Client data belongs to the signed-in account. Production deployment uses Supabase Row Level Security; demo mode stores data only in this browser.