Fonts, images, and third-party attributions

Fonts

Marketing and workspace UI use the system stack: Helvetica Neue, Helvetica, Arial, sans-serif and platform UI monospace. No Google Fonts or proprietary webfont files are bundled. Quantify PDF export embeds Liberation Sans (/fonts/LiberationSans-Regular.ttf), licensed under the SIL Open Font License 1.1 (see /fonts/LICENSE-LiberationSans.txt).

Images & brand marks

App icons under /public/icons, the runline wordmark, and UI illustrations are first-party assets. The Google “G” mark used on the sign-in button (protocolos-google-logo.png) is Google’s trademark, used only to label Google sign-in per common OAuth button guidelines — not as an endorsement. Specimen / demo art is generated in-app (SVG), not stock photography.

Open-source UI dependencies

npm packages (Next.js, React, Lucide, Framer Motion, Nosecone, etc.) ship under their respective licenses in node_modules — mostly MIT / Apache-2.0 / BSD, plus libvips (LGPL-3.0, via sharp, server-side image processing), DOMPurify (MPL-2.0 or Apache-2.0), and JSZip (used under MIT). PDF parsing in the literature service can use MinerU (OpenDataLab) under the MinerU license, credited here. Do not ship AGPL scientific engines into the web bundle — see runline_bioquant/legal/attributions.json for the imaging stack policy (Apache-2.0 / BSD / MIT only).

Model weights and datasets

Weights are loaded at runtime from upstream, not redistributed in our code. Register: licenses-allowlist.json (modelWeights, datasets).

• OpenAI Whisper (tiny.en / base.en, in-browser speech-to-text) — MIT
• Silero VAD (voice activity detection) — MIT
• Cellpose pretrained models — BSD-3-Clause
• StarDist 2D_versatile_fluo — BSD-3-Clause
• Qwen2.5-VL-7B-Instruct (optional self-hosted OCR/QA) — Apache-2.0
• PaddleOCR — Apache-2.0
• scispaCy en_core_sci_sm (server-side literature parsing) — CC BY-SA 3.0
• BiomedParse (Microsoft) — code Apache-2.0; upstream states the model is for research and development use only, so the weights are off by default and are not enabled for paid use
• GelGenie (code Apache-2.0) — the pretrained-weight licence is not yet confirmed; the weights are optional, and without them a classical gel analysis runs

Lab channel files

Channel file storage uses Supabase Storage (private lab-channel-files bucket). In-browser Office editing was removed (STOR-1); files upload, download, and preview (images/PDFs) only. See docs/lab-files.md.

Copied UI component provenance

Components under src/components/ui/ that were adapted from third-party registries carry file-top provenance headers (source URL, license, adaptation note). Refero / design-reference screenshots are not shipped in the product bundle. Inventory:

• shadcn/ui-shaped primitives (button, card, badge, textarea) — MIT
• Showcase demos (shiny-button, v0-ai-chat, voice-powered-orb, draggable-widget-grid) — adapted under MIT / Apache-2.0 upstream terms; see each file header

Third-party processors (audit)

• Vercel — Hosting, edge network, and optional first-party web analytics (only if you accept optional cookies).
• PostHog (US) — Optional product analytics, feature flags, error tracking, and in-product surveys (only if you accept optional cookies; never when Global Privacy Control is on). Browser traffic is proxied through /ingest on our domain so the browser talks to runline.space, not a third-party analytics host.
• Dub — Optional referral and ambassador short links (go.runline.space). Created only when you click Get referral link / Ambassador link — never emailed to contacts automatically.
• Supabase — Authentication, Postgres, and file storage for cloud workspaces.
• Anthropic, PBC — Primary AI model provider when AI is enabled (Claude Haiku 5.5 / Sonnet 5.5 via the Anthropic API), including Anthropic's server-side web search tool for community search when that feature is on.
• Google (Gemini / OAuth) — Optional Google sign-in; when AI features are on, the paid Gemini API for AI fallback, Justin chat, literature answers, OCR, grant mock-review, and live voice (Gemini Live audio).
• Langfuse — Optional AI call tracing and cost metering when LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY are configured (server-side OpenTelemetry exporter).
• GitHub OAuth — Optional GitHub sign-in.
• Stripe — Test-mode checkout, subscriptions, and Customer Portal for Individual Pro and Quantify trials (no live charges in this phase).
• Resend — Transactional email (notebook invites, run-report shares).
• Formspree — Contact / deletion request form delivery.
• Upstash Redis — Optional API rate limiting and AI daily quotas.
• LiveKit — Optional voice / realtime rooms when Copilot voice is enabled.
• Hugging Face Spaces (proxied) — Server-side diagnostics / bioquant / quant engines when configured.
• Cloudflare Turnstile — Optional CAPTCHA on sign-in / create-account, contact, and deletion forms when configured.
• OpenAlex — Literature search and open scholarly metadata when you run Analyzer / literature queries.
• Europe PMC — Literature search and full-text retrieval for open-access Europe PMC records.
• NCBI / PubMed — Literature search via NCBI E-utilities (PubMed), BLAST sequence search, and PubChem compound lookup (PubChem is called from your browser) when you use those features.
• Semantic Scholar — Literature search and paper graph metadata via the Semantic Scholar API.
• Crossref — DOI resolution and bibliographic metadata for citations you look up.
• arXiv, bioRxiv / medRxiv, ClinicalTrials.gov — Preprint and trial-registry search when you run literature queries.
• UniProt, AlphaFold DB (EMBL-EBI), RCSB PDB — Protein, structure, and sequence lookups from the connectors you use.
• SciCrunch (RRID resolver) — Antibody and reagent RRID checks when you verify a lab index entry.
• protocols.io — Protocol search and import when you use the protocols.io import.
• Zotero — Optional reference sync when you connect your Zotero library.
• RSpace (your instance) — Optional ELN import from an RSpace server URL you enter.
• Cloudflare cdnjs / Hugging Face Hub — Static viewer images for the deep-zoom image viewer, and on-device speech model files when local speech-to-text is enabled (both loaded by your browser).
• Operator-configured endpoints — Only when an operator configures them: a Rocket.Chat server for lab messaging, a feedback webhook, and an RFC 3161 timestamp authority for audit-chain anchors.

Full privacy detail: Privacy Policy