Supabase stores user data on infrastructure operated by Supabase, Inc. If Supabase is your backend, user data leaves the device and sits with a third-party processor, which your privacy policy must disclose. Generate a full privacy policy with this clause built in →
Does Supabase need a privacy policy disclosure?
Supabase is a backend-as-a-service: a hosted PostgreSQL database plus Auth, Storage, Realtime, and Edge Functions. Unlike an analytics SDK, Supabase does not decide what data to collect — you do. Whatever your app writes (profiles, messages, uploads) is stored in your Supabase project, plus whatever Supabase Auth needs to sign users in, plus platform logs.
This is a transfer of personal data to a third party, so disclose it. Supabase acts as a data processor (a subprocessor where your own customer is the controller) and offers a Data Processing Addendum. Supabase is self-hostable, and hosted projects deploy to a single primary region that you choose, including EU regions. Supabase is not an advertising SDK and does not track users across apps — this is "App Functionality" only, never "tracking" under Apple's ATT rules or Guideline 5.1.2.
What data does Supabase collect?
| Data type | Purpose | Linked to the user? | Used for tracking? |
|---|---|---|---|
| Supabase Auth account data: email address, phone number, hashed password, OAuth identity data (provider, provider user ID, name, avatar from Google / Apple / etc.) | Authenticate the user | Yes | No |
| Auth session data: access and refresh tokens, last sign-in timestamp, sign-up and confirmation state | Maintain login sessions | Yes | No |
| IP address and device user-agent | Security, rate limiting, audit logging | Yes (in the auth audit log) | No |
| Any application data your app stores in Postgres or Storage (profile fields, user content, files) | Whatever your app does | Depends on your schema | No |
| Platform and Edge Function logs (request metadata, IP, errors) | Operations and debugging | Potentially | No |
The real list is defined by your database schema and which Auth providers you enable. Supabase only mandates the Auth and logging rows; everything else is your design, so review your own tables before completing any store form.
Copy-paste privacy policy clause for Supabase
Backend and authentication (Supabase)
This app uses Supabase, provided by Supabase, Inc., as its backend
database and authentication provider. Account information you provide
(such as your email address, phone number, and password, or the profile
data returned by a social login provider you choose) is processed by
Supabase Auth to create and secure your account. Supabase also processes
session tokens, your IP address, and device user-agent for security and
audit logging, and it stores any additional data this app saves to its
database or file storage on your behalf. Supabase hosts this data in a
single region that we have selected and processes it solely as our data
processor under its Data Processing Addendum; Supabase does not use it for
its own purposes and does not sell it. See Supabase's privacy policy at
https://supabase.com/privacy and its DPA at
https://supabase.com/legal/dpa.Adapt this: list the specific data your tables hold (this clause covers only Auth and logs), name the login providers you enable, and state your data region. Because Supabase stores account records, give users a way to erase them — build one with the account deletion page generator.
App Store "App Privacy" label answers
Supabase does not publish an Apple privacy label for you, because the collection is app-specific. Declare, at minimum:
- Contact Info > Email Address, Phone Number — purpose "App Functionality" (account). Linked to the user: Yes. Used to track you: No.
- Identifiers > User ID — the Supabase auth UUID. Purpose "App Functionality". Linked: Yes. Used to track you: No.
- User Content > Photos or Videos / Other User Content — whatever users upload to Storage. Purpose "App Functionality". Linked: Yes. Used to track you: No.
- Diagnostics > Crash Data / Other Diagnostic Data — only if you log diagnostics to Supabase.
- Any other category your schema stores (Health, Financial Info, Location, etc.) — you must declare based on your own tables.
The Supabase client libraries (supabase-js, supabase-swift) ship a privacy manifest declaring no tracking.
Google Play Data Safety answers
For the Play Console Data safety form:
- Personal info > Email address, Phone number, Name, User IDs — Collected: Yes. Shared: No (Supabase is a service provider processing on your behalf). Purpose: Account management, App functionality.
- App activity / Files and docs / Photos and videos — per your schema. Collected: Yes. Shared: No. Purpose: App functionality.
- Device or other IDs / App info and performance — IP and logs. Collected: Yes. Shared: No. Purpose: Fraud prevention and security, App functionality.
- Data is not processed ephemerally. Users can request deletion: Yes — support account deletion (for example the Supabase admin
deleteUserAPI) and honor requests to purge their rows.
Supabase-specific gotchas
- You define the collection. This clause and table cover only Auth and logs. Every custom table you create adds data types you must disclose yourself.
- Region choice is a location control, not compliance. Picking an EU region keeps the primary database in the EU, but backups, logs, Edge Functions, and subprocessors can still move data — and the "Europe" grouping includes London and Zurich, which are outside the EU.
- Auth audit logs keep IP addresses. Sign-in events store IP and user-agent even if your app never asks for them.
- Social logins pull extra fields. Google, Apple, GitHub, and others return name and avatar into
auth.identities; disclose the providers you turn on. - Self-hosting shifts the roles. If you run Supabase yourself, you are the sole controller and processor — the "Supabase as processor" wording no longer applies.
- Deletion must be real. Deleting an auth user does not automatically delete rows in your own tables that reference their ID; wire up cascading deletion.
- You are responsible for the accuracy of your disclosures and for signing the DPA if your regulator requires it. This clause is a template, not legal advice.
Related
See the sibling clauses for RevenueCat, Stripe, Superwall, and Google Sign-In. Build the full document with the privacy policy page generator, add an erasure flow with the account deletion page generator, and see the Firebase privacy policy guide if your app also uses Firebase.