Unpublished science stays unpublished. Last updated 2026-10-17. For every data privacy and security inquiry, write to support@runline.space. Counsel review pending — not legal sign-off.
runline is offered to adults in the United States. Runline Labs, Inc. operates runline (https://runline.space). Contact the controller at support@runline.space. Postal / registered address: 4940 O Street #1082, Lincoln, NE 68510 (United States). Update NEXT_PUBLIC_LEGAL_* when incorporation details change.
This page explains how we treat unpublished protocols, images, instrument logs, Justin bench queries, account profiles, and contact details you share — including the contact form, deletion requests, and native workspace session on this host.
We do collect personal and lab data to operate runline. Account: name, email, avatar (from you or OAuth), and lab profile fields you choose. Contact / deletion forms: name, work email, organization, role, message, age confirmation, and privacy consent. Workspace: protocols, notebooks, images, and logs you upload or generate. Technical / abuse prevention: IP address (for rate limits, quotas, and CAPTCHA), user-agent, request timestamps, and essential session cookies. Optional product analytics only after cookie consent and never when Global Privacy Control (GPC) is on. We do not ask for government IDs, payment cards on Community, or unrelated personal data.
Account and workspace content are stored in Supabase (Postgres + private object storage) hosted on infrastructure selected for the project (typically AWS regions configured for that Supabase project). The Next.js app runs on Vercel. When AI features are on, AI prompts you submit are sent ephemerally to Anthropic Claude (primary) and/or Google Gemini (fallback and audio). Our AI providers process requests under their commercial API terms (see the AI page). When Langfuse is configured, we send opaque user/lab/session ids and token-usage metadata for AI cost metering — never prompts, completions, or protocol free text. Literature searches you run are sent to OpenAlex, Europe PMC, NCBI/PubMed, Semantic Scholar, and Crossref as needed for that query. Transactional emails go through Resend. Contact forms may transit Formspree. Rate-limit counters may use Upstash Redis. Voice sessions (when enabled) use LiveKit with Cloud recording and session observability off. Diagnostics/bioquant proxies may send assay images to Hugging Face Spaces we operate. Optional product analytics (only after cookie consent, and never when GPC is on) use PostHog US Cloud as a processor, proxied through our domain (/ingest) so the browser talks to runline.space; Vercel Analytics may also load on Vercel deploys. Per-lab feature flags are evaluated server-side using the lab id only (no personal data). We do not sell personal data or place it in public storage buckets.
runline uses third-party services that process personal or lab data on our behalf (processors / sub-processors). They are not advertising networks. Each receives only what that feature needs. The full list follows in “Third-party processors (detail)”. Review their terms for region and retention details.
Provide and secure your account and workspace; reply to pilot inquiries; run AI features you request when AI features are on (ephemeral inference under commercial API terms — see the AI page); enforce rate limits, AI usage quotas, and cost controls; detect abuse; send transactional emails (invites, share links) you or a teammate trigger; and comply with law. We do not sell personal information or use lab content to train foundation models.
API routes are rate-limited and AI endpoints also enforce per-IP daily quotas and a global daily budget (operator-configurable). Public forms may require Cloudflare Turnstile when configured. These controls process IP and challenge tokens solely to prevent abuse and unbounded AI spend — not for advertising.
When you sign in, we may store an approximate country and city derived from the hosting edge’s IP geolocation headers (for example Vercel’s x-vercel-ip-country / x-vercel-ip-city) on your remembered-device record, together with IP and user-agent. That data is for account security and device-context telemetry only. Approximate country read from the connection for signup and checkout is used only to keep the service to adults in the United States and is not stored.
We do not train, retrain, or improve foundational AI models on customer protocols, gels, notebooks, reagent math, or bench observations. Pilot inquiries and workspace data are used only to operate the product you asked for. Raw lab materials are never pooled across labs.
When AI features are on, Justin and related features may send prompts to Anthropic Claude (default) and Google Gemini (fallback / audio), processed under each provider's commercial API terms (see the AI page). When AI is off (personal toggle off, or lab AI off), zero calls go to either provider. Bench queries are not used by runline to train foundation models. We do not claim strict Zero Data Retention (ZDR): providers may retain encrypted transit and abuse-prevention metadata for a limited period that depends on the provider and plan. Justin is designed to decline self-harm assistance and point people in crisis to human help.
Diagnostics stores case and event metadata for your lab (technique, symptoms, controls, hypotheses, outcomes). It does not store prompts, completions, or images; images stay ephemeral. Each AI call writes an audit record with metadata only: lab, user, feature, model id, which fields were sent, redaction counts, image count, and outcome — no free text. When lab AI memory is enabled for your lab, it keeps short structured notes used for that lab only: your lab can see, edit, and delete them, they are never shown to or used for another lab, they are not used to train models, and deleting them removes derived copies (embeddings, caches, summaries). Other labs are never named as a source in an answer: answers cite a verified paper where one backs the claim, and are otherwise labelled as AI.
Before Justin opens the microphone, you see a recording notice and must consent. Consent is logged (timestamp + notice version — not audio). Audio is streamed for the active session only and is not written to disk or used for training. If others can hear your device or join a LiveKit room, tell them voice capture may be active. LiveKit Cloud recording and session observability stay off for runline voice rooms.
Lab literature notebooks can be read and edited by every active member of that lab, including the PI. Experiment runs are visible to you, collaborators you add, and a mentor your lab assigns to you (read-only, including runs outside the lab area). Named lab chat channels are visible to all active lab members. Files in the lab area are readable by lab members. For supervised members, the lab supervisor can also read the member's personal files. Justin chats and direct messages are visible only to their participants. When you leave or are removed from a lab, lab-area content stays with the lab.
runline is a professional research tool. It is not directed to children under 13, and we do not knowingly collect personal data from anyone under 16. People aged 16 or 17 may use runline only with the permission of a parent, guardian, or school. Sign-up asks for your birth month and year, and our server checks it before an account is created, for email sign-up and for Google or GitHub sign-up (through a short-lived, server-signed cookie). One-time codes only sign in existing accounts. We keep only whether you are 16–17 or 18+, never the birth date. Contact forms require age confirmation. If you believe a child under 16 used the service, email support@runline.space and we will delete the data.
Do not provide protected health information or information that identifies a patient or research participant. runline is not a HIPAA covered entity or business associate.
Essential cookies (httpOnly where applicable) keep you signed in. Auth session tokens are stored in cookies managed by Supabase SSR / our native session cookie — not in localStorage. Optional analytics cookies (PostHog US, and Vercel Analytics on Vercel) stay off until you accept them, and stay off when your browser sends Global Privacy Control (Sec-GPC / navigator.globalPrivacyControl). PostHog session replay and text autocapture stay off; we capture only named product events with opaque user/lab ids — never email, name, or protocol content. Details: Cookie Policy and Your privacy choices.
Labs retain intellectual property ownership of experimental data and protocol assets. Signed-in users can export personal and lab-owned workspace data as JSON, Markdown, or a BagIt ZIP (byte-exact Storage files + SHA-256 manifest) from Settings → Privacy or GET /api/privacy/export — including remembered devices and feedback you submitted. JSON, Markdown, and the ZIP cover the core workspace tables plus your profile, Justin chat history, literature notebook messages and notes, Zotero links (without the stored API key), bench memory, and your direct messages and private groups. Langfuse cost traces and PostHog analytics are not in the export — email us for a copy. Account deletion is self-serve and immediate (Settings → Privacy → Delete account, or /privacy/delete): for lab members, lab-area data stays with the lab; individual accounts delete fully; DMs, Justin chats, connections, and other private items are deleted (other DM participants keep their copy, shown as from “Deleted user”). A PI with remaining members picks a successor in the same flow. Optional ZIP download is offered before confirm; deletion does not wait for it. People who cannot sign in can request a one-time expiring email link from /privacy/delete (rate-limited and CAPTCHA-protected); if email is not configured on that deployment the form says so and asks you to email us instead. Shared open-access literature cache rows (lit_papers / lit_sentences) are not personal data and are retained. Security logs may be kept longer when law requires. Counsel review pending — this wording is not legal sign-off.
How long we keep categories of data is summarized below. Lab-specific diagnostics retention settings may shorten case retention further.
You can reject optional cookies in the cookie banner (and change that choice later with Cookie settings in the site footer), send Global Privacy Control (GPC) from a supporting browser (we honour Sec-GPC and navigator.globalPrivacyControl and keep analytics off), export your data from Settings → Privacy, and delete your account immediately via Settings → Privacy or /privacy/delete (including the signed-out one-time email link). We do not sell personal information or run advertising pixels.
We use the processors listed below to run the product. We do not sell personal information. We do not use advertising trackers for cross-site ads.