Daily backups roll back a day, PITR a minute; neither restores Storage

The answer. Hosted projects on Pro and above get a daily logical backup, kept for 7 days (14 on Team, up to 30 on Enterprise), downloadable and restorable from the dashboard. That protects against "we dropped the table on Tuesday", at the cost of losing everything since the last snapshot. Point-in-Time Recovery is the add-on for the other failure: WAL segments are archived every two minutes (or sooner under load), so a restore can target any second inside the retention window with a worst-case loss of two minutes; it needs a Small compute add-on or larger and is billed by retention (7, 14 or 28 days). Both cover the database only. Files uploaded through Storage are not in a backup, only their metadata rows are, and passwords of custom Postgres roles are not stored either. Whichever tier you pay for, the runbook is worth nothing until a restore has been rehearsed into a fresh project with the clock running.

The pattern.

# quarterly drill, scratch project
npx supabase db dump --db-url "$PROD_POOLER_URL" -f schema.sql               # roles + schema
npx supabase db dump --db-url "$PROD_POOLER_URL" -f data.sql --data-only --use-copy
psql "$SCRATCH_URL" -f schema.sql && psql "$SCRATCH_URL" -f data.sql
psql "$SCRATCH_URL" -c "select count(*) from auth.users" ; psql "$PROD_POOLER_URL" -c "select count(*) from auth.users"   # parity
# then: recreate buckets, copy objects, rebind auth hooks, re-enable Realtime, reset custom role passwords

Record: minutes to a queryable copy (RTO), age of the newest row that survived (RPO), and every step that was not in the runbook.

Watch out.

Storage buckets and objects are recreated by hand and copied by API; a restore that forgets them serves broken images with a healthy database.
Auth hooks, MFA settings, SMTP and redirect URLs are instance configuration, not rows; the restored project has none of them until you rebind.
The dashboard's restore replaces the live database in place. Test restores go to a scratch project, always.