Supabase gives you Postgres, auth and storage in one dashboard. Start with the auth table it already provides, then add tables that reference auth.users(id) when a row belongs to someone.

Row Level Security is the gate. Every table that holds user data should have RLS enabled and at least one policy: authenticated users can only read their own rows. Without this, your app leaks data by default.