Third-party notices

Inter

This product self-hosts the Inter font through `@fontsource/inter` version

`5.3.0`. The font is distributed under the SIL Open Font License 1.1.

No browser request to Google Fonts is required.

• Font project: https://rsms.me/inter/
• Package: https://www.npmjs.com/package/@fontsource/inter
• Licence: https://openfontlicense.org/open-font-license-official-text/

GeoLite2

This product includes GeoLite2 data created by MaxMind, available from

https://www.maxmind.com.

GeoLite2 data is used only for country-level billing location evidence and

remains subject to MaxMind's GeoLite2 licence and EULA.

FFmpeg

The AI Coach worker invokes the FFmpeg command-line program as a separate

process for video frame extraction and proxy generation. FFmpeg is an upstream

third-party work; no proprietary AI Coach rights notice applies to FFmpeg,

linked codec or library code, or their notices.

The production worker deployment captured on 2026-08-06 uses the following

verified executable for the current Railway-hosted backend SaaS:

• Executable identity: `ffmpeg version 7.0.2-static`
• Platform: Linux x86-64
• Supplier build: John Van Sickle static build
• Licence reported by the executable: GPL version 3 or later
• Relevant configuration: `--enable-gpl`, `--enable-version3`, static build
• Prohibited configuration check: `--enable-nonfree` is absent
• Executable SHA-256:

`e7e7fb30477f717e6f55f9180a70386c62677ef8a4d4d1a5d948f4098aa3eb99`

• Normalized build configuration SHA-256:

`8f6c8244f85a15a6dcb9953be359c6b4845aca6b542cd29bf0bf273040f1eb6c`

• Normalized licence output SHA-256:

`ded79d175884c465e623c3664990a0d5e612c40f3efe2c1f4d6bdc74f5975c8b`

The worker requests the `libx264` encoder. The production executable was

verified as bit-for-bit identical to the supplier's public 7.0.2 archive. The

official FFmpeg 7.0.2 source archive and detached signature, the supplier

archive, configuration output, licence output and hash records are retained in

the controlled compliance evidence package.

• Project and source: https://ffmpeg.org/
• Exact upstream source: https://ffmpeg.org/releases/ffmpeg-7.0.2.tar.xz
• Upstream detached signature: https://ffmpeg.org/releases/ffmpeg-7.0.2.tar.xz.asc
• Licence and legal considerations: https://ffmpeg.org/legal.html
• Supplier: https://johnvansickle.com/ffmpeg/

No FFmpeg executable, customer container, installer, on-premises package,

appliance or public registry artifact may be distributed from this project

until the exact distributed build's licence, notices and corresponding source

have passed the separate signed OSS/IP release gate.

ffmpeg-static

The worker currently retains `ffmpeg-static` version `5.3.0` as a pinned

fallback while migration to a Talyvro-controlled `FFMPEG_BIN` is evaluated.

The npm wrapper package declares `GPL-3.0-or-later`. Its package metadata

declares binary release tag `b6.1.1`, but the captured production executable

identifies itself as FFmpeg `7.0.2-static`. Runtime identity is therefore

controlled by the executable hash, version, build-configuration and licence

evidence above rather than inferred from the wrapper's declared tag.

• Source: https://github.com/eugeneware/ffmpeg-static
• Licence metadata: https://github.com/eugeneware/ffmpeg-static/blob/master/package.json

The npm package's licence does not by itself establish the exact licence or

source identity of the platform-specific executable downloaded during

installation. The exact production package metadata, wrapper licence and

README are retained with the C2 runtime artifacts. This notice and the C2

closure apply only to the verified current backend-SaaS facts and do not

authorize distribution of a software copy.