Masjid Donation Manager

Masjid Donation Manager is a complete donation management system built specifically for masjids, surau, and Islamic charitable organizations in Malaysia. It supports multiple campaigns, two popular Malaysian payment gateways (ChipIn Asia and Bayarcash), and ships with a frontend dashboard so the masjid committee can manage everything without ever touching wp-admin.

The plugin is bilingual-friendly — the user-facing strings are in Bahasa Malaysia by default, and all strings pass through __() so they can be translated.

Key Features

• Multiple campaigns — create unlimited fundraising campaigns, each with its own image, description, target amount and schedule (ongoing, time-limited, or one-off).
• Two Malaysian payment gateways out of the box — ChipIn Asia and Bayarcash, both with sandbox and live modes.
• Frontend dashboard — a dedicated /masjid-admin/ page lets the masjid committee (administrator and the included “Bendahari Masjid” role) view donations, manage campaigns, send receipts and pull reports without learning wp-admin.
• Donor wall — automatic recognition wall showing recent donors (with option for anonymous donations).
• Live statistics bar — total collected and donor count update in real time.
• Elementor widget & Gutenberg block — drop a donation button into any page with full visual configuration (toggle stats, toggle donor wall, customize colors and button text).
• Shortcodes — [masjid_donation id="1"], [masjid_donor_wall id="1"], [masjid_donation_stats id="1"], [masjid_campaigns_list].
• Receipt emails — automatic, customizable HTML receipts on every successful payment.
• Custom reports — daily/weekly/monthly breakdowns, gateway-by-gateway and campaign-by-campaign comparisons.
• CSV export — export all donation data for accounting or audit.
• Webhook hardening — signature verification, replay-window protection and optional IP allowlisting for incoming gateway callbacks.
• PDPA / GDPR considerations — data-retention period configurable, donor anonymization tool, and external resources (Google Fonts) are opt-in only.

External services

This plugin relies on third-party services to process donations. Connection to a gateway only happens when a donor actually clicks “Pay” on the donation form — no data is sent at any other time, and no data is ever sent to the plugin author. By using this plugin you (and your donors) are accepting the terms and privacy policies of whichever gateway you enable.

ChipIn Asia (CHIP) — payment gateway

What it is: a Malaysian payment gateway by CHIP IN Sdn. Bhd. used to process FPX, e-wallet and card payments.

What is sent and when: when a donor initiates a donation through a campaign that uses ChipIn Asia, the plugin sends the donor’s name, email, phone number, donation amount, currency (MYR) and a unique reference (donation_id) to ChipIn’s API to create a payment session. The donor’s browser is then redirected to ChipIn to complete payment. After payment, ChipIn calls our webhook with the transaction status. No donor card / bank details ever touch your WordPress server.

API endpoint contacted: https://gate.chip-in.asia/api/v1/ (the same hostname is used for both sandbox and live; mode is selected per-account on ChipIn’s side).

• Service URL: https://www.chip-in.asia/
• Terms of service: https://chip-in.asia/terms-of-service
• Privacy policy: https://chip-in.asia/privacy-policy

Bayarcash — payment gateway

What it is: a Malaysian Shariah-compliant payment gateway by Web Impian Sdn. Bhd. used to process FPX, DuitNow QR and DuitNow Online Banking payments.

What is sent and when: when a donor initiates a donation through a campaign that uses Bayarcash, the plugin sends the donor’s name, email, phone number, donation amount, currency (MYR), a unique reference (donation_id / order_number) and a selected payment channel to Bayarcash’s API to create a payment intent. The donor’s browser is then redirected to Bayarcash to complete payment. After payment, Bayarcash calls our webhook (and POSTs to the return URL) with the transaction status. No donor card / bank details ever touch your WordPress server.

API endpoints contacted (depending on the “Mod” selected in Tetapan → Bayarcash):

• Live mode: https://console.bayar.cash/api/v2/ and https://api.console.bayar.cash/v3/
• Sandbox mode: https://console.bayarcash-sandbox.com/api/v2/ and https://api.console.bayarcash-sandbox.com/v3/

The sandbox URLs are only contacted when the merchant explicitly selects sandbox mode for testing; live installations never reach the sandbox hosts.

• Service URL: https://bayarcash.com/
• Terms of service: https://bayarcash.com/terms-conditions/
• Privacy policy: https://bayarcash.com/privacy-policy/

Google Fonts (optional, opt-in)

What it is: the Poppins font family hosted by Google Fonts, used for the donation button UI and the frontend dashboard.

What is sent and when: this connection is disabled by default. If — and only if — the masjid administrator enables “Muat Google Fonts” in Tetapan → Keselamatan → Privasi & Sumber Luar, the visitor’s browser will fetch the Poppins font family from fonts.googleapis.com on any page that displays the donation button, dashboard, or thank-you template. When disabled (the default), the plugin falls back to system fonts and no requests are ever made to Google.

• Service URL: https://fonts.google.com/
• Terms of service: https://policies.google.com/terms
• Privacy policy: https://policies.google.com/privacy

All donation records remain in your own WordPress database. No data is ever transmitted to the plugin author.

Privacy Policy

This plugin processes the following personal data of donors:

• Full name
• Email address
• Phone number (optional)
• Donation amount and currency
• IP address (for webhook security only — not stored against the donor record)
• Anonymous flag (if the donor opts to donate anonymously)

This data is:

• Stored in your WordPress database (tables wp_masjid_donations and wp_masjid_donation_logs).
• Transmitted to the payment gateway (ChipIn Asia or Bayarcash) only at the moment a donor proceeds to checkout, so the gateway can process the payment. See the External services section above for exactly what is sent to each gateway.
• Retained for a period configurable in the plugin’s data-retention setting. After this period, donor identifying fields are anonymized.

Donors may request anonymization or deletion of their record at any time. The frontend dashboard includes a one-click anonymization tool for the masjid administrator.

This plugin does not send any data to the plugin author or to any third party other than the payment gateway the donor actually transacts with.