Loading
Customer mobile app — login flow
Your customers log into the same app your team uses. Name + phone. Done.
The all-in-one mobile app means your customer base doesn't need to download a second app to track their job or check their warranty. They open SalesThumb, type their name + phone, get a 6-digit SMS code, and land on a portal showing only their stuff. Staff get a different login (email + password) and a per-employee mobile_role flag (NONE / INSTALLER / SALES / BOTH) decides which tabs appear. No app-switching, no second download, no separate brand.
No credit card
Cancel anytime
Features, zoomed in
The parts that actually move the needle.
Three capabilities built specifically for the day-to-day of a working shop.
Deep dive · 01
One app — tech, sales, customers
The mobile app lives in the App Store / Play Store as a single brand. The first-launch splash shows two big buttons: 'I'm a customer' and 'I'm a team member'. Customer flow is name + phone + SMS code; staff flow is the existing email + password Better-Auth path. The token type written to SecureStore decides which tab group renders on the next launch — customer tabs (Home / Garage / Profile) or staff tabs gated by the mobile_role enum.
- Single iOS + Android app, single brand on both stores
- Splash picker on first launch — no friction to find the right path
- Sessions stored in different SecureStore keys so a phone never has both at once
- Push notifications work today on the staff side (new-job alerts, team voice messages); customer-side push isn't wired up yet
SalesThumb mobile
SalesThumb · iOS / Android
One binary9:41
Enter your phone
We'll text you a code
(512) 555-0148
4
8
2
9
·
·
No password · no email
Customer · passwordless
9:41
Sign in
Shop staff & owners
marcus@precision-tint.com
Password
••••••••••
Email + password
Staff · email + password
Auth shape detected at app launch · routes to correct experience
Deep dive · 02
Why name + phone is safer than it sounds
Most apps use email + password (forgettable) or magic links (bounces in spam). Phone-based passwordless is the right shape for a service-business customer who probably booked their original appointment over the phone anyway. Three layers keep it secure: the 6-digit code (10⁶ space), a 5-attempt lockout per code, and a 3-codes-per-hour rate limit per phone. The requestCode endpoint always returns ok:true so an attacker can't enumerate which phones are registered.
- 10⁶ code space + 5-attempt lockout = effectively guess-proof in the 10-min window
- Codes hashed (SHA-256) before storage — DB leak doesn't expose codes
- Phone enumeration prevention (always-ok response) shut at the protocol level
- Token issued on success has 30-day expiry + can be revoked from /app
SalesThumb mobile
SalesThumb
Run, book, and track your jobs from one app.
I'm a customer
I'm a team member
Splash
Customer · Sample Shop LLC
See your job
Type your name + the phone number we have on file.
Sarah Chen
(555) 014-2821
Send code
Sign in
Code sent to ···2821
Enter the 6-digit code
Arrived in 4 seconds. Expires in 10 minutes.
4
1
8
2
9
5
✓ Verified · landing in your portal…
Didn't get it? Resend in 0:42
Verify
What's included
The full capability list.
Everything that ships on day one. No feature-gating surprises inside a single plan.
- Passwordless SMS-code login (6 digits, 10-min TTL, 5-attempt lockout)
- Re-uses the existing 30-day customer portal token format
- Multi-shop disambiguation via name hint + most-recent-appointment heuristic
- Phone normalization shared with the Twilio inbound webhook
- Enumeration-safe: requestCode always returns ok:true regardless of phone match
- 3-codes-per-hour rate limit per phone
- Constant-time hash comparison (SHA-256, no plaintext at rest)
- Mobile session auto-expires after 30 days; re-auth via the same flow
See every angle
A tour of the screens
Every meaningful view, the path through it, and the moments that matter — so you know exactly what you're buying.
One app, two login paths
Customer flow uses passwordless SMS code; staff flow uses email + password.
Both live in the same Expo app on the same App Store listing.
SalesThumb mobile
SalesThumb · iOS / Android
One binary9:41
Enter your phone
We'll text you a code
(512) 555-0148
4
8
2
9
·
·
No password · no email
Customer · passwordless
9:41
Sign in
Shop staff & owners
marcus@precision-tint.com
Password
••••••••••
Email + password
Staff · email + password
Auth shape detected at app launch · routes to correct experience
Customer home — their stuff only
Active job progress, upcoming appointments, quotes and invoices.
No staff data leaks; the portal token only authorizes the customer's own records.
SalesThumb mobile
Customer home — their stuff only
Screenshot coming soon
Who it's for
Built specifically for…
- Shops whose customer base is phone-first (not email-first)
- Shops who want their customer portal to feel like an app, not a magic link in SMS
- Multi-location franchises where one customer might use 2-3 shops in the chain
What it replaces
The old way…
- 'Send me the link again' phone calls when the magic-link SMS got buried
- Customer-facing apps with email + password (forgotten passwords are the #1 support issue)
- Two separate apps (customer app + employee app) for the same brand
How it works
Set it up once. Run it forever.
- 1
1. Splash → role pick
First launch: 'Are you a customer or team member?' Two big buttons. Customer route asks name + phone; staff route asks email + password.
- 2
2. Code arrives in 4 seconds
Customer types their phone → Twilio fires a 6-digit code via SMS within ~4s. They type it in. Backend hash-compares, mints a 30-day token, stores it in SecureStore.
- 3
3. Customer tabs render
App reads the customer-token key from SecureStore on launch and routes to the customer tab group: Home (active job progress, appointments, quotes, invoices, loyalty), Garage (per-vehicle warranty status), Profile (account + sign out).
What this looks like in a shop
Illustrative scenario: Sarah just got her Tesla tinted at Atlas. The shop rang her up, she paid via pay link in the lobby. Two days later she remembers Mike said something about checking her warranty in the app, but she lost the SMS link. She downloads SalesThumb, taps 'I'm a customer', types Sarah Chen + 555-0142, gets a code in 4 seconds, and lands on her account with the appointment history and the warranty cert for her Tesla. No password, no support call to the shop.
Questions
Good to know.
- What if a phone matches two shops in my chain?
- The verify endpoint resolves to the customer record with the most recent appointment activity — that's almost certainly the shop they're trying to log into. Future enhancement: a shop picker on the second login if multi-shop is common in your customer base.
- What if Twilio is down?
- The customer sees 'Code sent — check your messages' (we don't surface delivery failures, by design — that would leak which phones are registered). They can retry after a minute. Operator can also generate a fallback magic-link from /app/customers/<id> and SMS it manually.
- Can a staff member also be a customer?
- Yes — they'd log in with their staff credentials by default but can also use the customer flow with their personal phone if they want to test the customer experience. The two sessions live in different SecureStore keys so they don't clash.
- Is this PCI / SOC 2 compliant?
- The auth flow itself doesn't touch payment data. The codes are hashed at rest, transmitted over TLS, expire in 10 minutes, and rate-limited. Standard passwordless-SMS pattern that auditors have approved for many SaaS products.
Fits in with
Works with your stack
Tw
Twilio
Delivers the 6-digit SMS code
Be
Better-Auth
Powers the staff email+password side
Ex
Expo SecureStore
On-device token storage, encrypted at rest
Explore more
Pairs well with
Mobile Apps
The installer app shows today's schedule, captures photos, clocks in/out, and updates job status. The customer app shows their active job's progress, appointments, quotes, invoices, and warranty status — as the SalesThumb app with your shop's name on it today. (A fully white-labeled app under your own brand in the App Store is on the roadmap.)
Learn more
Two-way SMS
Every customer conversation in one inbox. Auto-reminders run 24/7, but when they reply, a human sees it. MMS, templates, merge fields.
Learn more
Automations
Pick a preset drip sequence — win back lapsed customers, follow up cold leads, or ask for a review after a completed job. Choose your pace, edit the message, turn it on.
Learn more
Job Photos
Every appointment gets a photo gallery. Techs capture on mobile. Customers see a polished post-install gallery. You protect yourself from 'it was like that when you got it' claims.
Learn more