Donations Website

Fundraising campaigns under spiky traffic

Design a fundraising site where campaigns show a live total, donors pay by card through a processor, and a televised drive can bring twenty times the normal traffic without double charges or lost donations.

Overview

A donations website lets a charity create a campaign (a title, a story, a goal and an end time) and lets anyone give money to it by card. The campaign page shows a progress bar: how much has been raised against the goal, and how many people gave. Most days the traffic is gentle. Then a charity runs a drive: a televised or streamed event, a few hours long, where a presenter asks viewers to give now. Every appeal sends a wave of people to the same page in the same minute.

The hard parts are not the forms. The site never sees card numbers: donors type them into fields hosted by a payment processor (a company such as Stripe that talks to the card networks), and the processor tells us later, by webhook, whether the payment succeeded. Between those two moments things go wrong: donors double-click, browsers retry, the processor throttles us at the peak, and webhooks arrive twice or out of order. Meanwhile the campaign total is one number that every donation wants to update. This page builds on the Payment System topic (idempotency, ledgers, reconciliation) and focuses on what a donations site adds: the spike, the hot counter and the checkout boundary.

Questions to ask first

Who uses it? — Charities create campaigns; donors give, mostly as guests without an account
Volume? — 500,000 donations a day normally; a 6-hour drive brings 3 million donations to one campaign
How spiky is the drive? — After an on-air appeal, 20 times the drive's average for about 10 minutes
Payment methods? — Cards, through one processor's hosted checkout; US dollars only
Do we hold the money? — No: the processor collects; we record donations and show totals
How live is the total? — Within a few seconds on the page; exact in reports and receipts
Leaderboard? — Top donors per campaign, by display name or 'Anonymous'

What you will be able to do

Take card donations without card data ever reaching your servers, and say why that shrinks PCI scope.
Make a donation safe to submit twice and a webhook safe to receive twice.
Keep a campaign total correct under thousands of writes a second with sharded counters, and explain approximate versus exact.
Absorb a drive's spike when the processor caps your request rate.
Handle refunds, chargebacks, receipts, a top-donors board and card testing.

Key concepts

Hosted checkout
PCI scope reduction
Idempotency keys
Webhook confirmation
Donation state machine
Sharded counters
Approximate vs exact totals
Admission control
CDN caching
Card testing

Functional requirements

Charities create a campaign with a goal, a start and an end time
Donors give any amount above a minimum by card, as a guest or signed in
The campaign page shows the amount raised, the donor count and the goal
A donor receives an emailed receipt once the payment succeeds
Charities can refund a donation; chargebacks reduce the total
Each campaign shows a leaderboard of its top donors

Non-functional requirements

A donor is never charged twice for one submission
No succeeded payment is lost from the records, even if the donor closes the tab
Campaign pages load in under 1 second at p95 during a drive (a target we chose)
The live total usually lags the exact total by a few seconds and never by more than about 20 (a target we chose: a 2-second edge cache, up to 10 seconds of stale-while-revalidate, a 5-second poll)
Card numbers never touch our servers
The site stays up when the processor throttles: donors wait, they are not rejected

Interview questions

How do you make sure a donor is never charged twice?
Why not just UPDATE the campaign's total for each donation?
Is the total on the page exact?
The processor limits you to a fixed rate. What happens at the peak?
How do you keep card data out of your system?
How do you handle webhooks safely?
How would you stop card testing on a donation form?
What changes when a donation is refunded or disputed?
How does the design grow from one server to a national drive?