When would Supabase fit your app?
Imagine you’re building a private journal with photos. You need the entries to come back after someone closes the page, and each person should see only their own work. Supabase gives you a database, sign-in and file storage in one project. You still build the journal screen and decide who can open or change an entry.
Supabase uses PostgreSQL, often called Postgres. In a table of journal entries, each row could hold an entry’s text, date and owner. The original photo lives in file storage. The entry can point to it.
Which service handles each part of the journal?
If the journal starts with text alone, set up entries and sign-in first. Connect file uploads when you add an attachment field.
| You want to | Use | Decide or configure |
|---|---|---|
| Save an entry | Postgres | The fields to keep and who may read or change them. |
| Recognize a returning reader | Auth | How they sign in and where an email link sends them back. |
| Attach a photo | Storage | Who may open the photo and what file sizes to allow. |
On a small screen, scroll the table sideways to read every column.
Can you save one entry and open it again?
Use a separate project with made-up entries so you can get the journal working without touching anyone’s real information.
In the dashboard, create the project, choose where it will run and make a table with the entry text and its owner. If your coding agent writes SQL, the language used to work with database tables, ask it to show you which fields it created and which access rules it set.
Use the project address and publishable key to connect the test app. A person signs in separately to establish their identity. A secret key can bypass the access rules and belongs only in code running away from the browser.
If people will sign in by email, set up a test email sender for inboxes you control before requesting a link. Supabase’s default hosted sender only delivers to project team addresses.
Sign in as an ordinary test user with permission to save their own entry. Save one, then close the page and open it again. Check that the entry is still there.
Can one signed-in person open someone else’s entry?
Supabase calls its per-record rules Row Level Security, or RLS. Set a rule for each action your journal allows. Someone who can sign in should be able to read and edit their own entry without getting access to anybody else’s.
If your coding agent sets up the database, ask it to show you that RLS is on and which users can access the table. Test through ordinary signed-in sessions. An administrator or a secret key can get a result your customers should never receive.
Set access rules for photos in Storage as well. With an account that should have no access, try to open the original image through the app. A private journal entry should not leave its attachment exposed.
| Attempt | Expected result |
|---|---|
| Account A opens its own entry | The saved entry appears. |
| Account B requests that same entry | The app returns no private entry. |
| Account B tries to edit it | Account A’s saved text stays the same. |
- Row Level Security in Supabase for Vibe-Coded AppsUnderstand the rules behind private records and check them through normal signed-in accounts.
Would a restored entry bring back its photo?
Supabase database backups can restore information about the photo. The image itself is stored separately and won’t come back with the database backup.
Paid hosted plans include daily database backups, with retention that varies by plan. Supabase advises Free projects to make database exports and keep copies elsewhere. Decide how you’ll keep copies of original uploads as well. In a test restore, open an entry as its owner and check that the original image actually loads.
What does Supabase cost once people use the app?
The hosted Free plan is US$0 per month. Pro starts at US$25 per month per organization, the account that holds your projects.
Check the bill for what you plan to run. A journal with lots of photos may use more file space and send more data to readers than a journal with text alone. A separate app host or email service has its own terms and charges.
| Cost area | What affects it |
|---|---|
| Free plan | Projects may pause after a week without activity. Check the allowed number of active projects and the usage limits. |
| Pro plan | The included compute credit covers one project at the Micro database size. Extra projects or more processing and memory can add to the bill. |
| Usage | Check signed-in activity, database and file space, and data sent to visitors. Confirm what happens when you pass an allowance and whether the account permits extra charges. |
What would you need to move to another service?
You can export the database, then check that its tables, records and permissions work in the new place. Plan a separate transfer for original images, sign-in settings and anything else the journal calls.
Before closing the old project, try the new one with a copy. Can a test user sign in, open an old entry, and load the photo that belongs to it? That is a better check than a successful database import on its own.
You can also run Supabase on infrastructure you arrange. You then handle updates, security, monitoring and recovery. Compare what your setup can run with any hosted features you already use.
When would you add live updates or private server code?
If you turn the journal into a shared workspace, Realtime can show new entries without asking everyone to reload the page. Decide which changes each person may receive before enabling that behavior.
Edge Functions can run your app’s code outside the visitor’s browser. That can be useful for an action that needs a private credential, such as calling a separate service. Give that action its own permission checks.
Where can you learn the next steps?
- Supabase From Scratch for Auth, Database, and File StorageBuild a private profile and avatar, then check access with a second account.