Forms that answer back
A farmer writes this week's vegetable list on her phone, sends it to twenty customers, and their orders land back in her app. Nobody signs up for anything; she runs no website. Here is the whole path — what she taps, what they see, where the orders arrive, and why only she can read them.
It is the same path for a sign-up sheet, a poll, an RSVP, a homework hand-in: one app, shared; many replies, back to one phone.
- The path
- 1 · Her side
- 2 · Their side
- 3 · Where the orders arrive
- Why only she can read them
- Five things that surprise people
- Into a spreadsheet
- Limits
The path
WeChat · WhatsApp · mail
The relay in the middle is the only server involved, and it is blind: the order is encrypted on the customer's phone with a key only the farmer's phone can undo. No account, no login, on either side.
1 · Her side — the list goes out
- Get the form. Apps→Gallery→Order Form→Install. It needs no AI. (Or build one: “an order form for this week's vegetables”.)
- Put this week's list in. Open it, tap ⚙ Edit, and write one item per line —
Tomatoes (kg), 4.50— with the title on the first line. Save items. - Send it. Long-press the app's tile → Share → Share link. Leave “Include its data” ticked — that tick is what carries her list and prices; without it her customers get the demo vegetables the template ships with. Then send the link through anything: WeChat, WhatsApp, iMessage, mail.
- Or send it to a group once. Circles→New circle→Invite, then post the app with +. Everyone in the circle gets it, and next week's list is one post rather than twenty messages.
The moment she shares it, Palmtop gives the app an inbox. The public half of it travels inside every copy and can only post; the private half never leaves her phone. She does not set anything up, and there is nothing to configure.
2 · Their side — the order comes back
- The customer taps the link. It opens Palmtop in their browser — any phone, no install, no account. (If they add Palmtop to their Home Screen, the app stays there for next week.)
- A card says what they are about to get — the name, what it does, and that it comes with data. They confirm Install.
- The form opens with her items and her prices. They enter quantities, their name, any note, and tap Send order.
- They see “Sent … 2 × Tomatoes, 1 × Eggs — 15.00”. That is their receipt; their copy keeps it.
Their copy has no Orders received panel — that part of the form only appears on the phone that created it. A customer sees their own order and nothing about anyone else's.
3 · Where the orders arrive
Two places, the same orders:
Inside the app
She opens her own copy of the Order Form and Orders received is there: a row per order, and a to pack line that adds the quantities up across every customer. It fetches whatever is new each time she opens it.
In the Inbox
Long-press the tile → Inbox: every reply to that app, newest last, with Refresh, Export CSV, Save into the app, Clear and Turn replies off. This one works for any app that takes replies, including one the AI wrote her.
With an AI set up, the Order Form also has ✨ Packing list and ✨ Customer notes, and a
Bookkeeping button that needs no AI at all — it writes every order once into data/ledger.csv.
Why only she can read them
Every copy of the app carries a write token and her public key. A reply is sealed on the customer's phone to that public key and posted to the relay. Her phone alone holds the read token and the private key.
- A customer who digs the token out of their own copy can post an order — they already could — but cannot read the inbox: the relay refuses, and the contents are encrypted to a key they do not have.
- The relay stores sealed bytes. It cannot see what was ordered, by whom, or from whom.
- Nothing about the farmer's customers reaches us, and there is no account anywhere to leak.
Five things that surprise people
- “My customers see the wrong vegetables.” The list was shared without its data. Share again with Include its data ticked.
- “I changed the prices — theirs did not change.” Every copy is its own. Send the link again: their Palmtop says “You already have this app — replace its data with the shared data?” and Yes puts the new list in. In a circle, tap the post and confirm the same thing.
- “It did not tell me an order came in.” Replies do not ring. Open the app, or the Inbox and Refresh.
- “Someone I never sent it to ordered.” Copies can be passed on, and a passed-on copy still replies to her. That is usually the point; when it is not, Turn replies off and share a fresh one.
- Sharing the list sends what the app has stored — but not your own records. The Order Form keeps its bookkeeping ledger, the customer notes and your own last order to itself: they are marked owner-only, so re-sharing next week's list does not hand them out, and the share card names what is staying behind. Your backup still has them. In an app you had built for you, tell the builder which records are yours alone and it will mark them the same way.
Into a spreadsheet
- Export CSV in the Inbox — a file, straight to Numbers, Excel or Google Sheets.
- Save into the app writes
data/replies.csvinside the app; with a paired computer, Push to git puts it in the repository there. - The Order Form's Bookkeeping button keeps its own
data/ledger.csv, one line per order, never counted twice.
Limits
- One reply is at most 64 KB — an order, a form, a vote; not a photo album.
- An inbox takes 200 replies an hour and holds up to 32 MB; the relay keeps them 90 days, and the phone keeps the last 1000.
- Turn replies off is final: the keys are forgotten, and copies already out there can no longer send.
- A share link's parcel expires after 30 days — the link stops working, the copies people already installed do not.