A donation ledger a church office can trust

My wife runs the office at our church, Renovación, and part of that job is keeping an accurate record of donations. The work was being done by hand across tools that were never meant for accounting — easy to fat-finger, hard to correct cleanly, and impossible to audit after the fact. I built a small, dependable web application to replace that: a bilingual donation ledger designed around accuracy, traceability, and the way the office actually works.

The challenge

Donation records have to be right, and they have to stay right. A number that looks close is not good enough when it feeds reporting and giving statements.

The office needed a few things at once:

• Fast, low-friction entry for everyday giving
• Reporting totals the team could trust without re-checking by hand
• A way to fix mistakes that leaves a clear trail instead of quietly overwriting history
• English and Spanish, because the congregation is bilingual
• Access limited to the right people, since this is sensitive financial data

What I built

A focused web app for entering donations, viewing totals, and producing reports. It leads with the everyday task — record a gift in a few seconds — and keeps the heavier reporting and administration a step behind it.

The interface is fully bilingual. Every screen reads naturally in English or Spanish, so whoever is at the desk works in the language they think in.

Keeping the numbers correct

The parts a recruiter can’t see on screen are the parts that matter most here.

• Money is stored as integer cents, never as floating-point decimals. That removes an entire class of rounding errors before they can happen.
• Reporting totals are computed, not typed. The app derives the figures the office reports on — including the ICFG extension tithe, calculated as ten percent of unrestricted giving (the total minus anything designated for a restricted purpose) — so the math is consistent every time.
• Nothing is silently deleted. Corrections and voids are recorded as traceable adjustments rather than destructive edits, so the ledger can always explain how it reached a number.
• Duplicate submissions are guarded. Idempotency keys keep an accidental double-submit from turning into a double entry.
• Every change is written to an audit trail — who did what, and when — so the record is reviewable long after the fact.

Roles and access

Not everyone who touches the app should be able to do everything. Access is role-based:

• Administrator — full management, including corrections and user access
• Entry — record and manage day-to-day donations
• Viewer — read reports and totals without changing anything

Identity is handled by Cloudflare Access in front of the application, tied to the church’s Google Workspace accounts, so there is no separate password to manage and only authorized people reach the app at all.

Architecture

The whole thing runs on Cloudflare, which keeps it fast, inexpensive, and simple to operate:

• React and TypeScript on the front end, styled with Tailwind CSS
• Cloudflare Workers serving the application at the edge
• Cloudflare D1 as the database, with Drizzle ORM giving the schema and queries type safety end to end
• Cloudflare Access + Google Workspace for authentication and authorization

The data model is deliberately small and clear: donors, donations, authorized users, and an audit log tie the system together.

Outcome

The office moved from hand-maintained records to a purpose-built ledger that is accurate by construction. Entry is quick, totals are trustworthy, corrections are honest, and access is controlled — and it is in production and in daily use at the church. (The application is access-controlled, so there is no public demo.)

Impact

Before — Donations were tracked by hand in general-purpose tools, where mistakes were easy to make and hard to correct or audit.

After — A role-based, bilingual application computes reporting totals, records every correction, and keeps a full audit trail, so the church office can rely on its own numbers.