Well, damn. I put effort into making a thing that could be tried out by anonymous users but still had RLS policies and now they've provided a solution that would have made the whole thing heaps easier.
supabase auth stores your users in the same database created, just in a separate schema so you have full access to it to perform joins or enforce referential integrity.
I wonder how anonymous user sign-in info is persisted on the client. Specifically, I want to know whether re-installing the App will make it forget the previous anonymous sign-in.