RunPaper

Privacy Policy

Last updated: August 6, 2026

1. What RunPaper does

RunPaper is a tool that lets you upload ML/AI research papers (PDFs) or supply an arXiv URL and receive a runnable Python code scaffold, reproducibility checklist, and interactive Q&A about the paper. This privacy policy explains what data we collect, how we use it, and your rights.

2. Data we collect

  • Uploaded PDFs. When you upload a paper, the raw PDF bytes are stored temporarily in our cloud storage (Supabase Storage). Files are retained for up to 30 days and then deleted automatically.
  • Paper content. We process up to the first 60 pages and send up to 40,000 characters of extracted text and up to five selected diagram images to our LLM providers to generate structured analysis, code scaffolds, and diagrams. We do not store the extracted source text as a separate database record.
  • Account information. If you sign in with Google, we store your Google user ID, display name, email address, and profile picture URL in our database (Supabase PostgreSQL). This data is used solely to associate your papers with your account.
  • Chat messages. Questions you ask in the Chat tab, together with a limited amount of recent chat history, are sent to an LLM provider for answering. RunPaper does not persist chat history in its database; it is held in the current browser page state.
  • Usage logs. Our servers log the HTTP method, path, response status, and latency of each request (not request bodies). Application logs are retained according to our hosting configuration, generally for up to 30 days, and are used for debugging, performance monitoring, and abuse detection.
  • Paper fingerprints and shared results. We calculate a SHA-256 hash of uploaded PDF bytes, or use the arXiv ID, to detect a paper that has already been processed. Generated analysis is stored in a shared cache and may be reused when another user submits the same paper. Other users do not receive your account details, original uploaded file, or chat messages.

3. Third-party services

  • Anthropic — We send paper text and chat messages to Anthropic's Claude API for analysis and code generation. Anthropic's privacy policy governs their handling of API data. By default, Anthropic does not train on API data.
  • OpenAI — We use OpenAI's API for selected generation and validation steps. OpenAI's privacy policy governs its handling of API data.
  • Supabase — We use Supabase for database storage and file storage. Data is stored in the US (AWS us-east-1). See Supabase's privacy policy.
  • Google OAuth — Sign-in is handled by Google. We receive only the standard OpenID Connect profile (name, email, picture). Google's privacy policy applies to the OAuth flow.
  • Sentry (optional) — If configured, we use Sentry for error monitoring. Error payloads may include stack traces and request metadata but never paper content.
  • arXiv — When you import a paper via arXiv URL, we fetch the PDF from arxiv.org on your behalf. No personal data is sent to arXiv.

4. How we use your data

  • To generate code scaffolds, reproducibility checklists, and architecture diagrams for papers you submit.
  • To authenticate you and associate papers with your account.
  • To manage your credit balance and process feedback requests.
  • To debug errors and detect abuse.

We do not sell, rent, or share your data with third parties beyond the services listed above. We do not use your data for advertising.

5. Data retention

  • Uploaded PDFs: deleted within 30 days of upload.
  • Shared paper analysis results and fingerprints: retained as a reusable service cache with no fixed automatic deletion period.
  • Account data: retained until you request deletion.
  • Application logs: generally retained for up to 30 days, subject to hosting and security requirements.

6. Your rights

You may request deletion of your account and account-associated data at any time by emailing us at privacy@runpaper.app. We will respond within 30 days.

You can remove individual papers from your dashboard at any time. This removes your account's link to the paper. The shared, de-identified analysis cache and paper fingerprint may remain so that RunPaper can avoid processing the same paper again.

7. Security

Data at rest is encrypted by Supabase (AES-256). Data in transit is encrypted via TLS. We use short-lived signed URLs for PDF access. Our backend API rate-limits all requests to mitigate abuse. Nevertheless, no system is perfectly secure; please do not upload documents containing sensitive personal or confidential information.

8. Children

RunPaper is not directed at children under 13. We do not knowingly collect personal information from children.

9. Changes to this policy

We may update this policy from time to time. Material changes will be noted at the top of this page with a new “Last updated” date. Continued use of the service after changes constitutes acceptance of the revised policy.

10. Contact

Questions about this privacy policy? Email us at privacy@runpaper.app.