Licenses
Videogen is built with open source software and openly licensed AI models. Read the full license texts and notices.
# Third-party licenses Everything that ships to the browser, with the terms it ships under. Licenses were checked on 2026-10-31. Update this file whenever a dependency or model changes. Full license texts and notices are generated at build time and served at `/vendor/third-party-notices.txt`. ## AI models Model weights are licensed separately from the code that runs them, so each is listed here with its own source. ### MediaPipe Face Landmarker (`face_landmarker.task`, float16, version 1) - License: Apache-2.0, stated in the model card of each of the three models in the bundle: [FaceMesh V2](https://storage.googleapis.com/mediapipe-assets/Model%20Card%20MediaPipe%20Face%20Mesh%20V2.pdf), [BlazeFace Short Range](<https://storage.googleapis.com/mediapipe-assets/MediaPipe%20BlazeFace%20Model%20Card%20(Short%20Range).pdf>) and [Blendshape V2](https://storage.googleapis.com/mediapipe-assets/Model%20Card%20Blendshape%20V2.pdf) - Source: https://storage.googleapis.com/mediapipe-models/face_landmarker/face_landmarker/float16/1/face_landmarker.task - SHA-256: `64184e229b263107bc2b804c6625db1341ff2bb731874b0bcc2fe6544e0bc9ff` - Attribution: Copyright Google LLC. Include the Apache-2.0 license text. - Scope limit from the model cards: not for identity recognition or surveillance. This app only locates facial features. ### MediaPipe Pose Landmarker Lite (`pose_landmarker_lite.task`, float16, version 1) - License: Apache-2.0, stated in the [BlazePose GHUM 3D model card](https://storage.googleapis.com/mediapipe-assets/Model%20Card%20BlazePose%20GHUM%203D.pdf) - Source: https://storage.googleapis.com/mediapipe-models/pose_landmarker/pose_landmarker_lite/float16/1/pose_landmarker_lite.task - SHA-256: `59929e1d1ee95287735ddd833b19cf4ac46d29bc7afddbbf6753c459690d574a` - Attribution: Copyright Google LLC. Include the Apache-2.0 license text. - Scope limit from the model card: not for identity recognition or surveillance. This app only locates body joints. ### MediaPipe Selfie Multiclass Segmenter (`selfie_multiclass_256x256.tflite`, float32, version 1) - License: Apache-2.0, stated in the [Multiclass Segmentation model card](https://storage.googleapis.com/mediapipe-assets/Model%20Card%20Multiclass%20Segmentation.pdf) - Source: https://storage.googleapis.com/mediapipe-models/image_segmenter/selfie_multiclass_256x256/float32/1/selfie_multiclass_256x256.tflite - SHA-256: `c6748b1253a99067ef71f7e26ca71096cd449baefa8f101900ea23016507e0e0` - Attribution: Copyright Google LLC. Include the Apache-2.0 license text. - Scope limit from the model card: not for identity recognition or surveillance, and not for uses needing pixel-perfect masks. This app only uses soft masks for visual effects. ### Depth Anything V2 Small (`model_q4f16.onnx`) - License: Apache-2.0, for the Small variant only. The Base, Large and Giant variants are CC-BY-NC-4.0 and must not be used here. - Upstream: https://github.com/DepthAnything/Depth-Anything-V2 and https://huggingface.co/depth-anything/Depth-Anything-V2-Small - ONNX conversion: https://huggingface.co/onnx-community/depth-anything-v2-small, revision `4472b7362082ad9968fee890ca0f1e5aca36b93d` - SHA-256: `eca72971aea64216d767c70c534160de53b5435b588d362bac6dbd5a73f9bf1e` - Attribution: Depth Anything V2, Yang et al., 2024. Include the Apache-2.0 license text. ### all-MiniLM-L6-v2 (`model_quantized.onnx`, tokenizer) - License: Apache-2.0, on both the upstream model and the ONNX conversion - Upstream: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2 - ONNX conversion: https://huggingface.co/Xenova/all-MiniLM-L6-v2, revision `751bff37182d3f1213fa05d7196b954e230abad9` - SHA-256 (model): `afdb6f1a0e45b715d0bb9b11772f032c399babd23bfc31fed1c170afc848bdb1` - Attribution: Sentence-Transformers, Reimers and Gurevych, 2019. Include the Apache-2.0 license text. - Use: optional. Only downloaded by a browser when the rules can't interpret a prompt. ## Libraries ### mediabunny 1.65.0 - License: MPL-2.0 - Use: unmodified, from npm. MPL-2.0 covers the files themselves: if this package's files are ever modified, those modified files must be published under MPL-2.0. - Source code: https://github.com/Vanilagy/mediabunny ### three 0.187.0 - License: MIT - Source: https://github.com/mrdoob/three.js ### @mediapipe/tasks-vision 1.2.0 - License: Apache-2.0 - Source: https://github.com/google-ai-edge/mediapipe ### onnxruntime-web 1.31.1 and onnxruntime-common 1.31.1 - License: MIT - Source: https://github.com/microsoft/onnxruntime ### @huggingface/tokenizers 0.2.0 - License: Apache-2.0 - Source: https://github.com/huggingface/tokenizers.js ### Dependencies of onnxruntime-web - flatbuffers 25.9.23: Apache-2.0 - long 5.3.2: Apache-2.0 - protobufjs 7.6.6 and its @protobufjs helper packages: BSD-3-Clause - platform 1.3.6: MIT - guid-typescript 1.0.9: ISC ## Advertising Adsterra's ad tags are loaded from Adsterra's servers on the live site under its [publisher terms](https://adsterra.com/publishers-terms-managed/). They aren't part of this codebase or redistributed by it. ## Considered and not used - **Wireface** (MIT): renders wireframe avatars driven by audio and cannot animate a photograph. - **Transformers.js** (Apache-2.0): works, but ONNX Runtime Web is all this app needs. It would also add `sharp`, whose prebuilt binaries include LGPL-licensed libvips, to the dependency tree. - **MobileBERT MNLI** (`typeform/mobilebert-uncased-mnli`, `Xenova/mobilebert-uncased-mnli`): neither repository states a license for the weights, so it can't be used commercially. - **Zod**: validation is generated from the action registry in `src/lib/animation/types.ts`, which checks the same things without another dependency. - **ONNX Runtime's WebGPU builds** (MIT): the license is fine, but the WASM files are 28 to 30 MB and Cloudflare Pages limits a file to 25 MiB. ## Test fixture `tests/fixtures/portrait.jpg` is a crop of NASA's official portrait of astronaut Eileen Collins, a United States government work in the public domain. It is used only by the test suite and is not deployed.