Ce qui vous protège précisément.

// When both partners have submitted, on the server:
async function computeReveal(partnershipId) {
  // privileged server context — no client can reach into this
  const [a, b] = await loadBothResponseSets(partnershipId);

  const overlap = sharedQuestions
    .filter(q => isMutual(a[q.id], b[q.id]));
    // mutual = yes·yes, yes·maybe, maybe·maybe

  return overlap; // the only thing either client is ever sent
}

-- row-level security · every user-facing table
alter table quiz_responses enable row level security;

create policy "own rows only" on quiz_responses
  for select using (auth.uid() = user_id);

-- in transit: TLS 1.2+ · at rest: AES-256 (platform-managed)
-- your session token cannot read your partner's rows

// Settings → Export my data (instant JSON download)
GET /api/account/export
// → profile, responses, matches, journal

// Settings → Delete my account (permanent, immediate)
async function deleteAccount(userId) {
  await cancelStripeSubscription(userId);
  await auth.admin.deleteUser(userId); // cascades through every table
}
// Daily backups expire on a 30-day window. No archive.

// excerpt from the BothWant Data Processing Agreement, §4.2
// available at /legal/dpa, executed by BothWant Editorial.

PROHIBITED USES. Processor shall NOT:
  (a) use Customer Data to train, fine-tune, evaluate,
      or otherwise improve any machine-learning model,
      whether owned by Processor or by a third party;
  (b) grant any license to Customer Data that would
      permit such training by a sub-processor;
  (c) retain or repurpose Customer Data beyond the
      operational purposes described in §3.1.

// This clause survives termination. It cannot be amended
// without notice to all active customers and an opt-out window.

$ rg 'connect.facebook.net|googletagmanager|doubleclick|tiktok|linkedin\.com\/insight' .
# (no matches)

$ rg 'pixel|fbq|gtag|ttq|_linkedin_partner_id' --type js --type ts
# (no matches)

$ cat package.json | jq '.dependencies | keys[]' | grep -i 'pixel\|analytics\|tracking\|ad'
"posthog-js" # the only match — and PII masking is enforced in posthog.config.ts