Three kinds of gift card

A gift card gets spent in one of three ways. Each needs different machinery, and each is at a different stage.

Kind	Everyday name	How the value is spent	Stores	Today
In store	Brick and mortar	A cashier scans a barcode on the buyer's phone	Best Buy, Nike, Target, Walmart	🔵 Built, never at a real register
Online	E-commerce	We fill the card into the store's own checkout	Best Buy, Nike	🔵 Built, never on a live checkout
Account credit	Account balance	The card is loaded into the buyer's own account	Netflix, Apple (iTunes), Starbucks	🟡 Designed, no code

The three states are the ones defined on the home page: designed, built, proven. None of the three kinds is proven.

At a glance

In store, which is the one the app offers:

1. SellerAdds a card they will not spend, then forgets it
2. ShopperAbout to spend at that store, is charged less than that amount
3. SalvoChecks the card, then shows its barcode for 90 seconds
4. CashierScans it like any gift card
5. SalvoChecks what happened: the sale counts, or the shopper is refunded

"Checks the card" means reading the balance at Best Buy and Nike, and using the seller's stated value at Target and Walmart. The shopper's own card is held at the one tap, gift card by gift card, and each hold is charged only for what worked, on a Stripe test key.

Nothing is bought until a shopper exists, so the design needs no stock. Today every listed card is recorded as the operator's own, so a bad card is still the operator's loss. That includes any card a stranger types into the public sell screen, which is an open decision. Which steps touch Stripe, and why Stripe has to approve this before real money moves, is on Where the money goes.

The obvious questions

What stops the seller spending the card after it sells?

Nothing physical: a gift card cannot be locked. So we try to catch it instead. The seller cannot cancel once the card has sold. At Best Buy and Nike the balance is read just before the barcode appears, and a card holding less than the shopper paid is refused and the shopper is not charged. A card the seller spent only partly can still be shown.

If the balance is lower when the shopper answers than when the barcode opened, and the shopper says it failed, the hold stays for 48 hours and is then cancelled, so the shopper is not charged. Nothing lets the seller argue their side yet. At Target and Walmart we do not read a balance, so the shopper's "it didn't work" keeps their hold until the next shopper's try decides it (below). See Dual claim.

What if the card is empty, or less than the seller said?

At Best Buy and Nike, a card holding less than the shopper paid is refused before the barcode shows, and the shopper is not charged. A card holding less than the seller said, but at least what the shopper paid, is still shown; the shopper then gets less than promised and is not refunded the gap. At Target and Walmart we go on the seller's figure, so the shopper finds out at the till and taps "No". Their hold is kept, and the card goes to the next shopper first: see What if the barcode won't scan?.

What if the card is stolen?

There is no stolen-card check and no seller identity check. What protects the shopper is that their card is only held when the barcode opens, and only charged once the gift card worked. Today every listing is recorded as the operator's, whoever typed it in, and no seller is paid at all.

Won't the store void a resold card?

It can. A store may void a card it believes was resold or stolen. If that happens before the barcode is shown, the balance check should catch it at Best Buy and Nike, and the shopper is not charged. At Target and Walmart the shopper taps "No", and the next shopper's try decides it, as below. How a voided card looks on a store's balance page has never been seen.

What if the barcode won't scan?

Target's eGift barcode is a PDF417, the dense square kind, and we draw it from the number printed under it. For the other stores the page offers up to three formats a scanner might read, two on screen at a time. None has been checked at a real register yet. The shopper can reopen it twice more. If nothing scans at Best Buy or Nike, the balance does not move and the shopper is not charged. The number is never shown as text, so a cashier cannot type it in.

At Target and Walmart nobody can read the balance, so the shopper's word is all there is. Taking it alone made "it didn't scan" a free card: the number had been on their screen. So:

• The shopper says why: it did not scan, or the card was declined.
• Their hold is kept, and the same card goes to the next shopper first. Never back to the same shopper: not to their card customer, and not to the same card under a new one. If a part-used card was the one, its deposit is kept with the hold.
• The next shopper's scan works: the first shopper told the truth, and their hold and any deposit are released.
• The next shopper says No too, whatever the reason: the card was empty for them, so the first shopper's hold is taken at the normal price, with any deposit behind it. The next shopper is refunded from their own hold, the card is retired, and a person is told, who can undo it if the barcode itself is bad. A false "it didn't scan" gains nothing.
• Every No counts against the shopper who gave it. Two in 30 days, with remainder reports, and they get nothing waiting first in line.
• Nobody comes in time: the hold is released a day before the bank would drop it. A kept hold lasts a week at most. The card stays first in line, still marked, and the next shopper who says No on it is refunded: nobody else pays for a card that may have been spent.
• The till said not to scan it (the total came down past what can stay on it): on a card someone else stands behind, only this shopper's hold goes back, and the card waits, as it was, for a real scan.
• No answer at all: 20 minutes after the code closes, it counts as used. The shopper can still report a problem for 48 hours after.

How does the seller get paid, and when?

The plan is cash when the card is used, or the seller keeps it and spends it themselves, whichever comes first. Today nobody is paid: a sale only changes a status.

How does the shopper get their money back?

They never paid it. The shopper saves a card once, on Stripe's page. Nothing is charged when they type the total. When they tap Pay at the till, each gift card's price is held on their card, with a deposit for what the last card leaves, and each hold is charged only once its gift card worked. The deposit is released when the next shopper uses the rest. Every failure cancels the hold instead. Some cases wait: a dispute waits 48 hours, a case we cannot decide at Best Buy or Nike waits 24 hours, and a hold kept at Target or Walmart after a "No" waits for the next shopper, a week at most. A sweep checks every 15 minutes, and also cancels any hold close to lapsing on its own.

Do you store my bank card?

No, Stripe does. A browser signed in to the shopper's account with Face ID, or the one that saved the card, keeps a signed cookie naming the shopper's Stripe customer, and only those can open a code. We show the card's brand and last four digits, nothing more.

Signing in never moves a card to an account. A card saved in a browser before the account stays that browser's; it joins the account only when its holder saves it under the account, typing it once more. Signing out of a browser takes the account's card off it too.

Do you store my card number?

Yes, the number and the PIN, encrypted. Each card has its own key, and one master key locks all of those keys. Only the last four digits are stored readable. The operator holds that master key, which is only acceptable while the operator is the only seller. See Custody.

Why is it cheaper than a gift card exchange?

Exchanges are said to charge 20% or more, because they buy cards up front and hold them. We have no quote or source for that figure yet. We skip buying and holding by matching only when a shopper exists. That does not avoid fraud entirely: at Target and Walmart a shopper who falsely taps "No" is refunded and the seller, today the operator, takes the loss. The saving has not been measured against a real competing quote.

---

The rest of this page goes kind by kind.

In store (brick and mortar)

How it works.

1. A seller adds a card on /sell. It is sealed in the vault, and only the last four digits are stored in the clear.
2. A shopper saves their own card once, on Stripe's page.
3. A shopper about to spend at that store types the amount and is matched to one card, or two: all of one and part of the next. Nothing is charged yet.
4. At the till, the shopper opens the card's barcode. That is when the price is held on their card. It stays live for 90 seconds and opens at most three times. The cashier scans it like any other gift card.
5. Settlement reads what happened. It worked: the hold is charged. It did not: the hold is cancelled. See Settlement.

There is no checkout to drive. The in-store adapter refuses checkout automation outright, though nothing constructs it yet. See Form factors.

Which stores. Best Buy and Nike publish a balance page with no login, and we built a reader for each, so a sale there is designed to settle on the balance change: a fact. Neither reader has read a real card yet, and the part of Nike's page that shows the result is a guess.

Target and Walmart have no page we can read. Target probably needs a login, and Walmart blocks datacenter traffic. Their cards are still accepted. The reveal relies on the value the seller entered, and settlement relies on what the buyer says. A holdback figure is computed but not enforced, because nothing pays a seller yet. The seller is told this on the screen where they pick the store.

Toast, Square and Clover have no barcode profile, so their cards cannot be listed.

What keeps it safe.

• The balance is read before the barcode is shown, and again on every re-open. For Best Buy and Nike, a failed read or a short balance refuses the reveal.
• A card is only revealed if its balance is at most $10 more than the buyer paid, or $5 where we cannot read the balance. So little is left on the card for anyone to spend after the buyer. Full drain, which protects online sales, mostly does not work in a shop.
• The seller cannot cancel once the card has sold.
• A store with no declared barcode format is refused, not guessed at. A wrong format does not error; the scanner just stays silent.

What is still risky.

• A falling balance cannot tell the buyer's spend from the seller's own. See Dual claim.
• For Target and Walmart there is no balance to check. The reveal relies on what the seller entered, and settlement on what the buyer says.
• The background balance sweep cannot read any balance in production yet. It reports every Best Buy and Nike card as unknown and available, and skips Target and Walmart. A card the seller drained stays listed until someone tries to use it. For Best Buy and Nike the check at reveal catches it; for Target and Walmart nothing does.
• Money moves only on a Stripe test key, and a live key is refused. The hold flow is tested against a stand-in for Stripe and has never run against Stripe itself. Stripe has to approve gift card resale before it can take real money. See Where the money goes.

Status. 🔵 Built and tested with sample cards. No barcode has been scanned at a real register. Target's PDF417 format comes from a real Target eGift, and our drawing reads back exactly in a separate decoder. The Code 128 the other stores declare has never been checked against a real scanner.

For test dollars (Salvo Pay)

The crypto rail. The same stores, the same till and the same barcode, but the shopper pays from their own account into an escrow contract, and the card lives on their phone. Test dollars only, on Tempo's test network.

How it works (the new escrow, SalvoEscrowV2, since phase 3b).

1. Once, on Account: the shopper signs in with Face ID and allows a weekly allowance, up to $200, that can only pay into the escrow.
2. A seller types the card into the Salvo Pay branch of /sell. Their own browser seals it, so our server never sees it.
3. At the till the shopper types the total on the register. Our server plans which cards cover it; the phone checks every one against the chain before it shows a price, and fetches what the tap needs while the total stays as typed.
4. One tap, no prompt: one transaction pays the escrow for the value used of each card, plus a deposit at face on what is left on the last one, and opens every card. Then "Scan 1 of 2", drawn on the phone, and card 2 after Next. The deposit comes back when the next shopper's use of the rest holds up.
5. The rest of the last card goes on sale to the next shopper once this shopper taps Done (or "Register says paid") on it: their phone proves it is them with the key that opened the card. If they never do, it rests two hours after the sale, since until then the card may still be on their screen, unscanned.

Cards a phone bought whole on the first escrow (the Load screen, before the till paid in dollars) are under Account, with their codes.

How do I get my money back? Once a card has opened, only the seller can give money back, in part or in full. A shown number cannot be taken back, so there is no automatic refund. If a card does not work, the shopper can dispute it on chain: that holds the seller's payout 48 hours longer and counts against the seller in public. The screens do not offer dispute or refund yet; that is a later phase. Before the tap, nothing is charged: a card that fails its check costs nothing. If a card sells to someone else in the moment after the tap, no card is bought, and at most the network fee, under a cent, is charged.

What if it won't scan? It depends on whether the card was checked. Every card sold in this version is unchecked: nobody could read its balance before the sale, and its seller still knows the number. So if it won't scan, the card may be spent. Only the seller can refund it, and only until they are paid, a day after the Load. The screens do not offer a way to ask yet. A checked card (a later phase, at stores whose balance Lit can read) had its balance read just before you paid, so it still holds its value. What you do not spend stays on the card. In this version the code on the phone's screen is the only way to show it; the Wallet pass is a later phase.

What if the card does not come back after I pay? The phone keeps the purchase. At the till, tap Pay again: it finds the purchase by its tap and finishes it, never paying twice. For a card bought on the first escrow, tap Finish it on Account. It still works after the seller is paid: a sale that has paid out still opens for the phone that bought it.

How does the seller get paid? The escrow pays the seller's own address 24 hours after the Load, or 72 hours if the shopper disputes. Anyone can trigger the payout, so it does not depend on us: the seller can tap Get paid on the sell page once it is due, disputed or not. If the token will not send a payout to the seller's address, the escrow keeps it as owed, and the seller taps Claim to have it sent again. Salvo takes no fee in this version.

Status. 🔵 Built. On 2026-10-10 the first escrow was deployed on Tempo's test network and on 2026-10-13 the second, each with its live smoke passed on Lit, with a fake card. The till's dollars rail, on the second, is built and tested offline only, never from a phone. Never used at a register. Off unless ESCROW_RAIL=testnet. It is not reviewed. On the testnet our server takes a listing as the operator's own card, for a Salvo test card or a Target card, and anyone with test dollars can buy it, so list only your own card. The Wallet pass is a later phase.

Online (e-commerce)

How it works. A buyer's order can be spread over up to five cards. Every card but one is used up completely, and that one may keep up to $10. We open the store's checkout, enter the card, and check that the store shows it as applied. No applied amount is read or recorded yet. If anything fails, the buyer is refunded.

Which stores. Best Buy and Nike have checkout adapters. Toast and Square have adapters whose checkout step is not built. Home Depot, Lowe's, Target, Walmart and several others were screened and set aside.

What keeps it safe. Full drain: a card used up in one checkout cannot be spent twice. Live checkouts are switched off by default for each store, because a wrong field on a real page can burn a real card.

What is still risky. Best Buy's checkout steps are medium-confidence guesses from saved pages. Nike's checkout has never been captured, so its test page is synthetic.

Gaps found in this pass

The online path cannot redeem a card yet. It unseals the card but never hands it to the store adapter, so the adapter stops with "no card material" and the buyer is refunded. The race check on the same path passes for the same reason.

Nothing in the app starts an online redemption. Only an operator script does, and it is a dry run unless confirmed. That script does not check the form factor, so pointed at an in-store card it would drive the online adapter. Today only the missing card material stops it.

Status. 🔵 Built and tested against rebuilt checkout pages: Best Buy's from saved pages, Nike's synthetic. Never run on a live checkout, and not offered in the app.

Account credit (account balance)

How it would work. Some brands never take a gift card at checkout. The card goes into your account balance instead, which is why nobody can resell them. So the plan flips the direction: you set a standing order, such as "pay my Netflix from gift cards whenever the discount clears 8%", and we buy a card and apply it to your account. The closest roadmap item is subscription standing orders.

Why it is hard. Our safety model checks a card's balance just before it is used and again after. An early screen found Apple allows neither, and loading a card into an Apple account cannot be undone, so a bad card could not be caught first or recovered after. Starbucks showed no place to enter a card. Netflix has not been screened.

Status. 🟡 Designed, in one paragraph of the overview. No code: no form factor, adapter or store profile exists.

Not the same as account_bound

In the code, the form factor account_bound means value that already sits inside an account and is spent at checkout. That is Cinemark's Movie Club credits. Account credit here is the reverse: a gift card loaded into the buyer's own account.