Third-Party Licenses
Last updated: 2026-08-30
Applies to: PartyF backend and frontend
Summary
PartyF uses open-source software. This document lists dependencies, their licenses, and any licensing obligations.
Backend GPLv3 licensing strategy: the backend is licensed GPLv3, but PartyF is operated as pure SaaS — the backend binary/image is never conveyed to end users, only run on infrastructure the operator controls. GPLv3's copyleft (source-disclosure) obligations are triggered by distribution/conveyance, not by network use (that's AGPL's trigger, which this is not). Today's hosting model does not trigger any GPLv3 disclosure obligation. Separately, though: GPLv3 is in tension with the stated goal of preventing copying and building a monetized product around this code — GPLv3 means anyone the source is conveyed to (a future co-founder, an investor doing diligence, an open-sourced snapshot, etc.) is free to redistribute and modify it. That is a business decision about licensing strategy, not a compliance gap — it isn't resolved here, since it may involve verifying all contributors' copyright can be relicensed. Revisit if distribution (rather than pure hosting) is ever planned.
Backend (partyf-backend)
Repository License
PartyF Backend is licensed under GNU General Public License v3.0 (GPLv3).
File: partyf-backend/LICENSE
What this means:
- GPLv3 is a copyleft license.
- If you distribute the backend (e.g., as compiled or in Docker form), you must:
- Include a copy of the GPLv3 license with the distribution.
- Provide (or offer to provide) the complete source code of your build.
- Ensure any modifications you make are also released under GPLv3 (with limited exceptions for proprietary dependencies using a linking exception).
- Merely running the backend on your servers for users to access (SaaS) does not trigger copyleft obligations.
Status in CI: The backend runs make licenses-check in CI to ensure dependencies comply with allowed license types (see .github/workflows/go.yml). This currently has continue-on-error: true, meaning a license violation does not block the build.
Open items, both engineering/business calls rather than legal ones:
1. Whether GPLv3 still aligns with the business model (see the monetization-tension flag above) — an intentional choice to revisit, not a compliance gap. 2. Whether continue-on-error: true in CI (see Backend Dependencies below — resolved as no incompatibilities exist today) should be tightened to fail so a future incompatible dependency can't land silently — a one-line CI change whenever you want it.
Backend Dependencies
Output of make licenses-list in partyf-backend, captured 2026-08-13. All dependencies are permissive (MIT / BSD-2/3-Clause / ISC / Apache-2.0) — none are copyleft, so there is no dependency-level incompatibility with the backend's own GPLv3 licensing.
| Package | License |
|---|---|
| github.com/beorn7/perks/quantile | MIT |
| github.com/caarlos0/env/v11 | MIT |
| github.com/cespare/xxhash/v2 | MIT |
| github.com/davecgh/go-spew/spew | ISC |
| github.com/gabriel-vasile/mimetype | MIT |
| github.com/go-playground/locales | MIT |
| github.com/go-playground/universal-translator | MIT |
| github.com/go-playground/validator/v10 | MIT |
| github.com/go-redsync/redsync/v4 | BSD-3-Clause |
| github.com/google/uuid | BSD-3-Clause |
| github.com/gorilla/websocket | BSD-2-Clause |
| github.com/labstack/echo/v4 | MIT |
| github.com/labstack/gommon | MIT |
| github.com/leodido/go-urn | MIT |
| github.com/mattn/go-colorable | MIT |
| github.com/mattn/go-isatty | MIT |
| github.com/munnerz/goautoneg | BSD-3-Clause |
| github.com/pmezard/go-difflib/difflib | BSD-3-Clause |
| github.com/prometheus/client_golang/... | BSD-3-Clause / Apache-2.0 |
| github.com/prometheus/client_model/go | Apache-2.0 |
| github.com/prometheus/common | Apache-2.0 |
| github.com/redis/go-redis/v9 | BSD-2-Clause |
| github.com/stretchr/objx | MIT |
| github.com/stretchr/testify | MIT |
| github.com/valyala/bytebufferpool | MIT |
| github.com/valyala/fasttemplate | MIT |
| go.uber.org/atomic | MIT |
| golang.org/x/crypto, x/net, x/sys, x/text, x/time | BSD-3-Clause |
| google.golang.org/protobuf | BSD-3-Clause |
| gopkg.in/yaml.v3 | MIT |
Re-run make licenses-list before each release to catch a newly added dependency with an incompatible license — this snapshot is not a standing guarantee.
Frontend (partyf-frontend)
Repository License
Explicit proprietary / All Rights Reserved. This is a deliberate business decision — the product is intended to be monetized, and the owner does not want the source freely copyable. A LICENSE file stating "All Rights Reserved" is present at partyf-frontend/LICENSE (copyright Miguel Mesa Chica), and package.json's "license" field is set to "UNLICENSED" (the npm/SPDX convention meaning "no license granted").
Note this is the opposite decision from the backend (GPLv3, see above) — the two repos intentionally carry different licenses since only the backend inherited GPLv3 from its history; the frontend's licensing was a fresh decision made for this product.
Frontend Dependencies (package.json)
The tables below list what's actually shipped to end users (Production) and the notable tooling used to build/test it (Development).
Production Dependencies
| Package | Version | License | Notes |
|---|---|---|---|
| vue | ^3.5.42 | MIT | Core Vue 3 framework |
| vue-i18n | ^11.4.10 | MIT | Internationalization library |
| @sentry/vue | ^10.73.0 | MIT | Error/performance monitoring SDK |
| posthog-js | ^1.425.1 | Apache-2.0 AND MIT | Product analytics SDK |
| qrcode | ^1.5.4 | MIT | QR code generation (used for join-game codes) |
License Summary for Production Dependencies:
- MIT-licensed: 4 of 5 production dependencies are MIT-licensed (permissive, minimal restrictions).
- Other licenses: 1 dependency under Apache-2.0 AND MIT.
- Compatibility: all listed licenses are permissive and mutually compatible; all permit commercial use, modification, and distribution.
This table is generated by pnpm generate:licenses (see scripts/generate-license-notice.mjs) from package.json and the installed node_modules package metadata — don't hand-edit it, re-run the script instead (see CLAUDE.md's "Legal docs" section for when to re-run it).
Development Dependencies
Not shipped to end users — listed for completeness, not because they carry a distribution obligation.
| Package | Version | License | Notes |
|---|---|---|---|
| @playwright/test | ^1.62.1 | Apache-2.0 | E2E testing framework |
| @tailwindcss/vite | ^4.3.3 | MIT | Tailwind CSS Vite integration |
| @types/node | ^26.4.1 | MIT | TypeScript types for Node.js |
| @vitejs/plugin-vue | ^6.0.8 | MIT | Vite plugin for Vue |
| @vue/test-utils | ^2.5.0 | MIT | Vue testing utilities |
| jsdom | ^30.0.1 | MIT | DOM implementation for Node.js |
| tailwindcss | ^4.3.3 | MIT | Utility-first CSS framework |
| typescript | ^6.0.3 | Apache-2.0 | TypeScript compiler |
| vite | ^8.2.2 | MIT | Frontend build tool |
| vitest | ^4.1.11 | MIT | Unit testing framework |
| vue-tsc | ^3.3.11 | MIT | TypeScript compiler for Vue |
All permissive, mutually compatible with the production dependency licenses above.
Copyleft Licenses
None of the frontend dependencies are copyleft-licensed. No obligation to release source code of the frontend or derived works.
Frontend License Selection — Resolved
Decision: proprietary / All Rights Reserved (see above), not open-source. MIT and Apache-2.0 dependencies still impose an obligation independent of the frontend's own license: their own license notices must be preserved/reproduced somewhere in the distributed product (typically an "open-source acknowledgements" section or file). This is a low-cost, standard practice — a proprietary product can and commonly does bundle permissively-licensed dependencies; it just needs to carry their attribution forward.
This document is served at /legal/licenses.md and linked from the landing page footer (common.legalLicenses), so it doubles as the acknowledgements page — no separate file needed. The notice text below satisfies the MIT/Apache-2.0 "reproduce the license" requirement for each shipped runtime dependency.
Open-Source Acknowledgements (shipped runtime dependencies)
Vue.js — Copyright (c) 2018-present, Yuxi (Evan) You. MIT License.
vue-i18n — Copyright (c) 2020 kazuya kawaguchi. MIT License.
Sentry (@sentry/vue) — Copyright (c) 2019 Functional Software, Inc. dba Sentry. MIT License.
PostHog (posthog-js) — Copyright 2020 Posthog / Hiberly, Inc.; portions Copyright 2015 Mixpanel, Inc. (inherited from code PostHog forked). Dual-licensed MIT / Apache-2.0 (see the package's own LICENSE for which files fall under which license).
qrcode (node-qrcode) — Copyright (c) 2012 Ryan Day. MIT License.
For each package, the MIT/Apache-2.0 text is the standard permissive template (reproduced in full in each package's own repository/node_modules entry); this section exists to name the copyright holders and confirm the license grant is preserved, per the terms above.
Third-Party Fonts
Resolved: fonts are self-hosted, not loaded externally. Bricolage Grotesque and IBM Plex Mono are bundled as 3 woff2 font files within the app; there is no runtime request to fonts.googleapis.com/fonts.gstatic.com.
- License: Open Font License (OFL) for the font files themselves — this still applies to the bundled files (self-hosting doesn't change the font's own license, only removes the third-party network request). OFL permits bundling and redistribution, including in a proprietary product, without requiring the product itself to be open-sourced.
Third-Party Services
Google Cloud Run (Hosting)
- License: Proprietary (Google Cloud Platform terms apply).
- Consideration: Data is processed by Google; disclosed in the privacy notice (see
privacy.md).
Redis (Data Storage)
- License: Typically dual-licensed (SSPL/Commons Clause for newer versions, Redis Modules are proprietary). See deployment configuration.
- Note: The backend uses Redis for session storage. Verify that your Redis deployment (Cloud Memorystore or self-hosted) complies with your license strategy.
SMTP email provider (optional email list)
- License: Proprietary; whichever provider the operator configures through
SMTP_*(none is bundled or named in the code; provider choice is open, see GitHub issue #186 ofmglmc/partyf-backend). - Consideration: Receives subscribers' email addresses and the confirmation message, so it is a processor under GDPR Art. 28: sign its data processing agreement before enabling the list. Disclosed in
privacy.md§5, §6 and §13.
Contact
For questions about licensing, compliance, or distribution:
Email: admin@partyf.es
Organization: Miguel Mesa Chica (individual operator, not a registered company)