Security & Privacy (Supabase MVP)

Core Model

• All data is family-scoped
• Supabase Auth provides identity
• RLS enforces authorization at the database layer

Roles

Roles are stored in family_members.role.

admin

• Full read/write access
• Can invite/remove members
• Can create share links
• Can manage children and camps

editor

• Read/write camps and children
• Cannot manage membership
• Cannot create share links (MVP choice; can be changed later)

viewer

• Read-only access to family data
• Cannot edit camps/children
• Cannot create share links

Row Level Security (RLS)

RLS must be enabled on all tables and enforce:

• A user can only access rows belonging to families where they are a member
• A user’s role controls write permissions

Token-Based Sharing (Option A)

Sharing uses share_links tokens and Edge Functions.

Requirements:

• Share links are read-only
• Tokens must not expose notes or cost
• Tokens may expire (optional in MVP; if implemented, enforce consistently)

Data Handling

• Soft deletes for camps and children (preferred)
• Users can request deletion of their account and associated family membership