A regional wildlife park moved 22,000 members from plastic cards to iPhone Wallet passes

Representative examplesEvery case study in this library is an illustrative composite of the kind of engagement we deliver — written to show our method and standards, not to name clients.

Where they started

A regional wildlife park and zoo runs on seasonal attendance: a membership base renewed mostly in spring, three gated entries, and a ticketing platform the operations team administers but does not control. Membership cards were plastic, printed by a local vendor, and every renewal push went out through the ticketing system's email tool. Gate crews are seasonal hires who relearn the entry each year, and the park's outdoor network drops in the far car park and the lower zoo.

What it was costing

Members queued at the gate while staff matched paper records to plastic cards; renewals lapsed because reminders lived in email nobody read, and the park had no way to reach a member standing outside the turnstile.

What they could see

• Gate staff kept a printed fallback list of current members because plastic cards and the ticketing system disagreed about who was paid up.
• Renewal reminders lived in email members never opened, so lapsed memberships were discovered at the turnstile, not before.
• Front-desk staff spent the spring renewal window re-printing replacement cards and answering phone calls about renewal links.
• Members who left cards at home queued at the office window for manual verification while their families waited at the gate.

The constraints we worked inside

• The ticketing system is a third-party SaaS with no native pass support — the app had to integrate through its export API only.
• Gate staff rotate seasonally; the scanning flow had to be learnable in one shift.
• The park's network is unreliable outdoors, so validation could not depend on a live connection.

What had been tried before

The membership office produced printable barcoded cards from the ticketing system and asked members to keep them in phone cases.

A picture of a barcode in a photo album still needed staff to match it to a record, and nothing about the reminder problem changed.

They switched on the ticketing platform's built-in renewal email sequence and doubled the send frequency for lapsed members.

Members treat gate-related email as marketing; open rates stayed low, and the park had no channel that reached someone already standing outside.

What we proposed

We proposed making the membership itself an Apple Wallet pass, so the member's iPhone carries the proof — photo, tier, and validity encoded in the barcode payload — and the park stops being the custodian of plastic. The pass refreshes through the ticketing export, expiry drives a lock-screen notification with a renewal deep link, and handheld scanners validate offline and reconcile in batches. Gates keep moving through dead zones, and the renewal loop moves from email nobody reads to a surface members check daily.

Just as important is what we ruled out, and why:

• A native park app with in-app membership — Another download at the gate was exactly the friction members would bounce off; a Wallet pass arrives without an app store trip and lives on the lock screen.
• Reissuing NFC plastic cards — Printing lead time and per-card cost ruled out a spring-season switch, and a better card still does nothing for the renewal reminder problem that caused most lapses.
• Generating passes from the park's own membership database — The ticketing SaaS is the source of truth for who is currently paid; a second pass issuer would have recreated exactly the disagreement the fallback list was papering over.

How the work ran

Delivered by the experience pod — mobile engineer + designer over 8 weeks, with working increments reviewed with the client every week.

The stack, and the reasoning

Swift

PassKit, the framework behind Wallet passes, is native-only; there is no credible cross-platform path to the certificate handling and pass updates the product depends on.

SwiftUI

The in-app surface is small — pass management and a renewal entry point — and SwiftUI let a two-person pod ship it without maintaining a storyboard layer.

Apple Wallet

Not a technology we chose so much as the product itself: the pass had to live where members already look, with no download standing between them and the gate.

APNs

Pass updates ride Apple's notification path, which is how expiry and renewal nudges reach the lock screen — the one channel members demonstrably check.

Fastlane

Releases had to land between season weekends; scripted builds and TestFlight distribution let the pod push gate-staff pilots without a release engineer.

What went wrong

How we worked together

Cadence

A 30-minute Tuesday demo call with the operations lead and the membership coordinator, plus one gate visit a month during the season to watch scans happen in real conditions.

Client side

The operations lead owned decisions, the membership coordinator owned member data and the collection drive, and two senior gate staff ran scanner pilots on their shifts.

Decisions

Anything the Tuesday demo could not settle went onto a one-page decision note the operations lead answered by Thursday, so questions never stalled a build week.

They provided

Sandbox and production access to the ticketing export API, scanner hardware from the gates, seasonal-staff time for pilot shifts, and the coordinator's afternoons during the data clean-up.

What changed

The headline: all active memberships issued as wallet passes over the first renewal season, with gate scan time logged by the ticketing system — Plastic cards → Wallet passes, read from Ticketing-system scan logs. A second check: on-time renewals during the first pass season at +18%.

The entry conversation changed shape. Gate staff stopped adjudicating memberships and started scanning them; the fallback list went from nightly ritual to forgotten printout. The membership office, which used to spend spring re-issuing cards and fielding renewal phone calls, now spends it watching the renewal funnel and phoning only the members the pass nudges failed to reach. The park also discovered it could message members at the moment that matters — a rain-day discount pushed to passes filled the lower zoo on a weekday that used to be dead.

The result was read from Ticketing-system scan logs against the pre-engagement baseline over the stated window, with a guardrail check on on-time renewals during the first pass season. Where platform-reported numbers and business outcomes differ, this record says which layer it is quoting.

What they own now

• Apple Developer account, signing credentials, and the pass-type certificate in the park's own custody
• A gate runbook covering scanner pairing, offline reconciliation, and the fallback procedure for unreadable passes
• A seasonal-staff training deck sized for one onboarding shift
• The Fastlane release setup and TestFlight distribution list for future pods
• Renewal deep-link configuration documented so the ticketing admin can change checkout campaigns without us