Backend & Auth

Privacy Policy for Apps Using Supabase

Supabase provides a Postgres database, authentication, and file storage that hold your users’ personal data. As your backend and sub-processor, it belongs in your privacy policy.

Create My Privacy Policy

Last updated July 8, 2026

Why this affects your privacy policy

Whatever your users enter — accounts, profiles, uploaded files, app content — is stored in Supabase’s database and storage on your behalf. That makes Supabase a processor handling personal data, which you should disclose along with where data is hosted and how users can delete it.

Data typically processed

Data type	Details
Account & auth data	Email, password hash, or OAuth identity via Supabase Auth.
Database records	Profile and app data stored in Postgres.
Uploaded files	Images and documents in Supabase Storage.
Session tokens	JWTs used to keep users signed in.

What to disclose

That a third-party cloud backend stores your account, database, and file data.
The region where data is hosted and that it may be transferred internationally.
The categories of personal data you store (account, profile, uploads).
How users can request deletion of their account and data.
That you apply access controls so users can only reach their own data.

Example wording

Data Storage. We use a third-party cloud platform to host our database, authentication, and file storage. Your account information, the data you enter, and any files you upload are stored on this provider’s infrastructure and may be processed in other countries. We use access controls so that your data is only accessible to you and to authorised personnel. You can request deletion of your account and associated data at any time.

Sample language only — adapt it to your actual data practices.

Best practices

→ Turn on Row Level Security so each user can only access their own rows — a real privacy safeguard.
→ Pick and disclose your hosting region, especially for EU users (data residency).
→ Delete storage objects and auth records together when a user deletes their account.
→ Disclose any Supabase add-ons you enable (e.g., logging, third-party auth providers).

Generate a policy that already covers Supabase and host it at a permanent URL.

Host Your Policy

Frequently asked questions

Is Supabase a data processor?

Yes. When Supabase stores your users’ personal data on your behalf, it acts as a processor/sub-processor. Your policy should disclose that a third-party backend hosts user data.

Do I need to name Supabase in my policy?

Disclosing that a third-party cloud backend stores user data is what matters for GDPR/CCPA. Naming the specific provider is optional but fine.

Where is my users’ data stored?

Wherever you provisioned your Supabase project’s region. Disclose that region (and the possibility of international transfer) in your policy.

Related guides

This guide is for general informational purposes only and is not legal advice. Your privacy policy should reflect your actual data practices and applicable legal requirements, which vary by jurisdiction and platform.

Create and host your privacy policy

Fill out a short form, get a permanent HTTPS URL for your app submission.

Create My Privacy Policy