Look at the diagram below: five services, one name. Your app is probably using all of them.

That bundle is Supabase, the ready-made backend many AI app builders connect you to.

What's in the box (per Supabase's architecture docs)
  1. Postgres

    The database. "Postgres is the core of Supabase."

  2. API (PostgREST)

    Turns the database directly into an API

  3. Auth

    Sign-up, login, and tokens

  4. Storage

    Files and images

  5. Row Level Security

    Decides what each request may see

Your app's phone code talks to the API; the API talks to Postgres; the rules decide what comes back.

Supabase's architecture page describes PostgREST as "a standalone web server that turns your Postgres database directly into a RESTful API." That's why your phone can talk to the database without code of yours in between.

Its login service "integrates with Postgres's Row Level Security". Your login and your data rules work together.

The free plan (checked 25 Sep 2026 on the pricing page) includes a 500 MB database and 50,000 monthly active users. "Free projects are paused after 1 week of inactivity."

The trade: with no server code in the middle, the database's rules are your only gate. That's the Moltbook lesson.

Try it with the rules off. In the sandbox, remove the Row Level Security step from the box. The API still answers every question, but now it answers them for everyone.

Check yourself

0/4 got it

Saved on this device only. No account, no streaks.

Next in where your data lives: Backups, and losing everything.