Who can see your app's data
Public and private apps, what signing in changes, and why one app can never read another's records.
Two separate questions decide who sees what. The first is who may open your app at all, which one setting controls. The second is who may read or save records inside it, which depends on whether the person has signed in. This guide covers both, and the rule that keeps one app's records away from every other app.
Who can open the app
New apps start private. To change that, open your app in the desk and select Publish above it, then the Access card (or Settings → Publish).
- Private. Only you and the people you invite can open the app. Anyone else is asked to sign in, and a person who signs in without an invitation is still not let in. Select Make public to change this.
- Public. Anyone with the app's address can open it, without signing in. It can also appear in search results. Select Make private to change this.
Switching to private does not delete anything. Visitors who were opening the app without signing in are asked to sign in, and those without an invitation can no longer open it. Switching to public keeps every invitation you have already given. Choose who can open your app goes through the setting in more detail.
Who can read the records
Two things decide it: whether the person has signed in, and what that kind of record is set to. By default the app's pages do not read the saved records directly — the app's own server-side code answers a page and returns only the records that person may see. A list can be opened to the pages themselves for content every user of the app may see.
Each kind of record has a reading setting:
Read permission has four choices:
- Admins. You, the people you invite to edit the app, and a hired AppHandler. Nobody else sees anything.
- Users (own). The default: a signed-in person sees the records they saved.
- Signed-in users. Any signed-in person sees every record of that kind.
- Public. Public by design: any visitor sees the records.
Write permission decides who may add and change records:
- Admins. A catalogue or menu the app presents.
- Users (own). The default.
- Signed-in users. A shared workspace.
- Public. A contact page, quote request or questionnaire. A visitor can add one record and nothing else. That record is stored with no owner, so reading cannot be Users (own) while adding is open to anyone.
Opening one kind of record up does not open anything else. It applies to that kind only, only within your app, and only to the people the setting names — an invitation is still needed to reach an app that is private. You and anyone you invited to edit the app can see and change the settings on the Data tab, where they are shown beside each collection's name.
Everyone who works on the app can see every record in the desk whichever setting applies. You, the people you invite to edit the app, and a hired AppHandler can all open the Data tab in the desk and read, filter, remove, and download every record the app has stored, whoever saved it. The desk does not label a record with the person who saved it.
Information that belongs to the whole app is different. A shop name or a set of opening hours can be read by everyone using the app, and only you or someone you invited to edit the app can change it.
A person's files are theirs
The app's own assets are shared with the app. A file a person uploads is not: it is stored under their account and served only to them (and to your app's owner and the people who work on it). The upload takes the owner from the sign-in, so a page cannot write into someone else's folder or read it. A handle function runs as the person, which is how the app can use the file for them.
No app can see another app's records
Every app's records are kept apart. An app can only read and write its own, and cannot reach another app's records, including another app that you own. AppHandle enforces this, so there is nothing to configure and nothing that can switch it off.
The people you invite to edit an app work inside that app only. An invitation to one app gives them nothing in any of your other apps.
Where your data is kept
The records an app saves are kept in the platform's own database, with each app's records stored apart from every other app's. Your files are kept with the app itself, and unlike records they are part of what counts towards metered storage. Deleting the app removes both, so nothing is left behind.
What the app knows about a person
When someone signs in to your app, the app receives their name and email address, their profile picture if they have one, and an internal id the platform uses to tell people apart. It receives nothing else. It has no access to their password, their AppHandle account, or their other apps.
Where to go next
Invite people to work on your app covers invitations, and Manage the people who signed up covers what you can see about the people who signed in.