Security and privacy
Nothing in the app to steal
Overview
You sign in with a six-digit code sent to your email, or with Apple on iPhone, or with Google. There are no passwords in Prysm, so there is none to leak or reuse. The database, not the app, decides what each account can see. Third-party secrets never leave the backend: the app ships only public identifiers, so even an unpacked app has nothing in it to steal. What Prysm stores and why is set out in the privacy policy, which these docs agree with.
How it works
- 1
Sessions use short-lived signed tokens, valid for an hour and refreshed automatically, and stored on the device so people stay signed in.
- 2
Row-level security is on for every table. Your library, wishlist and notifications are readable only by you. The catalog is readable by signed-in users only, and an anonymous client can neither read nor run anything.
- 3
IGDB, Steam, Xbox, language-model and push credentials exist only as backend function secrets.
- 4
Connecting Steam or Xbox starts from a signed-in account, and the return trip only works together with a one-time token tied to that session. Prysm never sees a Steam or Microsoft password.
- 5
Payments go through the App Store or Google Play, made by RevenueCat's SDK. Whether you are Pro is an entitlement computed from the store's receipt, and the backend learns it only from RevenueCat's webhook.
- 6
You can block and report people and posts, and an on-device word filter catches the worst posts before they are sent. Blocked accounts disappear from each other's feed and search.
Key decisions
The database is the gate
Every request from every client passes the same row rules, so a modified app gets nothing extra. Functions that act for you connect with your own token, so the rules apply inside them too. The free-tier cap is enforced the same way.
No passwords at all
An emailed code, Apple or Google means there is no password table to breach and nothing to reuse from another site. The web deletion page can only sign in to an account that already exists.
Describe principles, not mechanics
These docs explain why each protection exists and leave out the details that would help an attacker, such as how the webhook authenticates.