Privacy policy for Supabase apps

What Supabase does on a live site

Supabase is in the auth and database category. On sites we scan, it shows up through supabase.co. Its role is to store application data and sign users in.

Data that may be processed: Account emails, authentication tokens, and the rows your project stores in Postgres. The vendor describes the location as: The region you chose for the Supabase project (commonly the United States or the EU). Their public privacy or data-processing terms are at https://supabase.com/privacy.

A privacy policy for a Supabase app should name Supabase directly and say what your own product sends to it. A phrase like "third-party tools" is not enough once this service is on the page.

Supabase projects call a host ending in supabase.co. In the browser, an auth session is often stored under a localStorage key that starts with sb- and ends with -auth-token. Say that accounts and the rows you store live in Supabase, and name the kinds of rows (accounts, posts, files) your app actually writes.

Row Level Security controls who can read a row. It is not a substitute for telling people what you collect.

What you still have to type

The scan cannot know your company name, the country you operate from, or the support email you want on the page. Those go in a short form after the scan. The legal clauses around them are fixed template text, marked as a draft until a lawyer reviews them.