System overview
Prysm is a mobile app, a Supabase backend and a website. The app never holds a third-party secret: anything that needs one goes through a backend function, and the database itself enforces who can see what.
The three pieces
- The mobile app is built with Expo and React Native and runs on iOS and Android. It shows the screens, keeps local state, and hosts the home-screen widgets and the share-sheet target.
- The backend is a Supabase project: Postgres, Auth, Edge Functions (Deno), Storage and scheduled jobs. It holds the game catalog, every user's data and all the integrations.
- This website is Next.js on Vercel at www.prysmblast.com. It serves the legal pages, web account deletion and these docs.
Arrows show who calls whom. Third parties are only ever called from the backend, apart from purchases and push, which use their own SDKs.
Four principles
The app never holds a third-party secret
Every call to IGDB, Steam, Xbox or the language model goes through an edge function. IGDB forbids calls from browsers and apps outright: its API refuses CORS requests precisely so tokens cannot leak. Even where a vendor would allow it, a key inside an app bundle is a key anyone can extract.
The database enforces the rules
Row-level security means the app can only ever see and change the signed-in user's own rows. The free-tier game cap is enforced by database triggers, not by the app counting, so a modified client cannot get around it.
The catalog is local
About 90,000 games are seeded from IGDB into our own Postgres ahead of time. Search is one database query rather than a live API round trip, which keeps it fast and keeps it working when IGDB is slow.
Slow or flaky work runs on a schedule
Push delivery, release-day alerts and vague-search model calls run as scheduled sweeps, never inside a user's tap. Liking a post does not wait on a third party being up.
A request's life
You type elden ring into search.
- 1
The app calls the search function
It sends the text with your session token. The token is what lets the backend know who is asking.
- 2
The text is normalised
Case, punctuation and apostrophes are flattened so Assassin's Creed and assassins creed match.
- 3
Postgres matches it against the local catalog
A trigram match finds titles that are close to what you typed, including common abbreviations.
- 4
Results are ranked
Match quality is blended with popularity, so the game you almost certainly meant comes first.
- 5
The app shows the list
No third party was involved at any point.
Where to go next
- The mobile app, the backend, the data model and security and privacy each get their own page in this section.
- For a feature told end to end, start with how search works and how a shared link becomes a game.