Third-Party Licenses
This document was fact-checked against the current codebase, not drafted by a lawyer. It is not legal advice. License compliance here is a factual/mechanical question (what license does each dependency carry, does that conflict with how you ship) — the one place this crosses into an actual business decision is the GPLv3 section below, flagged as such.
Last updated: 2026-08-30
Applies to: PartyF backend and frontend
Summary
PartyF uses open-source software. This document lists dependencies, their licenses, and any licensing obligations.
Backend GPLv3 licensing strategy — resolved for today's deployment, flagged for the long term: the backend is licensed GPLv3, but PartyF is operated as pure SaaS — the backend binary/image is never conveyed to end users, only run on infrastructure the operator controls. GPLv3's copyleft (source-disclosure) obligations are triggered by distribution/conveyance, not by network use (that's AGPL's trigger, which this is not). Today's hosting model does not trigger any GPLv3 disclosure obligation. Separately, though: GPLv3 is in tension with the stated goal of preventing copying and building a monetized product around this code — GPLv3 means anyone the source is conveyed to (a future co-founder, an investor doing diligence, an open-sourced snapshot, etc.) is free to redistribute and modify it. That is a business decision about licensing strategy, not a compliance gap — it isn't resolved here, since it may involve verifying all contributors' copyright can be relicensed. Revisit if distribution (rather than pure hosting) is ever planned.
Backend (partyf-backend)
Repository License
PartyF Backend is licensed under GNU General Public License v3.0 (GPLv3).
File: partyf-backend/LICENSE
What this means:
- GPLv3 is a copyleft license.
- If you distribute the backend (e.g., as compiled or in Docker form), you must:
- Include a copy of the GPLv3 license with the distribution.
- Provide (or offer to provide) the complete source code of your build.
- Ensure any modifications you make are also released under GPLv3 (with limited exceptions for proprietary dependencies using a linking exception).
- Merely running the backend on your servers for users to access (SaaS) does not trigger copyleft obligations.
Status in CI: The backend runs make licenses-check in CI to ensure dependencies comply with allowed license types (see .github/workflows/go.yml). This currently has continue-on-error: true, meaning a license violation does not block the build.
Open items, both engineering/business calls rather than legal ones:
1. Whether GPLv3 still aligns with the business model (see the monetization-tension flag above) — an intentional choice to revisit, not a compliance gap. 2. Whether continue-on-error: true in CI (see Backend Dependencies below — resolved as no incompatibilities exist today) should be tightened to fail so a future incompatible dependency can't land silently — a one-line CI change whenever you want it.
Backend Dependencies
Output of make licenses-list in partyf-backend, captured 2026-08-13. All dependencies are permissive (MIT / BSD-2/3-Clause / ISC / Apache-2.0) — none are copyleft, so there is no dependency-level incompatibility with the backend's own GPLv3 licensing.
| Package | License |
|---|---|
| github.com/beorn7/perks/quantile | MIT |
| github.com/caarlos0/env/v11 | MIT |
| github.com/cespare/xxhash/v2 | MIT |
| github.com/davecgh/go-spew/spew | ISC |
| github.com/gabriel-vasile/mimetype | MIT |
| github.com/go-playground/locales | MIT |
| github.com/go-playground/universal-translator | MIT |
| github.com/go-playground/validator/v10 | MIT |
| github.com/go-redsync/redsync/v4 | BSD-3-Clause |
| github.com/google/uuid | BSD-3-Clause |
| github.com/gorilla/websocket | BSD-2-Clause |
| github.com/labstack/echo/v4 | MIT |
| github.com/labstack/gommon | MIT |
| github.com/leodido/go-urn | MIT |
| github.com/mattn/go-colorable | MIT |
| github.com/mattn/go-isatty | MIT |
| github.com/munnerz/goautoneg | BSD-3-Clause |
| github.com/pmezard/go-difflib/difflib | BSD-3-Clause |
| github.com/prometheus/client_golang/... | BSD-3-Clause / Apache-2.0 |
| github.com/prometheus/client_model/go | Apache-2.0 |
| github.com/prometheus/common | Apache-2.0 |
| github.com/redis/go-redis/v9 | BSD-2-Clause |
| github.com/stretchr/objx | MIT |
| github.com/stretchr/testify | MIT |
| github.com/valyala/bytebufferpool | MIT |
| github.com/valyala/fasttemplate | MIT |
| go.uber.org/atomic | MIT |
| golang.org/x/crypto, x/net, x/sys, x/text, x/time | BSD-3-Clause |
| google.golang.org/protobuf | BSD-3-Clause |
| gopkg.in/yaml.v3 | MIT |
Re-run make licenses-list before each release to catch a newly added dependency with an incompatible license — this snapshot is not a standing guarantee.
Frontend (partyf-frontend)
Repository License
Resolved 2026-08-13: explicit proprietary / All Rights Reserved. This is a deliberate business decision, not an oversight — the product is intended to be monetized, and the owner does not want the source freely copyable. A LICENSE file stating "All Rights Reserved" has been added at partyf-frontend/LICENSE (copyright Miguel Mesa Chica), and package.json's "license" field should be set to "UNLICENSED" (the npm/SPDX convention meaning "no license granted," distinct from having no field at all, which is ambiguous). Explicit beats implicit even when the answer is "no permissions granted."
Note this is the opposite decision from the backend (GPLv3, see above) — the two repos intentionally carry different licenses since only the backend inherited GPLv3 from its history; the frontend's licensing was a fresh decision made for this product.
Also found and fixed while implementing this: partyf-frontend/package.json's "license" field was previously set to "GPL-3.0-or-later" — actively wrong, not just missing, and inconsistent with "no LICENSE file" this document previously claimed. Corrected to "UNLICENSED" alongside adding the LICENSE file.
Frontend Dependencies (package.json)
The frontend dependencies and their likely licenses are listed below. This is based on public registry data as of the snapshot date. Verify license compatibility with your chosen frontend license before distribution.
Production Dependencies
| Package | Version | Likely License | Notes |
|---|---|---|---|
| vue | ^3.5.41 | MIT | Core Vue 3 framework |
| vue-i18n | ^11.4.9 | MIT | Internationalization library |
| @sentry/vue | ^10.71.0 | MIT | Error/performance monitoring SDK |
| posthog-js | ^1.418.13 | Apache-2.0 AND MIT | Product analytics SDK (mixed license: most of the package is MIT, a subset of files under Apache-2.0 — see the package's own LICENSE) |
| qrcode | ^1.5.4 | MIT | QR code generation (used for join-game codes) |
Correction (2026-08-15): this table previously only listed vue/vue-i18n and omitted three dependencies already present in package.json's dependencies at the time — @sentry/vue, posthog-js, qrcode. All three are permissive (MIT / Apache-2.0), so this was a documentation gap, not a compliance issue — but re-run npm ls --depth=0 --prod before each release rather than trusting this table, since it will go stale again the next time a dependency is added.
Development Dependencies
| Package | Version | Likely License | Notes |
|---|---|---|---|
| @playwright/test | ^1.62.1 | Apache 2.0 | E2E testing framework |
| @tailwindcss/vite | ^4.3.3 | MIT | Tailwind CSS Vite integration |
| @types/node | ^24 | MIT | TypeScript types for Node.js |
| @vitejs/plugin-vue | ^6.0.8 | MIT | Vite plugin for Vue |
| @vue/test-utils | ^2.4.11 | MIT | Vue testing utilities |
| jsdom | ^30.0.1 | MIT | DOM implementation for Node.js |
| tailwindcss | ^4.3.3 | MIT | Utility-first CSS framework |
| typescript | 5.7.3 | Apache 2.0 | TypeScript compiler |
| vite | ^8.2.1 | MIT | Frontend build tool |
| vitest | ^4.1.10 | MIT | Unit testing framework |
| vue-tsc | ^3.3.9 | MIT | TypeScript compiler for Vue |
License Summary for Frontend:
- MIT-licensed: 10 of 11 production + dev dependencies are MIT-licensed (permissive, minimal restrictions).
- Apache 2.0-licensed: 2 dependencies (@playwright/test, typescript).
- Compatibility: MIT and Apache 2.0 are mutually compatible. Both permit commercial use, modification, and distribution.
Copyleft Licenses
None of the frontend dependencies are copyleft-licensed. No obligation to release source code of the frontend or derived works.
Frontend License Selection — Resolved
Decision: proprietary / All Rights Reserved (see above), not open-source. MIT and Apache-2.0 dependencies still impose an obligation independent of the frontend's own license: their own license notices must be preserved/reproduced somewhere in the distributed product (typically an "open-source acknowledgements" section or file). This is a low-cost, standard practice — a proprietary product can and commonly does bundle permissively-licensed dependencies; it just needs to carry their attribution forward.
Implemented 2026-08-15: this document is already served at /legal/licenses.md and linked from the landing page footer (common.legalLicenses), so it doubles as the acknowledgements page — no separate file needed. The notice text below satisfies the MIT/Apache-2.0 "reproduce the license" requirement for each shipped runtime dependency.
Open-Source Acknowledgements (shipped runtime dependencies)
Vue.js — Copyright (c) 2018-present, Yuxi (Evan) You. MIT License.
vue-i18n — Copyright (c) 2020 kazuya kawaguchi. MIT License.
Sentry (@sentry/vue) — Copyright (c) 2019 Functional Software, Inc. dba Sentry. MIT License.
PostHog (posthog-js) — Copyright 2020 Posthog / Hiberly, Inc.; portions Copyright 2015 Mixpanel, Inc. (inherited from code PostHog forked). Dual-licensed MIT / Apache-2.0 (see the package's own LICENSE for which files fall under which license).
qrcode (node-qrcode) — Copyright (c) 2012 Ryan Day. MIT License.
For each package, the MIT/Apache-2.0 text is the standard permissive template (reproduced in full in each package's own repository/node_modules entry); this section exists to name the copyright holders and confirm the license grant is preserved, per the terms above.
Third-Party Fonts
Resolved: fonts are self-hosted, not loaded externally. Bricolage Grotesque and IBM Plex Mono are bundled as 10 woff2 subsets within the app; there is no runtime request to fonts.googleapis.com/fonts.gstatic.com.
- License: Open Font License (OFL) for the font files themselves — this still
applies to the bundled files (self-hosting doesn't change the font's own license, only removes the third-party network request). OFL permits bundling and redistribution, including in a proprietary product, without requiring the product itself to be open-sourced.
Third-Party Services
Google Cloud Run (Hosting)
- License: Proprietary (Google Cloud Platform terms apply).
- Consideration: Data is processed by Google. Your privacy notice should disclose this (see
PRIVACY-NOTICE.md).
Redis (Data Storage)
- License: Typically dual-licensed (SSPL/Commons Clause for newer versions, Redis Modules are proprietary). See deployment configuration.
- Note: The backend uses Redis for session storage. Verify that your Redis deployment (Cloud Memorystore or self-hosted) complies with your license strategy.
Maintenance and Updates
This document should be updated:
1. When dependencies change — Run npm audit and re-verify licenses. 2. Before each production release — Ensure no license violations are present. 3. When a backend license check fails — Update Section 3 with details and resolution.
Verification Steps
To verify this document:
Frontend
```bash cd partyf-frontend npm ls --depth=0
Then manually verify each license against the table above
```
Backend
``bash cd partyf-backend make licenses-list make licenses-check ``
Contact and Review
For questions about licensing, compliance, or distribution:
Email: miguelmesachica@gmail.com
Organization: Miguel Mesa Chica (individual operator, not a registered company)
Status: Nothing here blocks publication or current SaaS operation — verified 2026-08-30 against package.json, both LICENSE files, and the OSS-attribution section above (all present and consistent). The one open item is a business decision, not a compliance gap: whether the backend's GPLv3 (see the Summary above) still fits if you ever plan to distribute rather than purely host it, or bring on a co-founder/ investor who'd see the source. That's worth a real conversation with a lawyer only if and when distribution becomes a live plan — not before.