# Third-party notices Last audited: 2026-09-01. ## Scope and project status MicroDuck Web is an unofficial community simulator. It is not affiliated with or endorsed by Pollen Robotics or Hugging Face. Names are used only to identify upstream sources. Apache License 2.0 section 6 does not grant trademark rights, and this site does not use an official logo, product photograph, or endorsement claim. No license has been selected for the original `microduck_web` application code. This notice records third-party material only and does not place the project's original code under Apache-2.0, MIT, or any other license. Selecting a root project license remains an owner decision. The production inventory described here is the output of the current Vite build and the 63-entry `public/runtime/manifest.json`. It contains exactly nine locomotion/behavior ONNX policies: - `alpha_ground_pick.onnx` - `alpha_sitstand.onnx` - `alpha_stand.onnx` - `alpha_walking.onnx` - `ball_kick_left.onnx` - `ball_kick_right.onnx` - `roller.onnx` - `roller_crouch.onnx` - `roulade.onnx` The production manifest and build do **not** contain `duck_detect`, `pet_detect`, YOLO, RKNN, or other detector assets. Detector files that exist in an upstream source checkout are outside this site's distribution. ## Pollen Robotics source material ### MicroDuck runtime - Source: - Revision: `590b986bd8c0d50ae02cb3ea2f59c463b6828168` - License declared at that revision: Apache License 2.0 - Distributed material: the nine ONNX policy files listed above - Changes: the ONNX files are copied byte-for-byte and hash-checked. Original MicroDuck Web code assembles browser observations and applies policy outputs; the policy binaries themselves are not modified. - Full license: [`public/runtime/LICENSE.microduck.txt`](public/runtime/LICENSE.microduck.txt) ### MicroDuck RL simulator - Source: - Revision: `d424a0c899f6b33cbd3daeb279913134349c0b63` - License declared at that revision: Apache License 2.0 - Distributed material: selected MJCF XML and referenced STL meshes - Changes: `scripts/sync-runtime-assets.ps1` reproducibly adds a passive mouth hinge and relocates the affected jaw geometries/site, removes the Roller source keyframe, and combines project-authored playground, ball, pickup pouch, and hand-contact proxy overlays. These are modified browser runtime models, not an unmodified upstream simulator. - Full license: [`public/runtime/LICENSE.microduck-rl.txt`](public/runtime/LICENSE.microduck-rl.txt) Apache-2.0 source attribution does not imply that Pollen Robotics reviewed, approved, or supports this website. ## Browser runtime code The following versions are pinned by `package-lock.json` and are present in, or contribute executable code to, the production browser output. | Component | Exact version or revision | License | Full text / notices | | -------------------------------- | ----------------------------------------------------------------------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | Three.js | `0.185.1`, npm source commit `2431a09f46f34c560bc8e44b33be0e567723d5b9` | MIT | [`three-MIT.txt`](public/licenses/three-MIT.txt) | | ONNX Runtime Web | `1.29.0`, upstream tag `v1.29.0` | MIT | [`onnxruntime-MIT.txt`](public/licenses/onnxruntime-MIT.txt), [`onnxruntime-ThirdPartyNotices.txt`](public/licenses/onnxruntime-ThirdPartyNotices.txt) | | ONNX Runtime Common | `1.29.0`, upstream tag `v1.29.0` | MIT | [`onnxruntime-MIT.txt`](public/licenses/onnxruntime-MIT.txt) | | MuJoCo WebAssembly | `3.12.0`, npm source commit `13827e9ee56f097f57acf69ae52b078f9839682d` | Apache-2.0 | [`mujoco-Apache-2.0.txt`](public/licenses/mujoco-Apache-2.0.txt) | | MediaPipe Tasks Vision code/WASM | npm `1.0.1`; npm registry does not publish a source revision for this package | Apache-2.0 package metadata | [`Apache-2.0.txt`](public/licenses/Apache-2.0.txt) | | FlatBuffers | `25.9.23`, npm source commit `187240970746d00bbd26b0f5873ed54d2477f9f3` | Apache-2.0 | [`Apache-2.0.txt`](public/licenses/Apache-2.0.txt) | | long.js | `5.3.2`, npm source commit `e1bcb4f65096465b69f0fd67e68fc2a79a67ade9` | Apache-2.0 | [`Apache-2.0.txt`](public/licenses/Apache-2.0.txt) | | guid-typescript | `1.0.9`, npm source commit `1870de806c3db7ba46c5b8a1387c60fc9dda9284` | ISC package metadata | [`ISC.txt`](public/licenses/ISC.txt) | | platform.js | `1.3.6`, npm source commit `f048e72e08e6ca42baf54e010d1c6e75fd01b6c8` | MIT | [`platform-MIT.txt`](public/licenses/platform-MIT.txt) | | protobuf.js | `7.6.6`, npm source commit `795704d36c4d7de5c12f10e08836697e9d3011b2` | BSD-3-Clause | [`protobufjs-BSD-3-Clause.txt`](public/licenses/protobufjs-BSD-3-Clause.txt) | | Vite browser bootstrap | `8.2.2` | MIT | [`vite-MIT.txt`](public/licenses/vite-MIT.txt) | The MuJoCo source README attributes Copyright 2021 DeepMind Technologies Limited and separately attributes the box-collision code to Copyright 2016 Svetoslav Kolev. The repository states that its source code is Apache-2.0; the WebAssembly package carries that license metadata but no separate NOTICE file. The protobuf.js runtime also brings these packages under the same BSD-3-Clause text: `@protobufjs/aspromise@1.1.2`, `@protobufjs/base64@1.1.2`, `@protobufjs/codegen@2.0.5`, `@protobufjs/eventemitter@1.1.1`, `@protobufjs/fetch@1.1.1`, `@protobufjs/float@1.0.2`, `@protobufjs/path@1.1.2`, `@protobufjs/pool@1.1.0`, and `@protobufjs/utf8@1.1.2`. `guid-typescript@1.0.9` declares `ISC` and author `nicolas` in the exact npm package metadata, but its four-file npm tarball contains no upstream license file. The linked `ISC.txt` is the complete canonical SPDX ISC license text; it is not represented as a verbatim package-specific notice. The full upstream ONNX Runtime third-party notice is retained because the WASM binary can contain compiled dependencies beyond the JavaScript package tree. Type-only packages such as `@types/node` and `undici-types` are development inputs and are not represented as production browser runtime code. ## MediaPipe hand model: separate unresolved rights The following binary is distributed separately from the Apache-2.0 MediaPipe program code: - File: `public/mediapipe/hand_landmarker.task` - Upstream URL: - Version path: Hand Landmarker float16, version `1` - Size: `7,819,105` bytes - SHA-256: `fbc2a30080c3c557093b5ddfc334698132eb341044ccee322ccf8bcf3607cde1` The MediaPipe Web documentation instructs developers to download a compatible model and store it in the project, but the audit did not find an explicit official license or terms confirming commercial redistribution, repository redistribution, or independent same-origin hosting of this model binary. The Apache-2.0 declaration for MediaPipe source code and `@mediapipe/tasks-vision` must **not** be assumed to cover `hand_landmarker.task`. Status: unresolved production redistribution risk; feature retained pending an owner decision. Concrete options that preserve hand interaction are: 1. Stop redistributing the binary and load this exact version/hash from the official Google URL at runtime, with explicit network, availability, CSP, privacy, and consent handling. 2. Obtain written model-owner terms or permission covering the intended commercial and self-hosted distribution, then retain the same-origin asset. 3. Replace only the model/runtime adapter with a separately licensed compatible hand model while preserving the existing two-hand worker, UI, and MuJoCo proxy protocol. The current upstream MediaPipe privacy notice also says Tasks APIs may send performance and utilization metrics. Whether and how that statement applies to the exact pinned Web package `1.0.1` is not authoritatively documented in its npm tarball. Production consent/privacy treatment therefore remains a separate owner review item; this notice does not infer an answer. ## Reproducibility Run `npm run licenses:sync` after installing the exact lockfile. The script checks package versions, copies package-carried texts, downloads only pinned or canonical upstream texts, normalizes them to UTF-8/LF, and publishes this notice under `/licenses/`. Runtime asset identity remains enforced separately by `public/runtime/manifest.json` and its tests.