Privacy policy

Last updated: July 2, 2026

Overview

SupaDownload helps you export SQL backups from Supabase PostgreSQL databases. This policy explains what we collect, what we do not store, and how data flows through the service.

Account information

When you create an account, authentication is handled by Supabase Auth. We store your email and authentication session via secure cookies. We use your account to enforce export rate limits and keep you signed in.

SQL export files

We do not store your exported SQL files. When you run an export, SQL is generated from your database and streamed over HTTPS directly to your browser. It passes through our server only in memory during the request — it is not written to disk, object storage, or any database on our side. Your browser assembles the stream and saves the file locally on your device. Once the download finishes, no copy of the export remains on our servers.

Database connection strings

We do not store your database connection strings. When you start an export, your connection string is sent over HTTPS to our server only for the duration of that request. It is used to connect to your database, stream a SQL file back to your browser, and then discarded. Connection strings are not written to disk, databases, or logs (passwords are masked in server error logs).

Export rate limits

To prevent abuse, Free tier: 100 MB max per download, one successful export every 10 minutes. We record when your account last completed a successful export (a timestamp only). This does not include any database credentials or export contents.

What we do not collect

Exported SQL files on our servers (exports are streamed to your browser only)
Contents of your database after the download completes
Storage bucket files from your Supabase project
Payment information (SupaDownload is free to use)

Third-party services

The app is hosted on Vercel and uses Supabase for authentication. We use Vercel Analytics to collect anonymous page-view statistics (no connection strings or database data). Your use of those services is also governed by their respective privacy policies. Database connections during export are made directly from our server to Supabase-hosted PostgreSQL endpoints you authorize.

Error monitoring

If configured by the operator, anonymous error reports may be sent to Sentry to help diagnose failures. These reports do not include connection strings or database contents.

Contact

Questions about this policy? Open an issue or contact the project maintainer through your usual support channel.