Devhunt
- Your data trains their AI only if you opt in.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
You own your data; they won’t train AI on it without written consent, but ads tracking, and non-refundable auto-renew apply.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account info, GitHub login, uploads, device IDs, usage, IP-based location, and partner data.
Read the exact line
Privacy policy
“We collect personal and/or business information that you provide when you register for an account on the Site. This information may include your name, email address, and GitHub username.”
Training
They run the service, market to you, personalize ads, and send AI prompts to vendors—not to train models without consent.
Read the exact line
Terms of service
“Supabase will not use, nor allow any third-party to use, Customer Data, Customer's AI Input, or any AI Output to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model, without Customer's prior written consent.”
Sharing
Service vendors, affiliates, ad partners (hashed emails), and AI providers like OpenAI can receive data.
Read the exact line
Privacy policy
“We may share limited personal information, such as contact identifiers (including email addresses or cryptographic hashes of email addresses), with advertising and marketing partners to create, manage, and measure advertising audiences.”
Kept
They keep data as long as needed; contact info lasts about 60 days after you close the account.
Read the exact line
Privacy policy
“Contact information – if you have an account with us, we retain this for as long as you have an account on our services, and for 60 days after you close your account.”
Controls
You can edit account and content in the app, unsubscribe from marketing, and email them to .
Read the exact line
Privacy policy
“If you would like to request access to, or correction or deletion of personal information, you may send your request to us at the email provided below.”
Fine print
Auto-renewing non-refundable fees, you them.
Read the exact line
Terms of service
“Fees paid by Customer are non-refundable.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Cancel before auto-renewal
Give written notice of non-renewal at least 30 days before the term ends
or access
Email privacy@supabase.com
Unsubscribe from marketing emails
Click the unsubscribe link at the bottom of marketing emails
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If someone sues them over what you uploaded or typed into AI tools, you may have to pay their legal costs.
Read the exact line
Terms of service
“Customer shall , , and, at Supabase's option, defend Supabase from and against any Losses resulting from any Third-Party Claim that the Customer Data, AI Input or any use of the Customer Data”
For example, if a prompt you paste into their AI support bot includes someone else’s copyrighted code and they get sued, you could owe the legal bills.
Paid plans auto-renew and you generally cannot get money back once charged.
Read the exact line
Terms of service
“Fees paid by Customer are non-refundable. If Customer fails to make any payment when due, and Customer has not notified Supabase in writing within ten (10) days”
For example, if you forget to cancel 30 days before renewal, you still pay the next term with no refund.
They and ad partners can track you to show ads tailored to you.
Read the exact line
Privacy policy
“We may use tracking technologies to measure the effectiveness of our advertising campaigns and to help deliver personalized ads.”
For example, visiting the site after clicking a Google ad can be used to keep showing you Supabase ads.
What you type into their AI support tool is sent to outside AI companies to generate answers.
Read the exact line
Privacy policy
“We may share this information with the following service providers through the provision of the Service: OpenAI, LLC and its affiliates, Amazon Bedrock, Fly.io, and AWS.”
For example, a support question that includes a snippet of your schema can be processed by OpenAI.
They do not promise the product or AI answers will work, be accurate, or be error-free.
Read the exact line
Terms of service
“the Supabase IP is provided "as is" and Supabase hereby , whether express, implied, statutory, or otherwise.”
For example, if the AI support bot gives a wrong SQL snippet that breaks your app, they say they are not warranting that output.
Your project data and AI chats are not used to train models unless you agree in writing.
Read the exact line
Terms of service
“Supabase will not use, nor allow any third-party to use, Customer Data, Customer's AI Input, or any AI Output to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model, without Customer's prior written consent.”
For example, a bug report you paste into the chatbot should not become training data for OpenAI unless you separately consent.
You keep ownership of what you put in the service; they only get a license to run it.
Read the exact line
Terms of service
“Supabase acknowledges that, as between Supabase and Customer, Customer owns all right, title, and interest, including all intellectual property rights, in and to the Customer Data.”
For example, your database contents stay yours even while hosted on their platform.
They set a 13+ line but do not describe a real age check.
Read the exact line
Privacy policy
“Our services are not intended for children under the age of 13. We do not knowingly solicit or collect personal information from children under the age of 13.”
For example, a 12-year-old could still sign up with GitHub if nobody checks their age.
They say they use ordinary security measures but do not guarantee no breaches.
Read the exact line
Privacy policy
“Supabase cares about the security of your information and uses commercially reasonable physical, technical and organizational measures designed to preserve the integrity and security of all information we collect.”
For example, they store data on cloud servers and say they would investigate if those were hacked.
Words to know
Legal words from the lines above, in plain English.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- inputs and outputs
- Inputs are what you type, say or upload to an AI; outputs are what it gives back to you. For example, the question you ask a chatbot is an input and its answer is an output, and both may be stored.
- model training
- Using your content and conversations as examples to teach an AI system, which can then echo them in future answers. For example, a story you write in a chatbot may be studied by the company to make the next version of the bot.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- tracking pixels
- Tiny invisible images or bits of code in a page, app or email that report back when and where you opened it. For example, a pixel in a marketing email tells the sender the moment you read it.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- as is
- You get the service in whatever state it is in, with no promise that it works or will keep working. For example, if the app deletes your photos by mistake, it is not promising to fix that or pay you back.
How we got here · grade B · score 51/100 · 15 of 15 policy answers backed by a verified quote · 2 not stated
What does the app collect beyond what it needs to work?
They collect account and GitHub details, uploads, payments via Stripe, plus device IDs, IP, usage, cookies, and approximate location.
Does it record your voice, face or body, and what happens to that?
The documents do not describe collecting voice, face, or body data as a product feature.
Are your chats and uploads used to train AI models, and is that off by default?
They say they will not train models on customer data, AI inputs, or outputs unless you give prior written consent.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use tracking tools and share hashed emails with ad partners to measure and deliver personalized ads.
Do they sell or share your data, and can you opt out?
They say they do not sell under Nevada law, but share identifiers with ad partners and many vendors; cookie and marketing consents are mentioned.
What rights do they take over what you type and what the AI makes?
You own customer data. They get a license to run the service, plus a perpetual license only for anonymized aggregated data.
How long do they keep your data after you delete it, and can you delete it in the app?
You can edit some content in the product, but deletion of personal information is by email request and they do not promise to fulfill it. Contact data is kept 60 days after close.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe commercially reasonable physical, technical, and organizational security measures, without naming audits.
Is there a real age gate, and are teens protected?
The service is not intended for children under 13; they do not describe age verification.
Will they tell you when the rules change, and is the policy specific?
They say they will notify of material privacy changes and update a last-modified date, but these copies have no date.
Can they close your account without warning, and can you get your data out first?
They terminate with written notice for unpaid bills or breach, and you can export customer data through the product.
If something goes wrong, who pays?
The service is as-is, liability is capped at about a year of fees, and you must indemnify them for claims about your data and AI inputs.
Do subscriptions renew on their own, and can you get a refund?
Subscriptions auto-renew unless you give 30 days’ written notice, and fees are non-refundable.
The privacy policy is 7,919 words at a professional or legal expert level (Flesch reading ease 29); the terms are 7,903 words at a professional or legal expert level.
