First-time setup: your own database

Your tasks and images live in your own Supabase project, under your control. Complete these steps once for Mac or Android. It helps to keep the Supabase dashboard open in a computer browser alongside WhaleTodo’s setup screen.

1. Create an empty Supabase project

Sign up or sign in to the Supabase dashboard. Choose or create your organization, select New project, and set a project name, database password and region. Wait for the project to finish starting.

Use a new, empty project for WhaleTodo. Save the database password for administration; it is separate from your WhaleTodo password and is not entered in the app.

2. Copy two values into WhaleTodo

Open the project’s Connect dialog to find these values. You can also find your publishable key in Settings → API Keys.

Project URL: project address in the app

Looks like https://your-project.supabase.co. Use the full project URL, not a dashboard URL or a database connection string.

Publishable key: project publishable key in the app

Starts with sb_publishable_. The current app also accepts legacy anon keys; prefer a publishable key for a new project.

Choose first-time setup in WhaleTodo, paste the URL and key from the same project, and check the project to continue. Do not enter a Secret key, service_role key or database password.

3. Initialize the database

When the app asks you to prepare the project, copy its initialization script. In that project’s SQL Editor, create a new query, paste the complete script and select Run.

The script creates task tables, account access rules and private image storage. Use the script supplied by the app; there is no need to create tables manually. Keep Row Level Security (RLS) enabled and image storage private.

4. Configure sign-in

In Authentication → Sign In / Providers, set and save:

• Email: enabled.
• Allow new users to sign up: on.
• Confirm email: off.
• Minimum password length: 16, in the Email settings.

WhaleTodo uses usernames through Supabase’s email sign-in mechanism, without real email addresses. That is why confirmation is off; you do not need an email delivery service. Return to WhaleTodo and recheck the project.

5. Create your WhaleTodo account

Choose a username of 3–32 letters, numbers, underscores or hyphens, and a password of at least 16 characters. You can generate a password in the app. Save it, then create the account to start. This account is separate from your Supabase dashboard account.

You can now use your task list. Keep your login in a password manager: this username account has no email password recovery. Its project owner can use the account recovery procedure to reset the original account. AI can be configured later with your own model access; background agents also need a configured executor.

Why a public key does not make your data public

A publishable key connects a client to a project; it does not sign in as you. With the supplied access rules in place, the URL and key alone cannot read your tasks or images. Database rules check the signed-in owner, and storage rules protect private images.

Protection depends on authentication and correct permissions, not hiding the key. A publishable key can still reach enabled sign-in and signup endpoints. Administrator keys bypass RLS and must stay secret. See Supabase’s key guide.

Owning your project gives you control over access and backups; it does not provide end-to-end encryption. Supabase hosts your data when you use its cloud service. AI features send the context they need to your chosen model provider, and a configured executor processes the data needed for its tasks.

If you need a hand