The request is one sentence: "add a login so that only my colleagues can enter". What comes back is a sign-in screen, a sign-up screen, a sign-out button, and - the part that decides whether it is real - a rule every screen follows: if nobody is signed in you see the sign-in screen, not the data.

The first account is made on the sign-up screen: a name, an email address and a password. The app creates the account, signs that person in, and from then on that is how they get in. A second colleague signs up the same way. The password is never stored as text - the app keeps a scrambled fingerprint of it, so a wrong password simply does not open the door.

Each person's own records stay their own. A colleague who signs in sees their rows, not everybody's: two people can use the same app on the same day and neither sees the other's list. What is shared is shared on purpose, and what belongs to one person stays with that person's account.

It works the same on your published address as in the preview, because publishing does not take the accounts away - and it keeps working when you export the app and host it somewhere else.

What it does not do, said plainly so nobody plans around it: there are no roles (anybody who signs up can see whatever is shared), no email confirmation, and no "forgot my password" link. Ask for one of those in those words and you get it - a request that names the thing gets the thing.

One practical habit: ask for the app to print a demo account on the sign-in screen. Without one, the first person to open your app has no way in, and a login nobody can pass looks exactly like a broken app.