September 2026
All articlesBubble Privacy Rules to Supabase RLS: What Can You Migrate?
Only some Bubble Privacy Rules translate directly into Supabase RLS. Compare every privacy permission with its migration equivalent, including fields, searches, files, and auto-binding.
TL;DR: Only some Bubble Privacy Rules translate directly into Supabase RLS. RLS can enforce conditions on which records a user may read, create, update, or delete. Bubble also controls individual fields, search permissions, attached files, and auto-binding. Those features need additional enforcement or application logic. Migrating your privacy rules therefore involves more than generating RLS policies.
How Bubble Privacy Rules Map to Supabase RLS
A Bubble Privacy Rule combines two things: a condition, such as “This Project’s Creator is Current User,” and permissions that apply when that condition is true.
Both parts need a valid replacement. Translating the condition into SQL does not automatically reproduce every permission attached to it.
Here is how Bubble’s privacy permissions map to Supabase:
| Bubble privacy permission | Can RLS alone reproduce it? | Migration equivalent |
|---|---|---|
| Find this in searches | Partially. RLS filters accessible rows, but does not reproduce Bubble’s distinction between finding something in a search and accessing it through another reference. | Use a SELECT policy when search and direct-read permissions match. Otherwise, implement a controlled search endpoint or database function. |
| View all fields | Conditionally. RLS can allow access to a whole row, subject to database privileges. | A SELECT policy when full-row access is intended. Review search permissions before exposing unrestricted table queries. |
| View selected fields | No. RLS controls rows, not which columns are returned. | Use separately protected tables, column privileges, or a secured view/API that returns only authorized fields. Conditional visibility may require additional logic. |
Where RLS Alone Is Not Enough
Auto-binding illustrates the distinction. Supabase can enforce that a user may update only their own profile and only particular fields. But reproducing Bubble’s input binding, automatic saving, and separate permission for that update path requires more than an RLS policy.
Also, Bubble’s API permissions apply specifically to its Data API. They do not define authorization for ordinary workflow actions. Those workflows need their own migration review.
What to Check Before Migrating Privacy Rules
The conditions themselves need attention, too. “Current User” requires a reliable link between migrated Bubble users and Supabase Auth accounts. Related-record conditions may require joins or helper functions. A condition being possible in PostgreSQL does not mean a migration tool currently translates it.
Review the combined result. Bubble permissions are additive, and PostgreSQL’s default permissive policies also combine with OR. Test with actual user sessions, including users who should be denied access. A service-role credential bypasses RLS and cannot verify user permissions.
At unbub.dev, we translate a supported subset into reviewable RLS policies and flag behavior that needs additional implementation. Field visibility, file protection, and auto-binding should remain explicit migration tasks until their replacements are implemented and verified.
Sources: Bubble privacy permissions · Supabase RLS · Column privileges · Storage access control
Ready to migrate off Bubble?
Self-serve tools or a done-for-you service. Your app stays live while we move everything.