Sia Manager for Supabase
Sia Makerlab 제품 포트폴리오 통합 페이지에서 제공하는 개인정보처리방침입니다.
Last Updated: July 11, 2026
Effective Date: July 11, 2026
Revision: 1.0
| Version | Date | Changes |
|---|---|---|
| 1.0 | July 11, 2026 | Initial release |
This Privacy Policy describes how Sia Makerlab ("we," "us," or "our") collects, uses, and shares information in connection with your use of the Sia Manager for Supabase mobile application (the "App").
The App is an Android ops and management console for the Supabase projects that you specify. It connects directly from your device to your Supabase projects. It does not require you to create an account, and we do not operate a server that stores your project details or your data. By downloading, installing, or using the App, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the App.
The App is designed to function without an account or personal information. We do not collect your name, email address, phone number, or physical address.
To connect to a Supabase project, you provide its details — a project URL and one or more API keys (an anon/publishable key and/or a secret/service_role key) and, for Management API features on Supabase Cloud, a Personal Access Token or an OAuth2 access token. Keys and tokens are treated as opaque strings, and the project ref is derived from the URL. This configuration is stored locally on your device, encrypted at rest, and is not collected by us.
The App contains no analytics, crash-reporting, or attribution SDKs (no Firebase, Crashlytics, Google Analytics, Sentry, Amplitude, AppsFlyer, Adjust, or similar).
When you use the App, it communicates directly from your device to the Supabase endpoints you configure, across two API planes:
<project>.supabase.co, or to the host of a self-hosted project (REST, Auth, Storage, Realtime), authenticated with your API key. Available for both cloud and self-hosted projects.api.supabase.com, authenticated with your Personal Access Token or OAuth2 access token. Available for official Supabase Cloud projects only.Your rows, users, files, SQL, logs, and their results travel between your device and your Supabase project — not through us. We operate no server and do not see, receive, or store your project URLs, keys, tokens, or data. All such communication uses TLS (HTTPS); if you configure a self-hosted project over cleartext http://, the App does not transmit your secret key over that connection. You are responsible for ensuring you are authorized to access any project you connect to.
The App stores the following data only on your device, in app-private storage (DataStore):
| Data | Collected | Stored | Shared | Purpose |
|---|---|---|---|---|
| Project connections & credentials | Yes | Device only (encrypted) | No | Display name, project URL, anon/publishable key, secret/service_role key, Management Personal Access Token, and OAuth tokens for the projects you configure |
| App settings | Yes | Device only | No | Theme, screen-capture blocking, app lock, clipboard auto-clear interval, read-only mode, health-notification toggle, onboarding state, launch count, and ad-removal purchase state |
| App-lock fallback PIN | Yes | Device only (salted PBKDF2 digest) | No | Verifying the fallback PIN for the biometric app lock — the PIN itself is never stored |
| Offline snapshots | Yes | Device only | No | Cached project metrics and table / bucket / function lists (names and counts) shown while offline |
| SQL workspace | Yes | Device only | No | SQL you write in the editor, snippets, and execution history |
| Alert rule drafts | Yes | Device only | No | Local notification rules you create |
| Upload resume state | Yes | Device only | No | URL and offset used to resume an interrupted storage upload |
Project connections and credentials are encrypted at rest with an AES-256-GCM key held in the Android Keystore; the key material never leaves your device's secure hardware. The remaining entries above are ordinary preference data.
By design, the App does not cache Auth user records, table row data, or log bodies — that content is fetched from your project each time you view it and is not persisted.
This data is stored exclusively on your device, in the App's private storage. We do not have access to it, and it is never transmitted to our servers. Use the App only on trusted devices.
The App offers screen-capture blocking (Android FLAG_SECURE), which hides project data in screenshots and in the recent-apps (recents) list. This option is off by default and can be enabled once you have turned on the app lock, because it also blanks the recents thumbnail. This is a device-side protection; no capture data is collected or transmitted.
If you enable the app lock, biometric authentication is performed by the Android operating system on your device. The App never receives, stores, or transmits your fingerprint or other biometric data. Biometric re-authentication is also required before secret keys or tokens are revealed or copied.
If you set the 4-digit fallback PIN, only a salted PBKDF2 digest of it is stored on your device — the PIN itself is never saved and is not transmitted anywhere.
When you copy values within the App, the App may automatically clear the clipboard after a short interval to reduce the risk of sensitive data lingering. Clipboard contents are not collected or transmitted.
When project-status notifications are enabled, a background job (Android WorkManager) checks your configured projects about every 30 minutes and shows a local notification if a project is paused or in a failed state. This detection runs entirely on your device against the projects you configured — there is no Firebase Cloud Messaging (FCM), push server, or backend of ours involved. The home-screen widget and quick settings tile likewise render only locally cached snapshots.
Declared by the App:
INTERNET): required to connect to the Supabase projects you configure and to serve ads.ACCESS_NETWORK_STATE): used to detect network availability.POST_NOTIFICATIONS): used only to display the local project-status notifications described above. You may decline it.Merged automatically from the Google and AndroidX libraries the App uses:
USE_BIOMETRIC, USE_FINGERPRINT): the app lock and re-authentication before secrets are revealed.WAKE_LOCK, FOREGROUND_SERVICE): the periodic project health check.com.android.vending.BILLING): the one-time ad-removal purchase.AD_ID, ACCESS_ADSERVICES_AD_ID / _ATTRIBUTION / _TOPICS): merged from the Google AdMob SDK and used to serve ads (see Section 2.9).The App does not request location, camera, microphone, contacts, or broad storage permissions — file uploads use the system file picker (SAF).
Unless you purchase the ad-removal option, the App displays banner, native, and app-open advertising through Google AdMob. Our advertising partner may collect:
Where required, the App uses Google's User Messaging Platform (UMP) to obtain your consent for personalized advertising. The advertising SDK is not initialized until consent allows ad requests. This data collection is governed by Google's Privacy Policy: https://policies.google.com/privacy
We explicitly do not collect:
Data stored on your device is used locally to:
Data collected by Google AdMob and Google UMP is used to display personalized or non-personalized advertisements (based on your consent) and to prevent fraud and abuse. Data collected by Google Play Billing is used to process and reconcile your purchase.
We do not sell, trade, or rent your personal information to third parties.
The App integrates the following third-party services, which handle data according to their own privacy policies:
| Service | Purpose | Privacy Policy |
|---|---|---|
| Google AdMob | Advertising | https://policies.google.com/privacy |
| Google User Messaging Platform (UMP) | Ad consent management | https://policies.google.com/privacy |
| Google Play Billing | Process the one-time ad-removal purchase | https://policies.google.com/privacy |
| Google Play In-App Update / In-App Review | Offer app updates and review prompts | https://policies.google.com/privacy |
Separately, the App communicates directly with the Supabase projects you specify (both <project>.supabase.co or your self-hosted host, and api.supabase.com). Those projects and services are operated by you, by Supabase, or by parties you choose, and their handling of your connections and data is outside our control.
We may disclose information if required to do so by law or in response to valid requests by public authorities. As we hold no user content, such disclosure would be limited to information actually in our possession.
Data stored on your device remains until you delete it within the App, clear app data in device settings, or uninstall the App. Deleting a project connection also removes that project's credentials, cached dashboard and list snapshots, and SQL workspace. Because we hold no copy of any of it, there is no separate deletion request to make of us.
Data inside your Supabase projects is retained by Supabase or by your own self-hosted server and is outside the App's control; deletion and retention there follow Supabase's policies and your own.
Data collected by Google's advertising, consent, and billing services is retained according to their respective policies.
You have the right to:
Under the GDPR and applicable laws, you also have the rights to access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent. To exercise rights over data held by a third-party service, contact that service directly.
Manage advertising consent through:
We implement reasonable technical measures to protect data on your device:
FLAG_SECURE) is available as an opt-in setting — it is off by default — and hides sensitive information in screenshots and the recents list once enabledhttp:// self-hosted connection the secret key is not transmitted. Sensitive values are not written to logsThe App is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children.
Data collected by third-party services may be transferred to and processed in countries with different data protection laws. Please refer to Google's Privacy Policy for more information.
We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date and, for material changes, displaying a notice within the App.
We are not responsible for the data collection, use, or security practices of third-party services integrated into the App, including Google AdMob, Google UMP, and Google Play Billing, nor for the Supabase projects and services you choose to connect to.
We are not responsible for any loss of data stored locally on your device, including your project connections and workspace data.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, WE SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES RESULTING FROM YOUR USE OF THE APP.
This Privacy Policy shall be governed by the laws of the Republic of Korea. For EU users, it shall be interpreted in accordance with applicable EU law including the GDPR.
Sia Makerlab
For GDPR-related inquiries from EEA residents, please include "GDPR Request" in the subject line.
| Data Type | Collected | Stored | Shared | Purpose |
|---|---|---|---|---|
| Project connections & settings | Yes | Device only | No | Connecting to your projects and preferences |
| API keys, Management & OAuth tokens | Yes | Device only (AES-256-GCM, Android Keystore) | No | Authenticating to your projects |
| App-lock fallback PIN | Yes | Device only (salted PBKDF2 digest) | No | Verifying the app lock |
| Project data (rows, users, files, SQL, logs) | No (sent device → your Supabase projects) | Not retained | Only with the projects you specify | Running your operations |
| Offline snapshots (metrics, table / bucket / function lists) | Yes | Device only | No | Showing cached state offline, widget and tile |
| SQL workspace & alert rule drafts | Yes | Device only | No | Your in-app working data |
| Purchase state | Yes | Device only | No | Ad-removal entitlement |
| Advertising ID | Yes* | By Google | With Google | Advertising |
| Personal info | No | N/A | No | N/A |
*Collected by third-party services (Google), not by us directly.
This Privacy Policy is available in English. If translated versions are provided, the English version shall prevail in case of any discrepancy.