Security

Data handling

A practical summary of the distinction between account data, application data, and browser-local state.

Account data

Supabase Auth processes account credentials and sessions needed to provide sign-in. This is distinct from application encryption keys.

Applications can store encrypted records, but their implementation and data categories differ. The Privacy Policy is the authoritative public notice.

Applications may use browser storage for settings, local state, or session-related behavior. Water currently uses browser-local settings.