Lovable app: users see each other's data after login

Supabase does not separate users automatically, RLS does, and it is off by default on new tables. A frontend filter is decoration; the database must refuse.

alter table projects enable row level security;
create policy "own projects" on projects
  for all using (auth.uid() = owner_id) with check (auth.uid() = owner_id);

Then test it the way you already did: remove the filter in the network tab. You should get an empty list. Do this for every table with user data, and assume the same bug exists in every other table Lovable created.