Operations app for PHO & CO restaurants (Eastcote, Sydenham) and the Wembley central production kitchen.
Built for shared Android phones and tablets on site: staff pick their name, enter a PIN and work through
the day's checklists. Owners see every site, resolve alerts and control accounts; operations managers do most of
that for the sites they run.
-
Site tablets only: staff names and the name + PIN sign-in appear only on tablets registered to a site with a one-time set-up code from an owner or operations manager. Any other device shows no names, just a pairing box and a staff ID + PIN sign-in (the full app for owners and operations managers, My shifts for everyone else). Removing a tablet signs out everyone on it.
-
Sign in with name + 4-digit PIN. 5 wrong PINs (at sign-in, sign-off or PIN change) locks the account for 15 minutes.
-
Staff management (owners, and operations managers for staff and managers at their sites): add people, sites, roles, sections; temporary PINs that must be changed on first use; reset PIN; mark as left.
-
Roles, set per site: staff, manager (manager tools for their site), operations manager and owner.
- An operations manager runs a group of sites, above the site managers and below the owner. At their sites they have everything a manager has, plus the overview (Overview tab: the sites, today's team and Send reminders now, alerts, the activity log), staff and manager accounts (add, edit, temporary PIN, log out, freeze, mark as left) and the shop tablets (set up and remove). They get the full app on their own phone or laptop, and every manager message for their sites (alerts, gas, ready to open, cover, time off, the 08:00 and Monday summaries).
- These stay with the owner: closing and reopening sites (and anything that would lift a closure's freeze: unfreezing, or marking as left and rejoining), connecting rota sheets, right to work, owner and operations manager accounts (including the operations manager's own) and the account of anyone allowed to see right to work, anyone who also works at a site the operations manager doesn't run, and making anyone an owner or operations manager. An operations manager's own time off goes to the owners only (site managers don't see the request), "All sites" notices need someone who manages every site (a closed one included), and their activity log leaves out other sites and right to work. Signing in by staff ID on their own device lands at an open site they run.
-
Today screen: the site's checklists for each section (FOH, BOH, Production) with due times, overdue flags, open alerts and handover items.
-
Checklists: tick items, temperature readings, numbers, text, photo placeholders. Readings are checked against the approved limits:
- Fridge: target ≤ 5 °C, legal limit 8 °C
- Freezer: target ≤ −18 °C (warning only)
- Cooking: core ≥ 75 °C
An out-of-range reading must have a corrective action before the list can be signed off, and a failed one raises an alert for managers.
-
Sign-off requires the PIN again. Signed records are locked; corrections are added as new entries.
-
Handover notes between shifts. "Needs action" items stay open until someone closes them.
-
Owner control (the overview; operations managers see their own sites, without closing them):
- site overview
- resolve alerts (a note is required)
- log out or freeze any account
- close a site with one button, which logs everyone out there and freezes staff who only work at that site; reopening unfreezes them
- audit trail of every action
-
Rota and reminders: each site's rota Google Sheet sends its Export, week status (Settings) and Staff tabs every hour through a small Apps Script (Owner → Rota sheets → Connect sheet). Only Published weeks are shown or messaged. Staff sign in on their own phone with staff ID + PIN to a limited My shifts view and turn on notifications: a list when a week is published, a message when a published shift changes, and a reminder at 18:00 the evening before. Nothing is sent 22:00–08:00, except urgent messages (kit not working, P1 tasks), which still go out until midnight, and shift reminders (below). A Supabase schedule (pg_cron) calls /api/cron/tick every 10 minutes.
-
Shift reminders and replies: every published shift gets one reminder 2 hours before it starts (not before 05:00 unless the shift starts earlier), whatever the hour. It carries what's waiting from handover at the site: action notes (staff notes never; customer complaints only as a count, since they can name a customer) and prep still to do. The owner's Send reminders now button (top of the Owner screen) sends them straight away to everyone starting later today who hasn't had theirs, and shows today's team at every site, who has notifications on, and each reply. Staff answer under the shift on My shifts: On my way, Running late (15, 30 or 45 min) or Can't make it (they're also asked to phone). Late and can't-make-it replies go to the site's managers and owners straight away (if the shift starts within 3 hours, even at night) and show at the top of Today for managers. Replies are append-only: a new one replaces the last.
-
Handover tab (prep and notes in one place): everything outstanding for the shift on one list, prep items from the last handover and notes together, each ticked Done (who and when are kept; undo within 10 minutes). Notes can be added at any time and show straight away: Needs action notes stay until ticked, For info notes show for that shift and the next, then drop off. Food-safety notes go to the top. At Eastcote the closing shift also does the prep handover from the same tab: one master list in two parts, To do and To prep, in groups (managers edit it under Manage → Handover list; the owner and operations managers can take items off and put them back), tap only what's needed (saved as a shared draft), Next shift / Tomorrow morning / Tomorrow evening, then "everything else is stocked". Anything not done carries into the next handover once, and the manager gets an alert.
- Who it's for: anyone on the tablet can give a prep item, or a note that needs doing, to someone at the site, or change it at any time (each change keeps who and when, and goes in the activity log). The list puts the people working the shift it's for first, with their times (a morning runs to 15:00, an evening from then; working it means at least an hour of it), then everyone else at the site. Anyone can still tick it done. An item stays with whoever it's for until it's done or someone changes it, also when it carries into a newer handover (the review step shows who, to change it there); if they've left the site or are frozen, it counts as for anyone. The handover says what it's for with the date ("Tomorrow morning · Wed 14 Oct").
- On phones: managers get a Handover button on My shifts for a read-only view of their sites (no ticking, notes or prep; staff notes and complaint details stay on the tablet). Everyone sees what's for them under For you on My shifts, and their shift reminder starts with "For you: …" (then only what isn't for anyone in particular). No extra messages.
-
Ready to open (Today and the Owner screen): each site has a ready time (Eastcote 12:00, Wembley 08:00, in sites.ready_by). On a day the site has published shifts (and once it has started recording checklists in the app) it shows a light. Green: the opening checks (those due by the ready time) are signed and nothing is in the way. Amber: still getting ready, or kit not working, a warning alert, or someone late or not coming. Red: opening checks unsigned at the ready time, food-safety kit not working, or a critical alert. Red at the ready time messages the site's managers and owners once, with why.
-
Gas off at close: from 15 minutes before the last published shift at a site ends, the tablet and the closing team's phones show All gas is off. The first tap counts (who, when, and whether on the tablet or a phone; it can't be changed). If nobody has tapped 30 minutes after close, the site's managers and owners are told, whatever the hour, and hear when it's done. Only on days with published shifts, so a site whose rota isn't in the app yet (Wembley today) is never chased.
-
Yesterday at a glance: at 08:00 owners (all sites) and managers (their sites) get one message covering checks signed and missed, temperatures out of range, alerts, kit, people late or not coming, handover notes, overdue tasks, and whether the gas check was done. Sites that weren't in use that day are left out.
-
Shift cover: under any upcoming published shift on My shifts, Ask for cover (with an optional reason, which only managers see). Colleagues at the same site in the same section who aren't working (or already covering) then and aren't off are asked; the site's managers and owners are told. Colleagues see it under Shifts you could cover and tap I can cover (or take it back). A manager approves one offer (Manage → Shift cover) or declines with a note, and can cancel an approval later; everyone involved is told. The app never changes the rota sheet: the page tells the manager to move the shift in the sheet, and once the next import shows it moved, the request shows as covered. If the sheet changes the shift first, an open request closes. Requests can be withdrawn while open; nothing is deleted.
-
Team rota (Rota tab, and "Team rota" on My shifts): the site's week laid out like the Schedule tab in the rota sheet, a grid on a computer and day by day on a phone. Everyone at the site can see published weeks; owners and managers also see paid hours, daily and weekly totals, and draft weeks (marked Draft). Paid hours come from the sheet's Export tab with each hourly sync.
-
Manager tools (Manage tab for managers; tiles at the top of the overview for owners and operations managers). Managers use them on the shop tablet; staff phones stay limited to My shifts and the team rota.
- Task centre: everything open at the sites a manager runs, in one list by priority (P1 critical to P4 improvement): critical alerts and broken fridges first, then overdue checklists, food-safety handover actions, urgent prep, run-out certificates, and so on. Managers add one-off tasks for a person, a section or everyone at a site, with a date; they show on Today (and My shifts on a phone) for the people they're for, who tick them done with a note (undo within 10 minutes). Alerts can be resolved from here. Everything else links to where it's dealt with.
- Inspection records: for a site and date range, the temperature log (with limits, out-of-range readings and corrective actions), checklist sign-offs (on time, late, not signed), alerts with how they were resolved, and food-safety handover notes. Printable, with CSV downloads. Days before a site's first recorded checklist aren't counted as missed.
- Weekly report: per site and for the group, Monday to Sunday: checklists on time, temperatures out of range, alerts, handover actions, prep carried over and planned hours, with a change on the week before and a short "needs attention" list in plain words. On Monday at 9am each owner and manager also gets last week's headline numbers for their sites as a message.
- Team notices: post to a site (or every site, for someone who manages them all, closed ones included), optionally only FOH, BOH or PROD, with an end date. Everyone it's for sees it on Today or My shifts until they tap "Got it"; the poster sees who has and hasn't. Important notices also go to phones with notifications on.
- Time off: staff ask from My shifts (holiday, unpaid, other); managers of the site approve or decline with a note, and see any rota shifts on those days. Approved time off shows as "Off" on the team rota, and shifts that clash are outlined for managers. The rota sheet is never changed by the app.
- Certificates: food hygiene (Level 2 and 3), allergens, first aid, fire marshal and other training per person, with issue and expiry dates (expiry suggested from a 3-year refresher cycle). A matrix of who holds what, what's run out or running out, and whether each site has a first aider, a Level 3 supervisor and a fire marshal. Reminders at 9am, 30 and 7 days before and just after the date, to the person and their managers. Right to work checks are private to the owner (other owners and managers don't see them) and store dates, not document numbers. Nothing is deleted: a mistake is marked removed. Staff see their own certificates on My shifts.
-
SOP library (Library tab; "SOPs" on My shifts): PHO & CO's standard operating procedures as numbered steps, each with an optional red warning and a photo (taken or chosen on the tablet, made smaller there before upload, and stored in the database so only signed-in people see it). Managers, operations managers and the owner write drafts; the owner or an operations manager approves and publishes, or sends it back with a note. Nobody approves a version they wrote, changed or sent (the owner may, so they're never stuck), and an operations manager only approves, retires or takes back SOPs for sites they run: the rest go to the owner. Approving publishes exactly the version on screen: if it changed meanwhile, the approver is shown the latest first, and two people saving the same draft can't overwrite each other. Changes not yet saved are kept on the device and offered back if the writer leaves the page or is signed out. Only published versions reach staff. Each SOP has a code that never changes (SOP-BOH-001: one section, or SOP-GEN- for several or everyone), says who must read it (Front of house, Back of house, Production, or everyone), and has a review date (12 months by default). Everyone it's for sees it under SOPs to read on Today and My shifts until they tap "I've read and understood it", once per version: a new version (marked minor update or major change) asks them again. A Step by step view shows one step per screen in big text and keeps the screen on. Managers see who has read each version at their sites. A published version is never changed (the database refuses): editing makes a new draft, and the old version stays readable. SOPs are retired, never deleted, and can be brought back. For privacy, the owner can erase a photo (say it shows someone): it shows as "Photo removed" in every version (and in any other recipe using the same ingredient picture), and the reason is recorded. Photos no SOP uses are cleared away after a week.
-
Recipe handbook (Library → Recipes, on the shop tablet): prep recipes (a batch: what it makes, ingredients, method, storage and shelf life) and dish specs (what goes in a portion and how it's built), written and versioned like SOPs. Only the owner approves, sends back, retires or brings back a recipe or dish (operations managers and managers write drafts and send them). Each recipe shows as one card that fits the tablet screen, either way round, laid out like PHO & CO's printed recipe cards: a prep recipe has its ingredients as picture tiles, the method as numbered picture steps (past 12 steps, a second panel), then the final result, important notes (one per line, shown as ticks), storage and allergens; a dish has its photo with labels pinned to it ("Protein (generous)"), the serving standard as checks ("NOT over-burnt"), what's in a portion and how it's built, and its allergens. A version that isn't the one in use (waiting for approval, replaced or retired) says so on the card. Print A4 prints the card on one page (a recipe too long for one goes over two, never cut off). Amounts are numbers with units, so the size picker in the card's header makes ½, 2 or 3 batches, any number of portions, or scales to what's to hand ("18 kg of bones"). Writers add a picture per ingredient; a picture taken once for an ingredient is offered again wherever that ingredient appears (by name). A dish's components can link to the prep recipes they use. Every recipe marks all 14 allergens (and E120): contains, can be left out on request (dishes), or free from. A dish can be published with just its allergens, so the matrix can go live before every dish's build is written. Recipes are for kitchen staff and managers only, never on staff phones.
-
Allergen matrix (Library → Allergens, for everyone, on the tablet or their phone): every published dish, by menu section, with its kitchen notes and dietary tags; "A guest avoids…" shows which dishes are fine, fine only if the kitchen leaves something out, or not for them; it prints. When a dish's allergens change, everyone at its sites sees it on Today or My shifts and confirms they've seen what changed; managers see who has.
-
Training Academy (Library → Training on the tablet or their own phone; Manage → Training for managers): each section has a pathway of skills in order (front of house, back of house, production), under headings like Operations or Service. A skill can link SOPs and recipes to read (staff only see published ones), a video to watch (a link that opens in a new tab) and a short quiz. A knowledge skill is done when its quiz is passed (or, with no quiz, when they mark it done; not while its quiz is still being written). A hands-on skill is done when a manager watches them do it and confirms it (after the quiz, if it has one): the manager of that section at their site (a head chef for kitchen skills), an operations manager or the owner, never themselves. Quizzes are shuffled every time and marked on the server, so the right answers never reach the phone; people can try again as often as they like, and every attempt is kept with what was asked and answered. Each pathway has deadlines from the day someone starts in that section, or for everyone already working, the day training goes live (induction skills within 7 days and everything within 42, by default); coming back (from leaving or a site closure) starts the clock again for whatever isn't done. A skill can have a refresher (every 12 months, say): it's due by that date, people are told 30 days before, and they can do it again from then. A skill also has to be done again within 14 days when an SOP or recipe it links to has a major change, or when a manager asks for it again with a reason, which the person sees. Tightening a skill later never makes anyone due sooner than is fair, nor clears what's already overdue: shorter pathway deadlines or making a skill part of induction give the new days from the change (but no longer than before), a new or shorter refresher two weeks (but no longer than the old one), a skill moved to another pathway or brought back the pathway's usual days, a first quiz for someone who'd said they were ready two weeks, and linking an SOP accepts it as it is (only a major change after that counts). Overdue skills and ones to do again show on Today and My shifts, and at 9am people get a message when a refresher is 30 days away or due, or a skill is to be done again. Someone waiting for a manager's check is never shown as overdue. Managers see each person's skills passport, a matrix of who has done what at each site, and a Waiting for your check list. The owner and operations managers set the skills, quizzes and deadlines; questions drafted for them aren't asked until one of them approves them. Owners and operations managers have no training of their own. Nothing is deleted: skills and questions are retired (a retired skill can't be changed until it's brought back), and the training record is append-only.
-
Equipment and maintenance: each site's register of kit (fridges, freezers, fryers, probes and so on) with where it is, who services it and how often. Anyone working at the site reports a problem from the tablet, their own phone, or by scanning the QR label on the kit (Manage → Equipment → Print QR labels); managers are told straight away. "Not working" kit shows at the top of Today and on the Handover tab until someone marks it fixed and says what was done. Managers log services; reminders go two weeks before a service is due and when it's overdue. The weekly report counts problems and hours out of service. The history is append-only and kit is retired, never deleted.
-
Shift Mode (the Shift tab, and where everyone but owners lands after sign-in): your role + your shift = your screen. The app looks up your shift on today's published rota and shows only that shift's things in time order: the check due now, prep for you or your section, handover notes for you, allergen changes to confirm, training due, the gas check at close if you're a closer, with On my way / Running late / Can't make it under the header. Kitchen (BOH), Front of house (FOH) and Production (PROD) each see their own lane. Not on today's rota? Pick a lane and it shows what's waiting there. Managers see every lane with people on, side by side, and can switch to their own shift; the Owner screen opens with four numbers (urgent, ready to open, prep to do, on shift) and a link to the lanes. The old Today screen stays as "Everything at the site".
Not built yet: Wembley batch codes, labels, dispatch and receiving, and the remaining MVP features. See the PRD.
