Yeah they really should be using Stripe to authorise the card payment and then capture it when the app is successfully installed