Privacy Policy & Terms of Service for Pocket Studio (unofficial for Supabase)

Last Updated and
Effective Date:
November 5, 2026

This Privacy Policy describes how Pocket Studio (unofficial for Supabase) ("We", "Us", "Our", or the "Company") collects, processes, uses, and protects your personal data when you use our mobile application and related services.

We are committed to protecting your privacy in strict accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, the Information Technology Act, 2000, and Google Play Data Safety guidelines.

🔒 Core Guarantee: Your Supabase Data Stays On-Device

Pocket Studio has no user accounts and no database of ours. The only service we run is a small sign-in relay for "Connect with Supabase", which passes tokens through without storing or logging them. We do not collect, store, sell or share your Supabase access token, your project keys, your project data, your SQL queries or any personal information. The app talks directly from your phone to Supabase, at your request, and your token stays in the Android Keystore on your device. Pocket Studio has no analytics or crash-reporting SDKs. The optional AI assistant, if you turn it on, sends your questions and your table and column names (never row data) from your phone straight to the AI provider you pick, using your own key. Pocket Studio shows no ads and contains no advertising or tracking SDKs. Pocket Studio is not affiliated with, endorsed by or sponsored by Supabase Inc.

1. Roles Under the DPDP Act, 2023

►
Data Fiduciary: Under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, the developer (Tanay Anand Mishra) is the Data Fiduciary only for personal data that actually reaches the developer, which in practice is an email you choose to send us. Data the app keeps on your phone (your token, preferences and recent SQL statements) is never sent to the developer and stays under your control. Your project data is held by Supabase under your own agreement with it. We process any personal data we receive only for the purpose stated in this policy, keep it accurate, protect it with reasonable security safeguards, delete it when it is no longer needed or when you withdraw consent, and will notify you and the Data Protection Board of India if a personal data breach affecting you occurs.
►
Data Principal: You are the Data Principal. You have the right to: get a summary of the personal data we hold about you and how it is used; correct, complete, update or erase it; withdraw consent at any time, as easily as you gave it (by signing out, clearing the app's storage, uninstalling, or emailing us); have a grievance resolved by the Grievance Officer named in this policy; nominate another person to exercise these rights if you die or become incapable; and complain to the Data Protection Board of India. Pocket Studio is intended for adults (18+) and is not offered to children as defined in the DPDP Act.

2. Notice of Itemized Data Collection (Section 5, DPDP Act)

We collect and process the following specific categories of personal data with your explicit consent:

A. Supabase Access Token & Account Label

►
What is collected: The personal access token you paste or paste-detect during sign-in (or the access and refresh tokens from "Connect with Supabase"), and a display label for the account (for example your organization name).
►
Purpose: To call the Supabase Management API on your behalf. The token is stored only in Android's encrypted, Keystore-backed storage on your device and is sent only to api.supabase.com. If you used "Connect with Supabase", the refresh token that renews it is also sent to our sign-in relay, which passes it to Supabase without storing it. It is never sent to the developer or anyone else. Signing out or removing an account deletes it.

B. Project Keys & Project Data (in memory only)

►
What is collected: Project API keys (including the secret service_role key when your token has the API Key Secrets permission; that key has full access to its project), table rows, SQL results, auth users, storage files, logs, and organization information that Supabase returns to you (for example your organization's name, plan, member list and the features your plan includes).
►
Purpose: To display and, if you choose, change your data. Keys are held in memory while you use a project and sent only to that project's own supabase.co address; organization and project information is requested from api.supabase.com. None of this data is transmitted to us or stored by us.

C. Connect with Supabase (OAuth sign-in relay)

►
What is collected: When you tap "Connect with Supabase", Supabase's own consent page opens in your phone's browser. After you tap Authorize, Supabase sends a one-time sign-in code to our relay page (privacypolicies-beta.vercel.app, hosted on Vercel), which hands it straight back to the app. The app then sends that code, and later its refresh token, to the relay, which adds our OAuth client secret and asks Supabase for access tokens.
►
Purpose: To sign you in without copying a token. OAuth requires a secret that must not be shipped inside an app, so this one small step runs on a server. The relay only forwards each request to api.supabase.com and returns the answer: it does not store, log or look at your tokens, project data or password, and it has no database. Vercel, as our hosting provider, may keep standard request logs (time, IP address, path) under its own policy. You can revoke Pocket DB's access any time in your Supabase organization settings under OAuth Apps.

D. Supabase Sign-in (Open Supabase)

►
What is collected: When you tap "Open Supabase", supabase.com opens in your phone's browser (a Chrome Custom Tab). You sign in and create an access token there, then copy it and return to the app.
►
Purpose: To let you create a scoped access token on Supabase's own website. Your password, email and Supabase session stay in your browser; Pocket Studio cannot see or read them. Pocket Studio only receives the token you copy or paste, which is handled like any other (Keystore storage, sent only to api.supabase.com). You can delete the token in the Supabase dashboard at any time.

E. Clipboard Text (only to spot a token)

►
What is collected: Text on your clipboard, read once when you return to the app after tapping "Open Supabase", or when you tap Paste.
►
Purpose: To recognise a copied access token so you can connect with one tap. The text is not stored, logged or sent anywhere. If it still holds your token after a successful sign-in, the app clears it.

F. On-Device Preferences & Query History

►
What is collected: Theme, interface style (Easy or Advanced), read-only mode, app-lock setting, onboarding status and the date you accepted the terms, your chosen free-plan project, project IDs you add manually, your 30 most recent SQL statements, and queries you save by name for a project.
►
Purpose: To remember your settings and give you query history. Stored locally in the app's private storage and removed when you clear the app's data or uninstall. App backup is disabled. SQL history and saved queries may contain values you typed into queries.

G. Files You Choose (Upload / Download)

►
What is collected: A file or photo you select with the Android file picker, photo library or camera, a CSV file you choose to import into a table, a file you download, or a CSV/JSON export of table rows or query results that you create.
►
Purpose: Uploads go directly to your own Supabase Storage, and an imported CSV is read on your device and sent only as insert statements to your own project. Downloads and exports are written to temporary app storage so Android's share sheet can hand them to the app you choose. We never receive these files, and what the receiving app does with them is governed by that app.

H. Support and Feature-Request Emails

►
What is collected: When you tap "Request a feature" or "Send feedback" in Settings, the app opens your own email app with a message addressed to the developer. It may pre-fill the app version and whether Pro is active; you can edit or delete anything before sending.
►
Purpose: To let you contact the developer. Nothing is sent unless you press send in your email app. If you send an email, we receive your email address and what you wrote, use it only to reply and improve the app, and keep it for up to 2 years after our last exchange (or delete it sooner on request).

I. Self-Hosted Supabase (optional, Pro, Beta)

►
What is collected: If you add a self-hosted instance: its name, its web address, and the service_role and anon keys you paste.
►
Purpose: To connect to your own Supabase server. The keys are stored encrypted in the Android Keystore on your device and are sent only to the address you typed in, never to the developer or anyone else. Use https:// (plain http:// is accepted only on local networks). Removing the instance deletes its keys from your device.

J. Realtime Inspector (optional)

►
What is collected: The channel name you type and the broadcast, presence and database-change messages that your own project sends back.
►
Purpose: To show live messages from your project's Realtime service. The connection goes from your phone straight to your project's own supabase.co address with its API key held in memory only. Messages are shown on screen and are not stored or sent to us.

K. AI Assistant (optional, Pro, your own key)

►
What is collected: If you turn on the AI assistant: the API key you paste from an AI provider (Anthropic, OpenAI or Google, your choice), the provider and model name, the questions you type, the table and column names of the project you ask about (names, types, keys and foreign keys, never row data), and the answers you get back.
►
Purpose: To turn your plain-language question into suggested SQL. Your key is stored encrypted in the Android Keystore on your device and is sent only to the AI provider you chose, as the credential for your own account. Each question, the schema names and the recent chat are sent from your phone directly to that provider, which processes them under its own terms and privacy policy and bills you under your own agreement with it. Nothing goes through the developer. Suggested SQL runs only when you tap it, and changes need your approval and respect read-only mode. Results are shown on your device and are not sent to the AI provider. Remove the key in Settings > AI assistant at any time.

L. Alerts (optional, Pro)

►
What is collected: If you turn on Alerts: which projects you chose to watch, which warnings are on, and the time each warning was last shown. When a check runs, the app reads each chosen project's status, database connection count, database size, recent error count and your organization's plan.
►
Purpose: To show warning notifications on your phone (for example when a project is paused). The app checks about every 15 minutes in the background, using your stored token, and talks only to api.supabase.com and your project's supabase.co address. Nothing is sent to the developer or any third party. Notifications are shown on your device by Android. Turn Alerts off in Settings > Alerts to stop all background checks. Android may delay or skip checks to save battery, so Alerts are a convenience and not a guarantee.

M. Home-Screen Widget (optional)

►
What is collected: A small picture of your project's name and 24-hour usage counts (requests per service), saved in the app's private storage after you open a project.
►
Purpose: To show recent usage on your home screen without opening the app. The picture stays on your device, contains no token, key or row data, and is removed when you remove the widget data by clearing the app's storage or uninstalling.

N. Purchase Status

►
What is collected: Whether Pocket Studio Pro is active (a local flag) and purchase confirmations from Google Play.
►
Purpose: To unlock Pro features. Payment is handled entirely by Google Play. We never see your card or payment details.

Device Permissions & Justifications

To provide its advertised features, this app may request specific operating system permissions. The permissions it uses and their purposes are listed below:

android.permission.INTERNET
Connects to Supabase (api.supabase.com and your project's supabase.co address, or a self-hosted address you add), to Google Play for purchases, and to the AI provider you choose if you turn on the AI assistant.
android.permission.USE_BIOMETRIC
Optional app lock, and the check before API keys are shown. Authentication is performed by Android; Pocket Studio never receives your fingerprint or face data.
android.permission.POST_NOTIFICATIONS
Optional. Lets Pocket Studio show Alerts notifications if you turn Alerts on. You can refuse or revoke it in Android Settings.
android.permission.WAKE_LOCK / FOREGROUND_SERVICE / ACCESS_NETWORK_STATE / RECEIVE_BOOT_COMPLETED / VIBRATE
Added by Android's WorkManager and notification libraries so the optional Alerts check can run in the background, see whether the network is available, resume after the phone restarts and show a notification. They are not used when Alerts are off.
Play Billing (com.android.vending.BILLING)
Added by Google Play Billing so you can buy Pocket Studio Pro. Handled by Google Play.

3. Consent & Right to Withdraw Consent (Section 6, DPDP Act)

Pocket Studio only acts when you tell it to: you decide when to connect, which project to open and what to change. Clipboard text is read only on the sign-in screen after you return from Supabase or tap Paste.

Right to Withdraw Consent (Section 6(4))

You have the absolute right to withdraw your consent at any time. You can withdraw consent by:

►
Sign out in Settings, or remove a single account from the account menu, to delete the stored token from your device.
►
Revoke the access token itself in the Supabase dashboard under Account → Access Tokens. This is the strongest option and takes effect immediately.
►
Turn on read-only mode in Settings to block every action that changes data.
►
Turn off Alerts in Settings > Alerts to stop background checks and notifications.
►
Remove your AI key in Settings > AI assistant to stop all AI requests; delete the key in your AI provider account to revoke it.
►
Remove a self-hosted instance from the project list to delete its keys from your device.
►
Clear the app's storage in Android Settings, or uninstall Pocket Studio, to erase everything it stored on your device.

Because all data lives on your device, deletion happens instantly when you sign out, clear storage or uninstall. We keep no external copy.

4. Right to Erasure / Account Deletion (Section 12(3), DPDP Act & Google Play)

Pocket Studio has no user accounts and keeps no server-side records, so there is nothing for us to delete on a server. You can remove everything the app holds on your device at any time.

►
In-App Deletion: Open Pocket Studio → Settings → Sign out. This removes every saved access token and signs you out. To also remove preferences and query history, clear the app's storage in Android Settings → Apps → Pocket DB → Storage, or uninstall the app.
►
Manual Deletion: To erase data held in your Supabase projects, use Supabase itself (your data lives there, not with us). To stop Pocket Studio from accessing your account, delete its access token in the Supabase dashboard (Account → Access Tokens). If you have a question about your data, email tanayanandmishra@gmail.com with the subject "Pocket Studio Privacy Inquiry".

5. Third-Party Data Processors & Disclosure (Section 8 & Section 16)

We do not sell your personal data. We disclose your data only to the following vetted Data Processors who process data on our behalf under strict security obligations (Section 8(5)):

Data ProcessorService ProvidedData Shared
Vercel (hosting for the sign-in relay)
Your chosen AI provider (only if you use the AI assistant)

In the event of any data breach impacting your personal data, we will promptly notify both you and the Data Protection Board of India (DPBI) in compliance with Section 8(6) of the DPDP Act.

6. Data Security & Storage (Section 8(5))

Your access token is stored in Android's encrypted, hardware-backed Keystore storage where available. Traffic uses HTTPS, and Supabase requests go only to official Supabase domains (or a self-hosted address you add yourself). Viewing API keys requires your phone's screen lock (fingerprint, face or PIN), and screenshots and screen recording are blocked on the API Keys screen, and app backup and cleartext traffic are disabled. Read-only mode and typed confirmations help prevent accidental changes. Treat your personal access token like a password: create a dedicated, scoped token for Pocket Studio, set an expiry, and revoke it in the Supabase dashboard if you lose your device or stop using the app. Anyone holding the token can act on your Supabase account within its permissions.

7. Children's Privacy

Pocket Studio is a developer tool intended for people aged 18 and over and is not directed to children. We do not knowingly collect information from children; if you believe a child has sent us information, email tanayanandmishra@gmail.com and we will delete it.

8. Developer Contact & DPDP Act Compliance (Section 8(9) & Section 13)

In compliance with Section 8(9) and Section 13 of the Digital Personal Data Protection Act, 2023, the contact details of the Developer are published below:

►
Name: Tanay Anand Mishra
►
Role: Solo Developer & Grievance Officer
►
►
Address: Uttar Pradesh, India
►
Response Timeline: Email the developer with the subject "Pocket Studio Privacy Inquiry" for any question, complaint or request about this Privacy Policy or your data, including requests to access, correct or erase personal data, to withdraw consent, or to nominate someone to exercise your rights. Requests are acknowledged within 48 hours and resolved within 30 days, and never later than 90 days (the maximum allowed under India's DPDP Rules, 2025). If you are not satisfied with our response, you may complain to the Data Protection Board of India, or to your local data-protection authority.

Right to Approach the Data Protection Board (Section 13(3))

If your inquiry or grievance is not resolved to your satisfaction by the Developer, you have the statutory right to file a formal complaint with the Data Protection Board of India (DPBI).

9. Changes to this Privacy Policy

If Pocket Studio's data practices ever change (for example, adding analytics, ads or a server), this policy and the Google Play Data safety section will be updated before the change ships, and the date above will change.

10. European Union (GDPR) & California (CCPA) Privacy Rights

►
GDPR Legal Basis: Controller and contact: Tanay Anand Mishra, Uttar Pradesh, India, tanayanandmishra@gmail.com. What we process and why (Articles 6 and 13 GDPR): (1) Emails you send us: to answer you and improve the app; legal basis legitimate interests (Art. 6(1)(f)), or steps you ask for before or under a contract (Art. 6(1)(b)); kept for up to 2 years after our last exchange, or deleted sooner on request. (2) In-app purchases: to unlock Pro; legal basis contract (Art. 6(1)(b)); payment is processed by Google Play as an independent controller, and we receive only whether a purchase is valid. The app's own on-device data (token, preferences, query history) is not sent to us, so we do not process it. Supabase, the AI provider you choose and Google Play receive data directly from your device under your own agreements with them. International transfers: emails you send us are processed in India, which has no EU adequacy decision; we transfer them only as needed to reply to you (Art. 49(1)(b)). Providing data: you are not required by law or contract to give us any personal data; without it you can still use every feature except contacting us by email. We do no automated decision-making or profiling ourselves (Art. 22). Your rights: access, rectification, erasure, restriction, objection (including to legitimate-interest processing), data portability, and to withdraw any consent at any time without affecting earlier processing, by emailing us. The app contains no ads, analytics or tracking SDKs. You may complain to the supervisory authority where you live or work (in the UK, the ICO). We answer requests within one month.
►
CCPA "Do Not Sell or Share My Personal Information": Notice for residents of California and other US states with consumer privacy laws. The developer does not sell or share personal information, and the app contains no ads, analytics or tracking SDKs, so no personal information is used for targeted or cross-context behavioural advertising. The app itself does not send us personal information; data it keeps stays on your device. If you email us, we receive identifiers (your email address) and the content you write, use them only to reply and improve the app, and keep them for up to 2 years after our last exchange. We do not collect sensitive personal information: your Supabase access token never leaves your device except to go to Supabase. You may request to know, access, correct or delete personal information we hold by emailing tanayanandmishra@gmail.com with the subject "Pocket Studio Privacy Inquiry"; an authorised agent may do this for you with your written permission. We verify requests by matching the email address you used to contact us, respond within 45 days, and will not discriminate against you for using these rights.
Statutory Legal Agreement

Part II: Terms of Service for Pocket Studio (unofficial for Supabase)

Effective Date: November 5, 2026 | Last Updated: November 5, 2026

ToS 1. Agreement

By installing or using Pocket Studio (the "App") you agree to these Terms. If you do not agree, do not use the App. The App is provided by Tanay Anand Mishra, India ("we", "us").

ToS 2. Independent App, Not Affiliated With Supabase

Pocket Studio is an independent product. It is not affiliated with, endorsed by or sponsored by Supabase Inc. "Supabase" and the Supabase logo are trademarks of Supabase Inc. and are used here only to say that Pocket Studio works with Supabase's services. Pocket Studio does not use the Supabase logo. Your use of Supabase services is governed by your own agreement with Supabase.

ToS 3. What the App Does

The App lets you view and, with the right permissions and (for some features) a Pro purchase, change data in your own Supabase projects, using an access token you provide. It can also show charts and usage, import and export table data, and, if you turn it on, send you notifications about your projects. It runs on your device and connects directly to Supabase.

ToS 4. Your Responsibilities

• You are responsible for the token you enter and for everything done with it. Use a dedicated, scoped token and revoke it when you no longer need it. • Changes you make (editing rows, running SQL, uploading, deleting, pausing a project) can be permanent and can break production systems. Use read-only mode, test environments and backups. • Only access projects you are authorized to manage. • Do not use the App to break the law or violate Supabase's terms.

ToS 5. Pocket Studio Pro, Purchases and Subscriptions

• Pro is offered through Google Play as a one-time Lifetime purchase and an auto-renewing Monthly subscription. Prices are shown in the App and in Google Play and may vary by country. • Pocket Studio only, not Supabase: purchases are for the Pocket Studio app only. They are not purchases from, or payments to, Supabase Inc., and they do not change, upgrade or pay for any Supabase plan, project, usage or billing. Your Supabase subscription and invoices are separate. • Free trial: the Monthly plan may include a 7-day free trial for eligible users (Google Play decides eligibility, normally once per Google account). You are not charged during the trial. If you do not cancel at least 24 hours before it ends, the monthly price is charged automatically and the subscription renews every month. Cancel any time in Google Play → Payments & subscriptions → Subscriptions; cancelling during the trial costs nothing. Lifetime has no trial. • Lifetime unlocks Pro for as long as the App is offered and supported on your device. • Uninstalling the App does not cancel a subscription. • Refunds are handled by Google Play under its policies; you may also email us and we will consider a request in good faith. • We never receive your payment details.

ToS 6. Alerts and Monitoring

Alerts are an optional Pro convenience. They depend on Android running background work, on your network and on Supabase's APIs, so a warning can be late or missing. Do not rely on Alerts as your only monitoring, uptime or incident system. Importing data (for example a CSV file) adds rows to your own project and can be permanent; check the preview and keep backups.

ToS 7. AI Assistant

The AI assistant is optional and works only with an API key you add from an AI provider; you pay that provider under your own agreement with it. AI answers can be wrong or incomplete. Suggested SQL is never run for you: review it, test it on a safe copy first and keep backups. You are responsible for what you run and for the cost of your AI account. Do not enter personal or confidential information into questions that you are not allowed to share with the provider you chose.

ToS 8. Free Plan

The free plan includes one project of your choice (changeable once every 7 days), read-only queries, browsing tables, storage and logs, and viewing API keys. Free-plan limits and the list of Pro features may change over time.

ToS 9. Availability and Third-Party Services

The App depends on services we do not control, including the Supabase APIs and Google Play. They may change or stop working in ways that affect the App. We may update, modify or discontinue features, and we do not guarantee uninterrupted or error-free operation.

ToS 10. No Warranty

THE APP IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING FITNESS FOR A PARTICULAR PURPOSE, ACCURACY AND NON-INFRINGEMENT. We do not warrant that the App will prevent data loss, that displayed data is complete or current, or that any operation will succeed.

ToS 11. Limitation of Liability

To the maximum extent permitted by law, we are not liable for indirect, incidental, special, consequential or punitive damages, or for loss of data, profits, revenue or business, arising from your use of the App, including data loss or outages caused by changes you make or by Supabase's services. Our total liability for any claim is limited to the amount you paid us for the App in the 12 months before the claim. Nothing here limits liability that cannot be limited by law, including your statutory consumer rights.

ToS 12. Intellectual Property

The App, its design and its code are owned by us or our licensors. We grant you a personal, non-exclusive, non-transferable, revocable licence to use the App on your devices. You may not copy, reverse engineer (except where law allows), resell or redistribute it. Your data stays yours.

ToS 13. Termination

You can stop using the App at any time by uninstalling it. We may suspend or end access if you breach these Terms or abuse the App. Provisions that by nature should survive (disclaimers, liability limits, intellectual property) survive termination.

ToS 14. Changes, Governing Law and Contact

We may update these Terms; the date above shows the latest version, and continued use after an update means you accept it. These Terms are governed by the laws of India and disputes are subject to the courts of Uttar Pradesh, India, except where mandatory consumer law gives you the right to use your local courts. Questions or feature requests: tanayanandmishra@gmail.com.