that room on that date.

How does the pickup secret work?

When a child is checked in, the system generates two random 4-character codes:

The child code prints on the name label that goes on the child.
The guardian code prints on (or appears on screen for) the receipt the guardian keeps.

At pickup, the worker enters the guardian code (or scans the guardian's mobile receipt screen). The system confirms both halves belong to the same active check-in record before letting the child leave the room. Two simultaneous check-ins in the same room on the same date can never collide on either half — the unique index per room+date+code guarantees it; if a collision is ever sampled the mutation retries automatically.

The receipt screen also lists any pickup restrictions on the child's household profile (for example, "Do not release to anyone other than <name>"). A guardian who isn't on the authorized list will not be able to pick the child up without an admin override.

What if a guardian isn't on the authorized pickup list?

Pickup-restriction overrides are an admin-only action. When a worker enters a correct code but the guardian collecting the child isn't on the household's authorized pickup list, the worker sees an inline error and an "Admin override" button. Tapping it requires an admin to confirm; the override is recorded against the check-in with the admin's identity and the guardian's name in the safety log.

This isn't friction for friction's sake — it's the workflow that lets a pastor say, two months later, "yes, the override was approved by <name>, here it is in the log."

Data scope and privacy

Allergy, medical, and authorized-pickup data are part of the household minor-class privacy tier (see community.md): visible to admins and to adult members of the child's own household, and never to other church members or to the church-wide directory.

The check-in flow captures a snapshot of these alerts at the moment of check-in (the alerts_at_check_in column). If a parent edits the underlying household profile later that day, the worker on shift still sees what was on file when the child was dropped off. The household profile remains the source of truth for the next check-in.

How do I set up rooms?

Admin sidebar → Check-in → Rooms. Click New room to open the create sheet.

Every room has a name (required — kept short and descriptive, e.g. "Nursery", "2–3 year-olds", "K–2") and three optional fields:

Description — what workers see at check-in time. Use it for things like "Quiet room — for shy preschoolers" or special instructions.
Capacity — a soft cap on simultaneous check-ins. The live check-in view shows a "X of Y" indicator using this number; it doesn't block check-ins above the cap, it just warns.
Min age / Max age — the recommended age range, in years (0 is fine for nursery). When a guardian uses the kiosk, the kiosk recommends the room whose age range matches the child's age.

Rooms are soft-deleted, never permanently removed — because past check-in records are tied to them, a room always stays on record for audit. The rooms list has two tabs: Active (the default) and Trash (with a count). Move a room to trash from the row's menu — it disappears from the Active list and from check-in, but its worker schedules and past check-in records stay in place. Switch to the Trash tab to see trashed rooms; the row menu there offers Restore.

How do I schedule workers?

Admin sidebar → Check-in → Schedule. The page shows a grid of rooms (rows) × the next several Sundays (columns). Each cell holds the workers assigned to that room on that date.

Click the Assign… popover in a cell, pick a role (Lead, Helper, or Pickup-only), search by name, and select anyone. The assignment is recorded immediately.

A few things to know:

Every member can be assigned. A subtle Screened badge marks anyone with a current screening on file, but it's informational only — you decide who serves. (See "Screening" below for what the badge means.)
Removing a worker is the X button that appears on a worker chip on hover. This is a hard delete (the assignment is the meaningful audit unit; the assign/unassign pair is recorded in the audit log).

Each room also has its own detail page (Rooms → click a row) with a single-room schedule view of the next eight Sundays — handy when you're filling a single room's rota.

Screening

Screening is optional, advisory record-keeping — not a gate. Under People → <name> → Screening you can record any background check, reference, or child-safety training you keep on file, with a status and expiry. When a person has a current (cleared, non-expired) record, the Schedule picker shows a small Screened badge next to their name. That's the only place it surfaces.

Psalmly does not perform background checks, and it never blocks a worker from being scheduled or from checking children in. The safety guarantees that are enforced are the two-secret pickup and the authorized-pickup restriction (below).

If a volunteer you expect isn't in the picker, it isn't screening — confirm they have an active church membership (admins see this in the People list).

How do I run a Sunday morning?

The Today view (Check-in → Today, the check-in landing page) is the worker's surface during a service. It shows every room as a card with:

Headcount and capacity — turns red over capacity (still allows check-ins; the cap is a guidance signal).
Worker count — flags rooms with no scheduled workers so the pastor knows where the rota has gaps.
A list of children currently checked in, with their child claim code visible and a warning icon if their record carries any alerts.

To check a child in:

Tap Check in on the child's room card.
Search by family name, parent name, or child name — the picker filters as you type and surfaces an "Alerts" pill on any child with allergy / medical / pickup-restriction data on file.
Tap the child. You'll land on the Alerts step.
Acknowledge every alert — the Check in button stays disabled until you do. Each acknowledgement is recorded in the safety log with your identity and timestamp.
Submit. The label preview opens with the child's name, room name, any allergy chips, and the 4-character child claim code in large type. Tap Print label to send it to the browser print dialog — the printout includes the same code in 36pt monospace ready to peel and stick.
Hand the guardian their receipt. The guardian claim code sits right next to the child label on the same screen — show it to the guardian on the iPad, or have them note it down. Both halves must match at pickup before the child can leave.

The Today view refreshes after each check-in so the room headcount stays accurate. Switching dates (?date=YYYY-MM-DD in the URL) lets you look at a past Sunday for review.

How do I run a self-service kiosk?

A church can put a tablet in the lobby so guardians check their own kids in. The kiosk runs the same flow, but designed for tablet ergonomics — big tap targets, age-matched room defaults, 80pt claim codes on the receipt screen — and doesn't require the tablet to be signed in as any user. Authentication is a device token instead.

Pairing a tablet (one-time)

Admin sidebar → Check-in → Today, then tap Kiosk (top right) → New kiosk device.
Give the tablet a label ("Lobby tablet", "Kids hallway tablet"…).
Pick a mode — Check-in, Pickup, or Both. A Pickup or Both kiosk lets a guardian enter their pickup code to release a child. You can switch a device's mode any time.
Click Create token. The plaintext token is shown once — copy it now. We only store its sha256 hash, so there is no way to recover it later. The dialog also shows a QR that opens the kiosk app on the tablet (it encodes only the kiosk deep link, never the token).
On the tablet, scan that QR with the tablet's camera to open the Psalmly app's pairing screen (or open the app and navigate to /c/<your-slug>/kiosk). Paste the token into the pairing screen and tap Pair kiosk.

The tablet remembers the token in local storage until it's revoked or the app data is cleared. If the tablet is moved, lost, or shared, open Check-in → Today → Kiosk, find the row, and tap Revoke. The tablet disconnects on its next request (≤ 60 sec).

Guardian flow at the kiosk

Big welcome splash. Guardian taps Check in.
Searches and picks their child from the household list.
Sees the same alert banner the worker sees and acknowledges each one before they can submit.
Sees an 80pt claim-code screen — child code on top, guardian code with "Save this for pickup" below. After 10 seconds the kiosk auto-returns to the splash so the next family doesn't see the previous code.

The kiosk takes the snapshot of the alerts at submit time, just like the worker flow, so a guardian who later edits their child's profile doesn't change what the room workers saw.

How does pickup work?

Every check-in produces TWO halves of a claim code. The child code goes on the name label that travels with the child; the guardian code goes on the receipt the guardian keeps (printed, or shown on their phone via the Pickup codes card that appears on the church Home in the mobile app while their household has a child checked in). Pickup requires the guardian code to match the active check-in for that specific child.

Worker pickup (web)

From the Today view, find the child in their room's active list and tap Pickup. The pickup sheet opens:

Enter the guardian-half code from the receipt. Codes are uppercased + whitespace-trimmed on both client and server, so a paste with leading spaces still works.
Pick which adult is collecting — the picker is scoped to the child's household's adults (no church-wide list; we don't want to accidentally hand a child to anyone outside their household).
(Optional) Notes — useful for "Sibling waiting outside" type context, recorded on the check-in row.
Tap Confirm pickup. If the code matches and (if applicable) the guardian is on the authorized list, the child is checked out immediately and the Today view's headcount updates.

Authorized-pickup restrictions

A household can list specific adults on a child's Authorized pickup field (under You → Household members in the mobile member portal). When that list is non-empty, only those names can collect the child without admin involvement.

If a worker confirms pickup with an adult not on the authorized list, the sheet shows the restriction message and an Admin override button. Tapping it requires the caller to be a church admin (the database enforces this; the button just opens the path). The override writes a permanent audit-log row into the safety log naming the admin, the guardian who was approved, and any notes — exactly what an after-the-fact review or insurance audit needs.

Kiosk pickup mode

A kiosk device can be toggled to Pickup mode (admin → Check-in → Today → Kiosk → New kiosk device → mode "Pickup"). In that mode the splash CTA reads "Pick up", and the flow is:

Guardian taps the splash.
Types the 4-character guardian code from their phone or printout into a large monospace input.
The kiosk looks the code up; if it matches an active check-in, shows the child's name, the room, and the household's adults.
Guardian taps themselves and confirms. The child is checked out; the kiosk briefly shows "<Child> has been signed out" and returns to the splash for the next family.

The kiosk does not carry the admin-override path — if the code matches but the chosen guardian is restricted, the kiosk surfaces "Please ask a church admin" and the flow stops. Overrides happen at the worker web flow only.

Guardian "Pickup codes" screen (mobile)

While a child in the guardian's household is checked in, a Pickup codes card appears on that church's Home in the member app — tapping it opens the pickup-codes screen (/c/<your-church>/kids-receipts). The card is contextual: it shows only when there's an active check-in, and disappears once everyone is picked up. The screen lists every child currently checked into a kids room with their guardian-half code in 80pt monospace, so a worker can read it straight off the phone screen at pickup.

How do I review what happened last Sunday?

Three surfaces share the load:

Open the admin home. The Children section near the bottom shows three live KPIs at a glance:

Checked in now — children currently in a kids room across the church, with the count of rooms in use. Tap to jump to Today.
This Sunday — total check-ins for the most recent Sunday with a trend arrow against last Sunday. Tap to open the full report.
Open alerts — alert acknowledgements from the last 7 days that haven't been signed off. The tile is green when this is zero; yellow when there's follow-up to do. Tap to open the safety log (Reports → Safety log).

Attendance report

Admin → Check-in → Reports. Pick a date range — the page defaults to the most recent Sunday. The table lists one row per (date, room) showing checked in, picked up, and still active counts. The footer shows the total for the window.

Export CSV downloads the same table as kids-attendance_<from>_<to>.csv — ready to drop into a spreadsheet or pass to your accountant / pastor. The CSV columns match the table 1:1.

Safety log

Admin → Check-in → Reports, then the Safety log tab. Every alert ever raised at check-in or pickup, with the alert type, the child, the room, the acknowledger (when known), the timestamp, and whether it's still open.

Filter by date range and by alert type (allergy, medical, pickup restriction). The most useful slice is usually last 7 days × pickup restriction — that's what surfaces every admin override and lets a pastor verify they were warranted.

An open alert older than a few days is a process gap. Follow up with the worker who was on shift; the audit trail records who they were on the underlying check-in.