Gravity Forms
+ Child Pickup Authorisation & Log

At the end of the day, staff at an after-school club, a holiday camp, a nursery or a sports club have to answer the same question again and again: may this adult take this child home? Paper lists in a folder are hard to keep up to date, easy to read over someone's shoulder, and leave no record of who collected whom. The Gravity Forms Child Pickup Authorisation & Log add-on turns a Gravity Forms form into the pickup list and gives staff a simple screen to check and log every pickup.

Parents use your registration form to add the adults who may collect their child: name, relationship, phone, a photo, the last 4 characters of their photo ID, optional valid-from and valid-until dates and a one-time option for a single pickup. They choose a family PIN, which is stored only as a hash and never shown or e-mailed. Later they update the list themselves through a signed link or their account, and every change is recorded.

At pickup, staff open the pickup screen on a tablet or phone, find the child, compare the adult with the photos and confirm with the PIN or the ID characters. The pickup is logged with the time, the adult and the staff member, and the parent can get an e-mail. If the adult is not on the list, a red do not release warning appears, the attempt is logged and the parent can be alerted at once. Expired, not-yet-valid and used one-time authorisations are refused, and repeated wrong codes pause the check. A Today view lists who is collected and who is still waiting, with a closing-time warning, and the daily report downloads as CSV. Photos are encrypted in a protected folder, child data never appears in links or public pages, and a retention setting cleans up old records. Everything runs on your own site. Your organisation follows its own childcare licensing rules and policies; the add-on is a tool to support them.

When a registration form with pickup switched on is submitted, the add-on creates a child record in its own tables with the mapped child and parent details, one row per authorised adult and the photos. The PIN and the ID characters are hashed with PHP's password_hash and only the hashes are kept; the Gravity Forms entry receives a short summary (names and relationships) and never the PIN, the ID characters or the photos, not even in a saved draft. Photos are checked, re-encoded as a JPEG of at most 640 pixels, which drops camera metadata such as the location, encrypted with AES-256-GCM using a key kept in your database and saved under a random name in a private uploads folder with Apache and IIS deny rules. Staff see them through an authenticated request only.

The pickup screen talks to your site with POST requests protected by a nonce and a capability check, so names never appear in a web address. A pickup is released only when the adult is on the list, is valid today (dates, one-time use) and the PIN or ID characters match; a one-time authorisation is marked used in the same database step. Wrong codes are counted per child and pause the check for the minutes you set. Parent e-mails use Gravity Forms notifications with two new events, child collected and pickup refused, and merge tags for the child, adult, time, staff member and reason. Parent links carry only an opaque signed token with an expiry; staff can send a new link, which cancels the older ones. A daily clean-up anonymises or deletes old log rows, archived children and ended authorisations after the number of days you choose. The add-on makes no outside HTTP request beyond the licence and update checks.