# Third-party notices patchfields redistributes the components below. Some are bundled into the JavaScript the site serves; others are served as separate files. Each is listed with the licence it is redistributed under, and the full licence text follows. This file covers third-party material only. It says nothing about the licence of patchfields' own source. | Component | Version | Licence | How it reaches the browser | |---|---|---|---| | [React](https://github.com/facebook/react) | 18.3.1 | MIT | bundled into `dist/assets/` | | [React DOM](https://github.com/facebook/react) | 18.3.1 | MIT | bundled into `dist/assets/` | | [three.js](https://github.com/mrdoob/three.js) | 0.158.0 | MIT | bundled into `dist/assets/` | | [MediaPipe Tasks Vision](https://github.com/google-ai-edge/mediapipe) | 1.0.1 | Apache-2.0 | served from `mediapipe/wasm/` | | MediaPipe detector weights | see below | Apache-2.0 | served from `mediapipe/models/` | The MediaPipe runtime and the detector weights are staged into `public/mediapipe/` at install time by [`scripts/mediapipe.mjs`](scripts/mediapipe.mjs), which also copies the Apache licence text and a notice in beside them. That directory is generated, not tracked, so the notice is regenerated on every install rather than committed. Only the `detect` brick loads any of it. A patch without one never fetches the runtime or the weights. --- ## MediaPipe Tasks Vision — Apache License 2.0 Copyright The MediaPipe Authors Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. The complete licence text is in [`licenses/Apache-2.0.txt`](licenses/Apache-2.0.txt). Redistributed files, copied verbatim and unmodified from the [`@mediapipe/tasks-vision`](https://www.npmjs.com/package/@mediapipe/tasks-vision) npm package: - `vision_wasm_module_internal.js` - `vision_wasm_module_internal.wasm` The npm package declares `"license": "Apache-2.0"` in its manifest but ships no licence file of its own, which is why the text is vendored here. The upstream MediaPipe repository publishes no `NOTICE` file, so Apache-2.0 §4(d) attaches no further obligation. That runtime is a bundled build and embeds other upstream projects under their own permissive terms, including Emscripten (MIT / NCSA), TensorFlow Lite (Apache-2.0) and OpenCV (Apache-2.0). ### Detector weights Pre-trained weights published by Google at `https://storage.googleapis.com/mediapipe-models/`, redistributed unmodified. **`blaze_face_short_range.tflite`** — BlazeFace short-range face detector. Its [model card](https://storage.googleapis.com/mediapipe-assets/MediaPipe%20BlazeFace%20Model%20Card%20(Short%20Range).pdf) states: *"LICENSED UNDER Apache License, Version 2.0"*. **`hand_landmarker.task`** — MediaPipe hand tracking pipeline. Its [model card](https://storage.googleapis.com/mediapipe-assets/Model%20Card%20Hand%20Tracking%20(Lite_Full)%20with%20Fairness%20Oct%202021.pdf) states: *"LICENSED UNDER Apache License, Version 2.0"*. **`efficientdet_lite0.tflite`** — EfficientDet-Lite0 object detector, trained on COCO 2017. Google publishes no model card and no licence statement for this file. Its documented provenance is Apache-2.0 at every link: the weights derive from the EfficientDet-Lite implementation in [google/automl](https://github.com/google/automl) ("Copyright 2020 Google Research", Apache-2.0), by way of TensorFlow Hub. It is treated here as Apache-2.0 by inheritance rather than by an attached grant. ### Intended use The BlazeFace and hand tracking model cards place limits on intended use. These are not licence conditions — the Apache License carries no field-of-use restriction — but they record the authors' intent. Both state verbatim: > Any form of surveillance or identity recognition is explicitly out of scope and > not enabled by this technology. Both also state that the models are not intended for human life-critical decisions. BlazeFace names entertainment and assistive technologies as its primary intended application; the hand tracking card names research and entertainment, and describes its model as meant for experimental usage. patchfields uses these models as musical control surfaces — a face or a hand steering an instrument. It performs no identification, no matching against any database, and no recording of anyone. Detection runs entirely in the browser. ### Data handling MediaPipe Tasks processes input on-device and sends no image or video data to Google. The [MediaPipe Tasks privacy notice](https://developers.google.com/edge/mediapipe/solutions/tasks#mediapipe_tasks_privacy_notice) also states that the Tasks APIs report usage metrics to Google; that applies to the mobile SDKs, and the web build redistributed here contains no telemetry endpoint. When the runtime and weights are staged locally, as they are in a normal build, the `detect` brick makes no network request at all. If staging did not happen, [`src/modular/detect.worker.js`](src/modular/detect.worker.js) falls back to fetching them from `cdn.jsdelivr.net` and `storage.googleapis.com` on first use. --- ## React, React DOM — MIT License Copyright (c) Facebook, Inc. and its affiliates. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. --- ## three.js — The MIT License Copyright © 2010-2023 three.js authors Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.