I've written a simple stopwatch app in javascript, in which a user can measure the duration of a few laps and they are stored in an array.

What I would like to make possible is that a group of people (e.g. a school class) opens this app simulatenously, then each person makes a few measurements e.g. on their phone. Then the data from each person is somehow sent to one group member (e.g. the teacher) and on his end the app combines the data and e.g. does some statistics with it.

Since I'm just an amateur, I'm not sure how to go about it. What tools would you recommend me for that and also where could I deploy it? I assume I need a backend for that, and I started reading about node.js. Am I on a right track?

When it comes to deployment, I looked into Firebase and Heroku. On Firebase I need to provide my card details to even start using backend functions. There is a free tier but my concern is that some evil person finds this page, and runs some malicious code on it, so that the measurement is run 10000000 times, and all of the sudden I receive a 1000$ bill. If it's impossible, feel free to laugh, I'm a newbie :) . Or maybe there are some simple ways to prevent it?

On Heroku there is a free tier, and above it I've read that they charge per hour of runtime of the app. The thing is eventually I would like this stopwatch to be a part of a bigger webpage with mostly static content, so it's probably stupid for the static content runtime to be included here. How are things like that handled? Do I host the static content somewhere else, the stopwatch on heroku, and then get a single domain and assign both things to it?

Thanks in advance for guidance!