Pitfall 1: Omitting OAuth token handling from privacy notices
When you enable OAuth (Google, GitHub, etc.), Supabase Auth exchanges user credentials for access and refresh tokens that are stored server-side. Many indie founders disclose "email collection" in their privacy policy but fail to mention that OAuth tokens are also collected and what third-party services (Google, GitHub) receive data. Under GDPR Article 13(2)(c) and CCPA Section 1798.100, you must disclose the *specific categories* of data and recipients. Regulators in enforcement actions (e.g., EDPB decisions on Meta's cookie walls) scrutinize whether users knew third-party tokens were being collected. Consequence: incomplete disclosures can trigger DPA warnings and in some cases fines under GDPR Article 83(4).
Pitfall 2: Confusing Supabase's "user metadata" field with optional data
Supabase Auth includes a "user_metadata" column that developers often populate with profile data (name, avatar URL, phone). This field is not separate from the authentication table — it's part of the same record collected during signup. Teams frequently fail to update consent flows or privacy policies to account for this metadata collection, treating it as "optional developer data" rather than declared personal processing. If your signup form only says "we collect email," but your code stores metadata, you've created a mismatch. Consequence: consent is invalid under GDPR Article 7(4) (ambiguity invalidates consent), and audits will flag scope creep.
Pitfall 3: Forgetting to update the DPA when self-hosting
Supabase is self-hostable; some teams deploy it on their own servers to "avoid" the US processor. However, the standard Supabase DPA only covers cloud hosting. If you self-host Supabase Auth, Supabase may argue the DPA no longer applies, leaving you without a processor agreement *and* creating ambiguity about data location in privacy notices. Consequence: your privacy policy claims data stays in-country, but you have no signed agreement with Supabase confirming the self-hosted arrangement, violating GDPR Article 28(3).
