Volunt-App

OVERVIEW

Voluntapp is the Android app Banco de Alimentos de Guadalajara (BAMX) staff use to run their volunteer programme: keep volunteer records, schedule activities and fill their places, record who came and for how long, and close each activity with hours that count. Three staff roles — administration, coordination and supervision — each see only what they may do. Built by a team of four at Tec de Monterrey with BAMX as partner, in a course where security is graded.

WHAT I FOUND → WHAT I DECIDED

• After feedback from BAMX, its staff became the users and volunteers became records with no login→Rebuild v1's volunteer app as a staff app on the same Expo, Express and MongoDB stack, keeping v1 under a git tag
• On MongoDB, reading free places and then inserting doesn't stop two coordinators filling the last place at once→A counter on the activity with a conditional increment, and a lock stamped on the volunteer, inside one transaction
• Hours decided while someone is still unrecorded would be official and wrong→Finalising is refused until everyone assigned has a record, then closes the activity; only an admin can correct it, with a reason
• A native app has no browser cookies to keep the session token away from scripts→The token lives in SecureStore, encrypted by the Android Keystore; the server keeps only its SHA-256 hash

WHAT IT DOES

ROLES

Admin, coordinator and supervisor, checked on the server on every request; the app only hides what a role can't do.

VOLUNTEERS

Records with search, status filters and emergency contacts, deactivated instead of deleted, with hours derived from finalised attendance.

ACTIVITIES

Draft, publish, close or cancel activities with a capacity, a place and an optional supervisor.

ASSIGN

Fill places without overbooking and without putting one volunteer in two activities at the same time.

ATTENDANCE

Present, late or absent with times and hours, one tap to mark everyone present, then finalise.

AUDIT

Every create, edit and status change writes an insert-only audit entry, with no personal data in the logs.

HOW IT WAS BUILT

Built as a thin working slice first — staff signing in on Android and seeing one real screen backed by Atlas — then one feature at a time, each with a written spec approved by the team before any code. Every feature was verified with API checks against Atlas, including parallel requests for the capacity and overlap rules, and then walked on the Android emulator as each role. Dashboard, reports with CSV export, and staff management come next.