Evidence boundary
This register describes repository source at8d6a13e58762aedff6b1ea5eabb6de474a257e99. It uses generated Supabase types, migration history, owning routes, service code and checked-in Cloudflare configuration. It does not query production, inspect secrets, replay migrations or verify deployed grants, provider settings, backups or data volumes. A source definition is not evidence that a store is deployed or populated.
The schema census contains 655 tables and 6,932 columns. The appendices include all candidate tables, including catalogs that may contain no personal data. Every row lists all generated Row columns, its inventory family and source evidence for policy declarations. Free text, JSON, content, embeddings and indirect identifiers require review even when a column name does not mention a person.
Each appendix row inherits its family’s purpose, current lifecycle and rights-path assessment below. The policy index reports declarations found in migration text, not effective privileges. Dynamic SQL, schema moves, inherited/default grants, security-definer RPCs and later policy changes need applied-schema verification in an isolated fixture. An unresolved entry is an explicit access-coverage gap, not a claim that the table is public or inaccessible.
The source includes both active API routes and retained legacy implementations behind generated wrappers. Links to legacy implementations identify current behavior where the active wrapper delegates there. The inventory does not authorize changes to paused runtimes.
Database families
Unless a row states otherwise, no uniform expiry or complete subject export/erasure adapter was established in this source pass. Product CRUD and FK cascades are partial lifecycle paths. They do not prove subject discovery, physical object removal or processor erasure.private normally routes through privileged server RPCs and application authorization, while public can have direct RLS paths. The appendices preserve per-table policy evidence instead of assuming either schema grants identical access to every table.
| Family | Data category and purpose | Access evidenced in source | Current retention/deletion and export/erasure path |
|---|---|---|---|
| Identity | users, user_private_details, handles, onboarding, invitations, roles, account/device/session and recovery records. Authentication, profile and membership administration. | Public profile SELECT permits self and shared-workspace profiles. Private details and session paths have separate policies. Auth administration uses service credentials. | Account deletion verifies email and calls Auth admin deletion. The deletion trigger marks private details deleted and removes memberships, retaining profile rows. Subscription and orphan-workspace cleanup is best effort. No complete account export or erasure receipt was found. |
| Legal | Legal document versions, acceptances, policy source/version and network hashes. Evidence of a particular legal publication acceptance. | RLS enabled, PUBLIC/anon/authenticated revoked, service_role granted. | No expiry in that foundation. Acceptance references the public user with ON DELETE RESTRICT; workspace reference becomes null. This needs deliberate retention and erasure handling, not blind cascade deletion. Not a general consent-purpose ledger. |
| Contacts and workforce | Workspace users, profiles, linked identities, employee creation/restore operations, employment contracts, compensation, payroll and attendance. Customer relationship and personnel management. | Workspace permissions, actor-audited server RPCs and service-only employee operations. Contact deletion requires delete_users. | Audited contact deletion/merge and group reports exist. Attendance export and report exports cover subsets. Unknown provider writes and identity reservations need reconciliation before retirement. No all-person purge clock established. |
| Health | Healthcare checkups, vitals, diagnoses, personal journals and revisions. Health and private reflection content. | Private-schema service/RPC paths and actor/workspace authorization, with table-specific source evidence in the appendix. | Product CRUD is not a retention policy. Revisions, notes and AI-derived copies need explicit subject mapping and narrow access. No complete health/journal export and physical erasure coverage established. |
| Tasks | Tasks, boards, projects, history, drafts, assignments, comments, mentions, attachments, progress and plans. Collaboration and planning. | Workspace RLS, permissions and explicit public/share-link variants. Public sharing is a distinct access scope. | Legacy maintenance hard-deletes soft-deleted tasks/boards after 30 days. This does not cover every history/object copy. Media cleanup removes specific objects. Shared-content rights need redaction decisions. |
| Calendar and time | Calendar provider tokens, participants, events, sync logs/receipts and sagas; time sessions, requests, breaks and comments. Scheduling and work records. | Actor/workspace permissions, private RPCs and provider-scoped credentials. Token tables require distinct secret access. | Product deletion, provider synchronization and Time export exist. Remote calendar copies, retries, participants and sync receipts are separate erasure targets. OAuth nonce expiry is not a full calendar retention policy. |
| Chat | Workspace chat, private conversations, memberships, messages, reactions, attachments, previews and external-chat inbox/outbox/stream state. Communication and connected channels. | Conversation/workspace membership and server checks; external binding credentials are private. | Message deletion/reaction retirement is feature-specific. Attachments, audit, provider threads and queued external deliveries need coordinated erasure. Native/external replay must honor a subject/workspace fence. |
| AI and memory | Chat prompts/outputs, Studio datasets/runs/tool traces, credit usage, model favorites, settings, Mira/Meet memories and embeddings. Inference, personalization and billing attribution. | Studio foundation is private service-only with API permissions. Memory is scoped to user plus workspace. Meet consent is separate. | Studio content capture defaults off; content TTL 30 days, metadata 365 days with wider overrides. Cleanup RPC deletes expired content/runs; hosted invocation is unverified. Memory export covers one scope, not all AI data. See sidecar row below. |
| Meetings | Meeting participants, recordings, audio chunks, transcripts, live inputs/events, documents, Meet availability and Parley sessions. Calls, scheduling, streaming and transcription. | Workspace/meeting/actor authorization, guest and public-plan exceptions, private recording/stream paths. | Session finalization and cleanup exist, but transcript, storage, SFU/provider and memory copies have separate lifecycles. Leaving a room does not prove media erasure. No unified recording retention/export adapter established. |
| Mail and delivery | Mailboxes, addresses, recipients, raw MIME, bodies, attachments, connected accounts, OAuth, AI drafts, delivery jobs/events, email audit and suppression. Messaging and delivery safety. | Private mailbox membership/API credentials and audited service paths. Email-audit policies include workspace audit permission, root access and service role declarations. | Mail product deletion/connected-provider operations are partial. R2 raw bytes and jobs need their own cleanup. Existing email audit contains source address, IP, user agent and JSON metadata. Newsletter retention is a design standard, not a shipped newsletter store. |
| Notifications | Push-device endpoints, preferences, payloads, batches, delivery logs, topic announcements, contacts and report-email queues. User-requested notifications and reports. | Owner preference/device paths, workspace permissions and private service queues. | Notification expiry cleanup exists. Notification email-copy cleanup removes specific copies; it is not platform retention. Queue recipients, bodies, provider attempts and dead letters still need fences and bounded TTLs. |
| Education | Learners, parent links/invites, submissions, grades, quizzes, sessions, reports, certificates and coding runs. Learning and teaching. | Workspace/learner/teacher/parent permissions, private answer and report tables; some shared/public content paths. | Form response export, education reports and attendance exports are product-specific. Minors, parent authority, generated reports, code submissions and report email copies need an explicit rights graph. |
| Forms | Forms, response answers, sessions and share links. Surveys and submissions, including arbitrary personal or sensitive text. | Private service data with form/workspace/share-link authorization at the API boundary. | Form and response exports exist. No uniform response/session/IP purge deadline established. Public form access is not permission to export respondents. |
| Finance and commerce | Wallets, invoices, debt/loans, orders, inventory buyers/suppliers, payroll-linked transactions, billing, checkout/webhook receipts and integration credentials. Transactions, accounting and subscriptions. | Workspace finance/inventory permissions, wallet whitelists, private service integrations and provider signatures. | Transaction/inventory export routes cover subsets. Financial retention needs a legal schedule and reduced retained subset; no blanket indefinite exception. Subscription revocation is not Polar erasure. |
| Content and CMS | Documents, datasets, whiteboards, mind maps, notes, external-project entries/assets/imports and publication events. User-authored content and publishing. | Workspace roles, item/share/publication permissions, internal API adapters and scoped storage delivery. | Product deletion/export and revision-conflict flows exist. Free text/JSON can embed third parties. Published copies, revisions, embeddings, imports and CDN cache invalidation require separate adapters. |
| Security | Abuse signals/events, IP blocks, suspensions, rate-limit appeals, MFA failures, SSO transactions/disclosures and security-budget counters. Fraud prevention and authentication. | Service/private RPCs plus controlled administrator views. Not all security data belongs in a user’s unredacted export. | Some counters and challenges expire, while raw IP/UA and event history have no uniform lifecycle established. Redis TTL does not prove matching Postgres retention. Retain only lawful, time-bounded evidence. |
| Analytics | link_analytics, realtime_log_aggregations, workspace_api_key_usage_logs, storefront events, gamification events, AI usage and stress samples. Product metrics and operational diagnosis. | Link/workspace permissions, service ingestion and operational views. Policies differ by table. | Link raw events store IP/UA, and later analytics derive unique visitors from IP. API-key usage logs retain ip_address, user_agent, request_params and error_message. Their cleanup RPC deletes rows older than 90 days, but scheduled execution was not established in this source pass. No platform-wide 90-day TTL was established. A table named aggregation can still contain identifiers. |
| Operations | Devbox runs/events/artifacts, deployment audit, Git/bot audit/configuration, runner/CI credentials, cron executions and coordination receipts. Development, deployment and operational control. | Private service credentials and platform infrastructure permissions. Artifact download authorization is separate. | Leases/expiring tokens and bounded ledgers cover some records. Run logs/artifacts may contain customer content or credentials. Retention and erasure need both metadata and object-store coverage. |
| System and configuration | Currency/timezone catalogs, models, settings, secrets and tables not classified more narrowly by the census. Configuration and reference data. | Table-specific grants/RLS/RPC evidence in appendices. Catalog visibility does not imply secret visibility. | Static catalogs may have no PII. This family also includes personal tables pending dedicated lifecycle review: support_inquiries, workspace_habit_tracker_*, poll_user_votes and shortened_links. Their contact details, activity, votes, creator identities and content remain subject to the standard. Actor IDs, audit fields and arbitrary JSON remain candidates. Owner confirmation is required before marking a table outside personal-data scope. |
| Storage metadata | storage.objects, buckets, multipart uploads/parts, analytics/vector metadata and indexes. Object ownership, delivery, upload tracking and derived search. | Storage policies plus privileged object APIs; bucket public flags affect read exposure. | Deleting relational metadata does not prove deletion of bytes, multipart fragments, CDN copies or backups. Bucket-specific rights paths follow below. |
Stores outside the generated application tables
| Store | Personal data and purpose | Access | Current lifecycle and rights coverage |
|---|---|---|---|
| Supabase Auth | auth.users identities, email/phone, metadata; identities, sessions, refresh tokens, MFA and audit history managed by Auth. Authentication. Not included in the 655-table census. | Session identity and privileged Auth admin API. Internal Auth grants are not described by the generated application types. | Account API calls auth.admin.deleteUser. Provider-managed Auth logs/backups and retained public profiles remain separate. No Auth dataset/export completeness claim. |
| First-party memory sidecar Postgres | public.memories: container_tag, custom_id, content, metadata, embedding, summary, title, forget_reason, forgotten_at, timestamps, generated full-text index. Personalization and retrieval. | Authenticated internal server with caller-provided scoped container; public product adapters impose user/workspace consent. Schema has no application RLS policy in that file. | forgetMemory updates status to forgotten; content, embedding and metadata remain stored. This is not hard erasure. User/workspace memory export exists. A physical purge and restore fence are missing from this rights path. The retained service source is inventoried without starting Docker. |
| Lettin D1 | Eleven tables: creators, invitations, worlds, collaborators, entries, media, import_previews, creator_blacklist, creator_profiles, reader_bookmarks, creator_bookmarks. IDs, emails, draft/published JSON, creator profiles and reading/bookmark activity. | D1 migrations have local FK constraints; SQL has no Supabase RLS. Worker context/API permissions enforce actor/workspace and publication access. | World/entry cascades and export exist. Media cleanup claims at most ten unreferenced objects older than seven days, then deletes R2 and metadata. No general identity/workspace purge adapter established for D1, previews, invitations or bookmarks. |
| Browser/mobile/desktop local stores | Session material, downloads, drafts, cached requests, offline mutations, notifications and copied files. Offline use and responsiveness. | Device user, browser origin, operating-system storage and app/session scope. | Sign-out/session changes and product-specific cache cleanup are partial. A server cannot promise deletion of uncontrolled downloaded copies. Encrypted local stores, offline mutation replay and subject/workspace cache invalidation need adapter evidence. |
| Backups, replicas and exports | Supabase PITR/backups, memory DB backups, D1 recovery, R2 versions, DB replicas, developer exports and CI/runtime artifacts where configured. Recovery and delivery. | Infrastructure/provider operators and authorized downloaders. Not established by table RLS alone. | No deployed schedule was inspected. Record actual expiry, region, restore access and fence replay before any compliance claim. Temporary exports are additional stores, not only responses. |
Supabase Storage buckets
Eight bucket identifiers are evidenced by migrations. These are source definitions, not a live bucket listing. Object paths and metadata can identify subjects even when bytes are not obviously personal.| Bucket | Category and purpose | Access evidence | Current deletion/export path and gap |
|---|---|---|---|
avatars | Profile photos and identifying object paths. | Public profile read delivery; server-issued budgeted upload tickets under restrictive upload policies. | Avatar update/delete APIs remove selected objects. Account erasure, public CDN expiry and backup removal are not unified. |
banners | Profile artwork, possibly personal images. | Public bucket flag and budgeted server upload; same migration as avatars. | Banner retirement tracks a feature lifecycle. It does not establish all-subject purge or CDN removal. |
workspaces | Attachments, recordings, chat/AI uploads, course assets, documents, CMS media and other workspace files. | Workspace Storage policies, API permissions and explicit authorized share/export links. Bucket definition is private. | Storage core supports object/folder removal and export links. Product cleanup covers subsets; workspace-row cascades do not remove all object bytes or external copies. |
support_inquiries | Support attachments and potentially sensitive screenshots. | Inquiry upload/ownership policies, with later root-support read policies. | Inquiry lifecycle is not a documented attachment TTL. Need subject lookup, export, retention and support-agent access verification. |
time_tracking_requests | Evidence for time corrections, potentially employment data. | Workspace-member policies, with product permissions. | Request CRUD and time export do not prove evidence-byte erasure. Need orphan cleanup and legal employment retention decisions. |
changelog | Public release images; uploader and metadata may still identify a person. | Public SELECT, root-workspace writes. | No uniform media expiry. Exclude from subject scope only after content/metadata review. |
devbox-code-archives | Source archives, possibly customer content. | Private bucket, privileged runner/API access. | Lease/artifact metadata and byte retention need reconciliation. Repository/source archives are not automatically safe non-PII. |
devbox-run-artifacts | Run logs, screenshots and outputs. | Same private devbox migration and authorized artifact delivery. | No platform subject erasure adapter established. Limit artifact lifetime and redact before upload. |
Cloudflare and asynchronous state
| Runtime/store | Category and purpose | Access | Current retention/deletion/export assessment |
|---|---|---|---|
| Mail Email Routing Worker and R2 | Raw MIME, headers, addresses, content and attachments in MAIL_R2_BUCKET (tuturuuu-mail); mail_stored_objects records references. | Worker binding, internal webhook trust and mailbox API authorization. R2 access is not Supabase RLS. | Ingestion writes raw bytes before webhook handoff. Provider deletion, orphan objects and retry fences need explicit coverage. No verified hosted R2 lifecycle. |
| Lettin R2 and cache R2 | LETTIN_MEDIA plus NEXT_INC_CACHE_R2_BUCKET: media and rendered/cache state. | Private Worker bindings, authorized API and publication routes. | Seven-day unreferenced-media cleanup is partial. Published and draft copies, cache tags and backup/versioning need workspace erasure coverage. |
| Meet and Parley | MeetLiveDurableObject, meeting/media coordination, documents/transcripts and NEXT_INC_CACHE_R2_BUCKET; Parley binds MEETING_AI_PROVIDER. | Meet legacy configuration and Parley configuration, tickets, room membership and internal capabilities. | Finalization/close and retry budgets exist. No complete subject/workspace erasure/export across durable state, media providers and caches established. Legacy config is evidence of a possible store, not current traffic identity. |
| Meet realtime | CHANNEL_ROOM, COLLABORATION_ROOM, MEET_ROOM: persisted messages, document/Yjs updates, presence metadata and checkpoints. | DO bindings, room tickets and server-side scope checks. | State persistence/alarms handles lifecycle/retries. Stale checkpoints and reconnects must honor deletion; room closure alone is not certified data erasure. |
| Colab | ROOMS / ColabRoom, collaborative documents and identities, plus optional AI inputs. | Worker binding and workshop/room authorization. | Session state cleanup is product-specific. Need subject mapping, export and durable erasure acknowledgment before reconnect/replay. |
| Coordination, devbox control and Cron Control | CoordinationObject, RunnerWake, CronLedger store coordination receipts, actor/job IDs, runner state and attempts. | Coordination, Devbox, Cron Control use internal capabilities/secrets. | Expiring coordination leases and bounded ledgers exist. Metadata can remain personal. Their distinct lifetimes and physical purge need rights adapters. Default-off new jobs remain off in this phase. |
| Worker invocation logs and gateway | Request metadata, errors, origin paths and copied payloads where logged, including Apps staging gateway. | Provider operator access and configured log consumers. Checked-in configurations enable sampled observability on several Workers. | Sampling limits volume, not retention or PII. No hosted log TTL or processor deletion verified. Stateless gateways may still disclose data in logs. |
| KV and Cloudflare Queues | No production KV namespace or Queue binding was established in the inspected active configs. The newsletter design proposes Queues; other mail/report work uses database job tables. | Any future binding needs a dedicated authorization and processor inventory entry. | Absence from this source pass is not proof no hosted KV/Queue exists. Future KV keys, queue payloads, retry/DLQ copies and retention must be mapped before use. Do not invent current queue TTLs. |
| Database queues and legacy schedulers | Mail inbound/outbound/draft jobs, report/post email queues, notification batches, cron execution payloads, external-chat deliveries and operation receipts. | Service-only consumers and workspace/actor-validated submission APIs. Cron Control job catalog includes retained route processors. | Current retries/claims differ by feature. Global deletion generation, payload TTL, dead-letter purge and provider reconciliation are not established. New purge scheduling belongs on Cloudflare, not an expansion of legacy owners. |
Processor and telemetry register
Retention, region, roles, contract and delete/export APIs below require provider-owner confirmation. No provider account was accessed. A registry entry or import does not prove the provider is enabled for a customer. Customer content must not be sent merely to test retention.| Provider or processor class | Data and purpose evidenced by source | Who can access it | Current deletion/export and unresolved boundary |
|---|---|---|---|
| Supabase | Auth, DB, realtime, files and request logs. | Tuturuuu scoped roles/service operators and provider under agreed terms. | APIs/cascades cover subsets; hosted Auth logs, replicas, backups and expiry require confirmation. |
| Vercel | Hosted requests, runtime logs, analytics and performance data. Analytics/Speed Insights exports and legal registry evidence. | Project operators, authorized drains and provider. | No checked-in universal provider erasure/retention workflow established. Confirm configured log drains, analytics fields, TTLs and region. |
| Cloudflare | Workers/DO/D1/R2, security, Turnstile, realtime and optional media/email. | Bound Workers/internal operators and provider. | Per-store APIs differ; verify backups, state deletion, cached versions, observability and provider media retention. Binding deletion is not proof of byte erasure. |
| Upstash Redis and QStash | Rate-limit IP/email/user keys, counters, trust/suspension caches, temporary AI auth digests; Rewise declares QStash. Redis client and abuse cache. | Server-side credential holders and infrastructure tooling; vendor administrators. | Many keys use TTL, including 60-second AI temp auth and short suspension caches. No complete key-family census or QStash delivery/DLQ erasure established. Raw identifiers can exist in key names. |
| Polar | Customer/contact IDs, billing and tax transactions, checkout/subscription and webhook metadata. Payment adapters. | Merchant/provider, authorized billing operators and workspace billing permissions. | Cancel/revoke and seat updates are not privacy deletion. Merchant-of-record legal retention and customer rights routing require contract/API evidence. |
| Email: AWS SES, Cloudflare and other configured transports | Recipients, bodies, headers, attachments, bounce/complaint events and suppression. Provider implementations. The canonical legal registry also lists Resend. | Sending account operators and provider; mailbox/integration delegates where authorized. | Establish the enabled transport, message/log/suppression TTL and deletion capability per account. Do not claim plaintext-free suppression end to end. No live newsletter sending authorized. |
| AI model, gateway and speech providers | Prompts, files, tools, embeddings, transcripts, outputs, usage and possibly IP metadata. Source catalogs include Google, OpenAI, Anthropic and speech/voice integrations. | Selected processor/gateway and authorized AI operators, governed by product policy and contract. | No-training policy is separate from retention. Confirm provider/gateway path, data-control configuration, region, subprocessors, request-level deletion and training terms. Studio TTL does not delete provider copies. |
| Google and Microsoft integrations | Calendar/mail/file contacts and content, OAuth scope and account metadata. | Authorized user/workspace delegates and provider. | Disconnect/token revocation stops access but does not erase mirrored data or provider originals. Define controller scope, sync stop fences and reconciliation. |
| Square, SePay and commerce integrations | Buyer/order/financial metadata and webhook/connection identifiers where enabled. | Workspace integration operators and provider under separate roles. | Confirm provider records, legal retention and delete/export contract. Local event cleanup must preserve minimal financial evidence without full raw payloads. |
| Discord and connected chat channels | User/channel IDs, copied messages, attachments and bot interactions. | Channel participants, authorized integration operators and external provider. | Deletion in Tuturuuu need not delete a remote message. Explicit provider adapter and unknown-outcome handling are required. |
| Monitoring, compute and developer processors | Canonical legal registry lists Sentry; older legal UI lists Modal and Neon. Git/runner artifacts can hold diagnostics and content. | Project/provider operators and authorized artifact readers. | Actual enablement and data flow remain unverified. Reconcile the source registries, constrain artifact TTLs and remove raw PII before submission. Do not assume every listed processor is active. |
Reproduce and maintain the inventory
Use source-only searches and generated types. Never read credential files or query production to refresh this page. The appendices describe their extraction and policy-index limits. Useful bounded searches are:rg -n '^ [a-z_]+: \{|^ Tables: \{|^ Row: \{' packages/types/src/supabase.ts
rg -n 'CREATE POLICY|create policy|ENABLE ROW LEVEL SECURITY|enable row level security|REVOKE|GRANT' apps/database/supabase/migrations
rg -n 'storage.buckets|bucket_id' apps/database/supabase/migrations
rg -n 'deleteUser|on_delete_user|cleanup_ai_studio_retention|retention_days|expires_at' apps/database/supabase/migrations apps/web/src packages/ai/src/memory
rg -n 'durable_objects|kv_namespaces|r2_buckets|queues|d1_databases' apps --glob '*wrangler*.jsonc'
rg -n 'durableObject|queue|r2Bucket|kvNamespace' apps --glob '*cloudflare.config.ts'
import collections
import pathlib
import re
text = pathlib.Path("packages/types/src/supabase.ts").read_text()
rows = []
schema = None
in_tables = False
in_row = False
for line in text.splitlines():
match = re.match(r"^ (\w+): \{$", line)
if match:
schema = match[1]
in_tables = False
if line == " Tables: {":
in_tables = True
if line in (" Views: {", " Functions: {"):
in_tables = False
match = re.match(r"^ (\w+): \{$", line)
if match and in_tables:
table = {"schema": schema, "name": match[1], "columns": []}
rows.append(table)
if line == " Row: {":
in_row = True
if in_row and re.match(r"^ \w", line):
table["columns"].append(line.strip().split(":")[0])
if line == " };":
in_row = False
print(collections.Counter(row["schema"] for row in rows))
print(len(rows), sum(len(row["columns"]) for row in rows))