Supabase — The Backend That Replaces Your Team

Supabase is an open-source Firebase alternative built on Postgres. It provides: a managed Postgres database with a web GUI (TablePlus-style interface in the browser), authentication (email/password, OAuth, magic links, phone), real-time subscriptions (changes to database rows pushed to clients via WebSocket), file storage (S3-compatible, with access control), and edge functions (Deno-based serverless functions). For a solo or small-team founder, Supabase replaces what would previously require: a separate database (RDS), an auth service (Auth0, Cognito), a file storage system (S3 + CDN), and a backend API layer. The free tier (2 projects, 500MB database, 1GB file storage) is sufficient for early development. Paid tiers start at $25/month for production projects. The Supabase client SDK (JavaScript/TypeScript, Swift, Python, Dart) handles the API layer automatically — you write queries against the SDK and Supabase generates the REST and GraphQL endpoints. Row Level Security (RLS) policies in Postgres control data access — users can only access their own data, enforced at the database level rather than application layer.

For BathCheck: the Supabase schema might include users table (with auth.users foreign key), organisations table (OT practices), assessments table (the core data model), assets table (photos from assessments, stored in Supabase Storage), and reports table (generated report metadata + PDF URL in Storage). RLS policies for BathCheck: users can only read assessments belonging to their organisation. Organisation admins can read all assessments in their org. This is 3–4 lines of SQL policy, not 200 lines of middleware code. The security model is enforced at the database level — if your application layer has a bug, the database still won't return records the user shouldn't see. Real-time for ShowerBuddy: when a user completes a shower check-in, the status update is a Postgres row update. Supabase's real-time system broadcasts this change to any subscribed clients — a carer's app can instantly see 'Dad completed his shower at 9:17am' without polling. This is built in with zero additional infrastructure. Supabase + pgvector: for AI features, Supabase's pg_vector extension turns your database into a vector store. Store embeddings of assessment notes, search semantically ('find all assessments where fall risk was mentioned'), and build RAG (Retrieval Augmented Generation) features without a separate vector database.