Data model
Prysm's data falls into a shared game catalog and everything that belongs to a person: their library, their social activity, their notifications and their linked accounts. Row-level security decides who can read each group.
Groups and who can read them
| Group | What is in it | Who can read |
|---|---|---|
| Catalog | Games, platforms, alternate titles, external ids, genre pills | Any signed-in user, never anonymous visitors |
| Your library | Library entries, wishlist, recently viewed, share intake | Owner only |
| Social | Profiles, follows, blocks, posts, likes, comments, reposts, polls, reports | Profiles and posts follow visibility rules; blocks and reports are owner-only |
| Notifications | One row per notification | The recipient only |
| Events | Seasonal challenges, game watches | Challenges are visible to users; watches are owner-only |
| Linked platforms | Steam and Xbox account links and their one-time link tokens | Owner only |
| Subscriptions | Subscription state and its event history | Owners can read their own; only the payment webhook writes |
| Jobs and cache | Queued vague-search jobs, a search cache | The owner of a job; the cache is not readable by users |
Your library and the catalog
The catalog is shared. Everything on the left of it belongs to one person.
A library entry ties one person to one game. It records a status (playing, backlog, beaten or dropped), a rating from 1 to 10, notes, hours played, the platform they play it on, and where they found it: a TikTok, a YouTube video, search, a manual add or an import. That source is what makes "found on TikTok in March, beaten in September" possible.
Design points
Our id is the identity, IGDB's id is a reference
Every game has our own UUID. Nothing outside the sync layer reads the IGDB id. If the catalog ever changes provider, only the sync code changes, not the library, the feed or the widgets.
Share intake is written before matching
A shared link is saved the moment it arrives, before anything tries to work out which game it means. If matching fails or the person closes the app, nothing they shared is silently dropped.
Release dates carry a precision
Each game's release date says how precise it is: day, month, quarter or year, or no date at all. Most "upcoming" dates in games data are placeholders such as 31 December, and the precision keeps the app from showing them as real.
Deleting a user cascades
Deleting an account removes everything that references it, including rows that other people own but that point at the deleted person, such as their follows of you and notifications about you.
Social
Profiles are public identity. Blocks and reports stay private to the person who made them.