Supabase is an open source Firebase alternative. Start your project with a Postgres database, Authentication, instant APIs, Edge Functions, Realtime subscriptions, and Storage.

Supabase

Is it possible to create a RLS policy where a user can read all of the data in a row but can only update some?

Of course you can do that.  An RLS Policy is just a piece of SQL that gets added to the WHERE clause every time that record is accessed.

So if you can write a WHERE clause, you can write an RLS Policy (they're essentially the same thing)