Privacy
Supapad has no server. Nothing you do in the app is sent to us, because there is nowhere for it to go.
What the app stores, and where
When you connect your Supabase account, Supapad reads information about your organizations and projects from Supabase’s Management API. That includes project names and regions, service health, logs, advisor findings, and, only if you open the Database tab and allow it, the schema and query results you ask for.
All of it is stored in a database on your Mac, inside Supapad’s own container. You choose how long local history is kept, from 7 to 365 days (90 by default), and you can clear it at any time in Settings.
Sign-in and credentials
- You sign in on Supabase’s own page, in a secure sign-in window from macOS, using OAuth with PKCE. Supapad never sees your Supabase password.
- The access and refresh tokens Supabase issues are kept in the macOS Keychain.
- Supapad asks for read-only access. Database access is a separate permission, requested only when you first open the Database tab.
- Signing out deletes the tokens from your Keychain. You can also choose to delete the local history.
Network connections
Your project data is exchanged only with api.supabase.com. Supapad doesn’t send your data to Apps by SAHARA or to anyone else. Supabase’s handling of your data is covered by Supabase’s privacy policy.
Analytics, tracking and advertising
None. The app contains no analytics, no telemetry, no advertising identifiers and no third-party tracking code.
Diagnostics
If something goes wrong, Settings can gather recent API errors and crash reports into a file for you. Nothing is sent automatically. You decide whether to share the file, for example by attaching it to an email to support.
Purchases
Purchases are handled by Apple through the Mac App Store. We don’t receive your payment details.
This website
supapad.app uses Google Analytics to count visits and see which pages are read. Google sets cookies for this and receives your IP address (shortened) and details of your browser and visit. Google’s handling of that data is described in Google’s privacy policy; you can opt out with the Google Analytics opt-out add-on or by blocking the script. Nothing you do in the Supapad app is ever sent here. supapad.app also loads OpenAI’s ChatGPT Ads measurement pixel, which tells OpenAI when a visit followed an ad shown in ChatGPT. The pixel script is served by OpenAI, receives details of your browser and visit, and sets a first-party __oppref cookie to remember the ad click identifier from the landing page. OpenAI’s handling of that data is described in OpenAI’s privacy policy; you can opt out by blocking the script. Fonts and Supapad’s own scripts are served from this site. The site is hosted on Cloudflare, which processes standard request information such as IP addresses to deliver and protect it. Your appearance choice (light, dark or auto) is saved in your browser’s local storage and never leaves your device.
Children
Supapad is a tool for software developers and isn’t directed at children.
Changes
If this policy changes, the new version will appear on this page with a new date. If a change affects how your data is handled, the app will tell you before it takes effect.
Contact
Questions about privacy: support@appsbysahara.com. Supapad is made by Apps by SAHARA.