What we collect, why, and how to delete it.

The short version

Suparbase stores the absolute minimum required to do its job: your account, your saved Supabase connections, and an audit log of writes you perform. Your Supabase keys are AES-256-GCM encrypted before they ever touch a database row. They are never sent to a browser, never logged, and never read except inside a server-side proxy responding to one of your own requests.

What we collect

• Account: email address, hashed password (bcrypt), display name if you supplied one, and account creation / last-login timestamps. If you sign in via GitHub OAuth, we also store the OAuth provider id and avatar URL.
• Connections: the Supabase URL, hostname, role (derived from the JWT), and an AES-256-GCM ciphertext blob of the API key. Optionally a second ciphertext blob holding a direct Postgres connection string used by explicitly-invoked database tools such as the RLS debugger, SQL playground, session undo, reports, watches, health checks, and database sync.
• Audit log: per-write rows containing user id, connection id, schema name, table name, primary key, HTTP verb, status code, before/after row snapshots (when the upstream returned a representation), and a timestamp.
• AI usage: when you bring an OpenRouter key, we store an encrypted copy and the last-run token usage (prompt / completion / total). We do not retain conversation transcripts in the Suparbase database. Up to 50 conversations per connection are stored in your browser's local storage so you can reopen them on that device.
• Schema analysis cache: AI-generated table descriptions keyed by a SHA-256 fingerprint of your schema, so we don't spend tokens regenerating the same analysis.
• Operational data: the application and hosting layer may process request timestamps, IP addresses, paths, status codes, and user agents to operate, secure, and debug the service. The application's structured logger redacts JWT-shaped values and common credential fields.

What we don't collect

• A general-purpose copy of rows you read from your Supabase project. Routine reads are streamed through the proxy. When you make a change, however, the audit and undo features may store affected before-and-after row snapshots.
• Plaintext API keys, passwords, or Postgres URLs. The only persisted form is encrypted.
• Server-side AI chat transcripts. Local conversation history remains on the browser profile until you delete the conversation or clear the site's local storage.
• Full payment-card details. Checkout and payment management are handled by Dodo Payments.

How we use what we collect

• Your account exists so we can identify you across sessions.
• Connections exist so we can proxy your PostgREST / Storage / Auth-admin requests with the right key.
• The audit log exists so you can see who changed what, when, and (where captured) what changed.
• AI prompts, schema context, and aggregate results are sent to OpenRouter only when you use AI features. Row previews fetched by AI tools remain in the browser display and are excluded from the model payload.
• Operational logs exist so we can debug outages and detect abuse.

We do not sell or rent any of the above. We do not share it with third parties except as listed in Subprocessors below.

Subprocessors

The hosted service uses vendors in the following categories. Which optional vendors receive data depends on the features you enable:

• Application and Postgres hosting: to run Suparbase and store account, workspace, and audit data.
• Resend: to deliver verification, recovery, invitation, and service emails when email delivery is configured.
• Dodo Payments: to provide checkout, subscriptions, invoices, and the billing portal.
• OpenRouter: to process prompts and context when you choose to use AI features with your own API key.
• PostHog: optional product analytics, loaded only when the deployment operator configures a PostHog key. The integration respects Do Not Track and Global Privacy Control signals.
• GitHub: authentication data is exchanged with GitHub when you choose GitHub sign-in.

Dedicated-deployment customers choose the infrastructure and subprocessors covered by their agreement. Contact us for the current hosted-service vendor details needed for a procurement or data-processing review.

Encryption

Supabase keys and optional Postgres URLs are encrypted with AES-256-GCM using a key fromSUPARBASE_ENCRYPTION_KEY. The plaintext exists only as a request-scoped variable inside the server while it performs the operation you requested, then it's discarded.

Passwords (for email-and-password sign-ins) are hashed with bcrypt at cost 12. We never see your plaintext password and never email it to you.

Retention and deletion

• You can delete any connection from /connections at any time. Doing so removes the encrypted key and cascades to any audit rows referencing it.
• You can export your account, workspace configuration, audit history, and other associated records as JSON from account settings before deleting. Credentials, secret values, invitation tokens, and raw billing webhook payloads are excluded for security.
• Cancelling a hosted subscription does not delete your account. You may separately schedule account deletion in settings. That action signs you out and starts a 30-day grace period before permanent deletion; the UI provides a way to cancel the deletion during the grace period.

Cookies

We use strictly necessary authentication cookies to keep you signed in and, when enabled, remember a completed two-factor challenge for the current login session. If the deployment operator enables PostHog, it may use local storage and an analytics cookie; that integration is disabled for Do Not Track or Global Privacy Control signals. Hosted deployments must present any consent controls required by the law that applies to the visitor.

Children

Suparbase is not intended for users under 16. We don't knowingly collect data from anyone under 16. If you believe a child has signed up, email us and we'll delete the account.

Your rights

Depending on where you live (GDPR, CCPA, and similar regimes apply), you have the right to access, correct, port, or delete your data, and to lodge a complaint with a data protection authority. The account settings page and the contact email below are the fastest path for all of these.

Changes to this policy

We update this page when the answers above change. The Last updated date at the top is authoritative. Material changes will be announced via email.

Contact

For anything privacy-related, send a note via our contact form. For general support, same place.