What Touché records

Game and account data

When you enter the game, Supabase creates an anonymous account with a unique ID. Touché stores the player name and topic choices you provide, plus game questions served to you, answers, timing, results, ratings, challenge and LIVE match records, rematches, and question reports.

The server also stores a small set of product events such as onboarding completed, match started or completed, LIVE invite created or joined, challenge created, and question reported. Current product events do not include passwords, access tokens, player PINs, email addresses, or answer keys.

Reports about built-in questions or public community packs keep the exact published pack revision and the bounded evidence needed to investigate what was reported. For a question report, that includes the reported question, answer, and finished-match evidence; a pack report does not require playing first. Reports also retain the selected reason, optional details, shared rate-limit counters, and later moderation decisions. A creator appeal retains the creator’s appeal text and the exact owner-authored revision submitted for review.

Only specifically authorized operators can use the private review queue. Its browser responses omit reporter and operator account IDs and match IDs. Operators review the pinned published evidence and an explicitly submitted appeal revision; they cannot browse unrelated private drafts or edit a creator’s title, questions, answers, or other content. Creators can see a bounded notice and appeal outcome for their own pack, but never the reporter’s identity or an operator’s internal notes. Operator access changes, enforcement actions, and appeal decisions are audited. Operational retry-cache rows expire after 30 days; the report case, its original submission key, enforcement and appeal history remain under the beta retention rule. Report and appeal details are player-provided text, so operators are instructed to treat them as potentially sensitive.

If you enable player sign-in on another device, Touché gives the account an internal @rematch.invalid email and sends your six-digit player PIN to Supabase Auth as its password. Supabase stores the password hash; Touché does not put the raw PIN in gameplay or product-event tables.

Anonymous site and speed measurement

Vercel Web Analytics measures visits, pages, referrers, approximate country, browser, operating system, and device type. Vercel Speed Insights measures real-user performance signals such as loading, layout stability, and interaction responsiveness. Touché does not send custom product events to Vercel.

Before either tool sends a URL, Touché removes its query string and fragment. Challenge tokens, LIVE room codes, and match IDs are replaced with route templates such as /c/[token], /duel/[matchId], and /ops/moderation/[reportId]. Vercel describes both products as anonymous, and Web Analytics does not use cookies. Read Vercel’s Web Analytics privacy documentation and Speed Insights privacy documentation.

Storage, sessions, and deletion

Supabase hosts the authentication and PostgreSQL data in its Ireland region. Vercel hosts the web application and processes the anonymous traffic and performance measurements. The game uses a necessary Supabase browser session so your profile can return on the same device.

During this beta, gameplay and anonymous-account data remains until it is manually removed or the test project is reset; there is not yet an automated deletion screen. To stop playing, clear the site data in your browser. To request deletion of server-side beta data, ask the person who shared the Touché link with you.