Send a day, not your round
Pick the jobs — or just send a booked day, the natural parcel to hand over — and choose what travels with them: prices, notes, phone numbers, and whether they are allowed to collect money. Anything you do not tick is simply never in the file. The file is encrypted under a PIN you choose, so a work list sat in somebody's downloads folder is not a list of your customers.
You always know what is out
Every job that goes out is tagged Sent To with their name, and a booked day that has been handed over says With their name on its heading. Work that is out cannot be sent again — two people cleaning the same house ends with it cleaned twice or not at all — and a Work Sent Out list keeps track of every send until it comes home.
On their phone
They install Work Tracker, open the file, and type the PIN. The work appears as Extra Work — walled off from any round of their own, which stays out of reach until they leave your list. They can mark jobs done, skipped and tagged, but not cancel anything — your round is not theirs to change — and Paid only appears if you allowed collecting. When the week is done, Return Work writes the file back, still under the same PIN.
The round comes home
Open the returned file on your phone and it unlocks itself — no PIN to retype — and shows exactly what came back. Nothing touches your round until you press Update My Work: then done is marked done, skipped is skipped, paid is paid, and every job they touched carries their name in the customer's history, so it always says who was there.
Off by default: most rounds are one person, so the sending buttons stay out of the way until Work Sharing is switched on in settings. Receiving is never switched off — someone handed a work list needs no setting to open it.