Supabase gives a Flutter app Postgres, authentication, storage, and row-level security in one integration. For AI-built apps it is often the simplest safe backend because RLS is enforced in the database itself, not in code the AI might get wrong.
Postgres with real SQL. Email/password + magic link + OAuth authentication with account deletion built in. Postgres row-level security. File storage. Realtime subscriptions. Edge functions if you need serverless. One SDK: supabase_flutter.
Enable email confirmations. Add password reset. Add account deletion (Apple Guideline 5.1.1(v) requires an in-app path). Add at least one OAuth provider (Apple is required by Guideline 4.8 if you offer any third-party sign-in).
Every table gets RLS enabled. Every query then runs with the JWT of the calling user attached; a policy decides which rows the JWT can read or write. Written once in SQL, enforced by Postgres, impossible to bypass from a client. This is why RLS is the safest way to protect an AI-built app: the AI cannot forget to check permissions.
CREATE POLICY "own rows only" ON app_data FOR ALL USING (auth.uid() = user_id); Any row where user_id matches the caller's JWT sub is readable and writable; everything else is invisible.
Supabase Storage supports RLS-protected buckets. For private files, generate signed URLs from an edge function so the client never sees a permanent public URL.
Call supabase.auth.admin.deleteUser() from an edge function. Also delete any user-owned rows in tables that do not cascade automatically. Apple reviewers test this — an incomplete deletion is a rejection.
Official documentation this page is grounded in. Verified to resolve.