WHy not using a REST service for this? Then you can put the information in de response.
So App1 does a REST callt to App2. App2 gives back a response with all the information you want.
As Sander says, REST is probably the best way to do this.
You can pass values on the query string when using a DeepLink, but this would be visible to the user, and open to them manipulating it in the browser.
If you use REST, you can make this server to server, which would be safer.
If you use an api, you can create the preview in App1 right? App1 receives data via the rest call and you can create a page in app1 to preview the data. You can create non persistant objects in app1 to put the data in. Think this is the safest way to do this.
Otherwise you have to explain better why you cant use an api...