I don't understand your syntax:

    `You+App --Read/Write-> f_private(your_data) <--Write only- 3p`
Does this mean a server where third parties can send code to run on your data, but cannot respond to them?

It means any 3rd party even the app provider cannot read your data or the output of the function run. They can provide some data/resources like say map tiles, PoI data and a function to run.

They mean 3rd parties have wo permission instead of rwo to your data store