I deployed an app with supabase my apps most valuable part is the data collection. With the public anon key it seems anyone can just steal all my data records is there a was I can limit the number of api calls based on IP address just to make it little difficult. I have set supabase to return only 25 results per call but still nobody stopping them from grabbing everything in database in set of 25 results at a time. Is it possible to do this inside supabase or I have to write up the limit login in my app with some api keys.

I think what you are trying to do isn't worth the time, if someone wants to get all your data they will. Even with rate limiting the user would still be able to rotate IP and get as much data as they want if that's what they are after. And with

anon_key

you should enable RLS on the tables if you don't want them to be fully exposed to everyone.