# Third-party notices Last audited: 2026-09-01. ## Scope and project status MicroDuck Web is an unofficial community simulator. It is not affiliated with or endorsed by Pollen Robotics or Hugging Face. Names are used only to identify upstream sources. Apache License 2.0 section 6 does not grant trademark rights, and this site does not use an official logo, product photograph, or endorsement claim. The original `microduck_web` application code is proprietary; all rights reserved. Its source repository is intentionally private, and no root open-source `LICENSE` file is provided. This notice records third-party material only and does not place the project's original code under Apache-2.0, MIT, or any other third-party license. The production inventory described here is the output of the current Vite build and the 63-entry `public/runtime/manifest.json`. It contains exactly nine locomotion/behavior ONNX policies: - `alpha_ground_pick.onnx` - `alpha_sitstand.onnx` - `alpha_stand.onnx` - `alpha_walking.onnx` - `ball_kick_left.onnx` - `ball_kick_right.onnx` - `roller.onnx` - `roller_crouch.onnx` - `roulade.onnx` The production manifest and build do **not** contain `duck_detect`, `pet_detect`, YOLO, RKNN, or other detector assets. Detector files that exist in an upstream source checkout are outside this site's distribution. ## Pollen Robotics source material ### MicroDuck runtime - Source: - Revision: `590b986bd8c0d50ae02cb3ea2f59c463b6828168` - License declared at that revision: Apache License 2.0 - Distributed material: the nine ONNX policy files listed above - Changes: the ONNX files are copied byte-for-byte and hash-checked. Original MicroDuck Web code assembles browser observations and applies policy outputs; the policy binaries themselves are not modified. - Full license: [`public/runtime/LICENSE.microduck.txt`](public/runtime/LICENSE.microduck.txt) ### MicroDuck RL simulator - Source: - Revision: `d424a0c899f6b33cbd3daeb279913134349c0b63` - License declared at that revision: Apache License 2.0 - Distributed material: selected MJCF XML and referenced STL meshes - Changes: `scripts/sync-runtime-assets.ps1` reproducibly adds a passive mouth hinge and relocates the affected jaw geometries/site, removes the Roller source keyframe, and combines project-authored playground, ball, pickup pouch, and hand-contact proxy overlays. These are modified browser runtime models, not an unmodified upstream simulator. - Full license: [`public/runtime/LICENSE.microduck-rl.txt`](public/runtime/LICENSE.microduck-rl.txt) Apache-2.0 source attribution does not imply that Pollen Robotics reviewed, approved, or supports this website. ## Browser runtime code The following versions are pinned by `package-lock.json` and are present in, or contribute executable code to, the production browser output. | Component | Exact version or revision | License | Full text / notices | | -------------------------------- | ----------------------------------------------------------------------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | Three.js | `0.185.1`, npm source commit `2431a09f46f34c560bc8e44b33be0e567723d5b9` | MIT | [`three-MIT.txt`](public/licenses/three-MIT.txt) | | ONNX Runtime Web | `1.29.0`, upstream tag `v1.29.0` | MIT | [`onnxruntime-MIT.txt`](public/licenses/onnxruntime-MIT.txt), [`onnxruntime-ThirdPartyNotices.txt`](public/licenses/onnxruntime-ThirdPartyNotices.txt) | | ONNX Runtime Common | `1.29.0`, upstream tag `v1.29.0` | MIT | [`onnxruntime-MIT.txt`](public/licenses/onnxruntime-MIT.txt) | | MuJoCo WebAssembly | `3.12.0`, npm source commit `13827e9ee56f097f57acf69ae52b078f9839682d` | Apache-2.0 | [`mujoco-Apache-2.0.txt`](public/licenses/mujoco-Apache-2.0.txt) | | MediaPipe Tasks Vision code/WASM | npm `1.0.1`; npm registry does not publish a source revision for this package | Apache-2.0 package metadata | [`Apache-2.0.txt`](public/licenses/Apache-2.0.txt) | | FlatBuffers | `25.9.23`, npm source commit `187240970746d00bbd26b0f5873ed54d2477f9f3` | Apache-2.0 | [`Apache-2.0.txt`](public/licenses/Apache-2.0.txt) | | long.js | `5.3.2`, npm source commit `e1bcb4f65096465b69f0fd67e68fc2a79a67ade9` | Apache-2.0 | [`Apache-2.0.txt`](public/licenses/Apache-2.0.txt) | | guid-typescript | `1.0.9`, npm source commit `1870de806c3db7ba46c5b8a1387c60fc9dda9284` | ISC package metadata | [`ISC.txt`](public/licenses/ISC.txt) | | platform.js | `1.3.6`, npm source commit `f048e72e08e6ca42baf54e010d1c6e75fd01b6c8` | MIT | [`platform-MIT.txt`](public/licenses/platform-MIT.txt) | | protobuf.js | `7.6.6`, npm source commit `795704d36c4d7de5c12f10e08836697e9d3011b2` | BSD-3-Clause | [`protobufjs-BSD-3-Clause.txt`](public/licenses/protobufjs-BSD-3-Clause.txt) | | Vite browser bootstrap | `8.2.2` | MIT | [`vite-MIT.txt`](public/licenses/vite-MIT.txt) | The MuJoCo source README attributes Copyright 2021 DeepMind Technologies Limited and separately attributes the box-collision code to Copyright 2016 Svetoslav Kolev. The repository states that its source code is Apache-2.0; the WebAssembly package carries that license metadata but no separate NOTICE file. The protobuf.js runtime also brings these packages under the same BSD-3-Clause text: `@protobufjs/aspromise@1.1.2`, `@protobufjs/base64@1.1.2`, `@protobufjs/codegen@2.0.5`, `@protobufjs/eventemitter@1.1.1`, `@protobufjs/fetch@1.1.1`, `@protobufjs/float@1.0.2`, `@protobufjs/path@1.1.2`, `@protobufjs/pool@1.1.0`, and `@protobufjs/utf8@1.1.2`. `guid-typescript@1.0.9` declares `ISC` and author `nicolas` in the exact npm package metadata, but its four-file npm tarball contains no upstream license file. The linked `ISC.txt` is the complete canonical SPDX ISC license text; it is not represented as a verbatim package-specific notice. The full upstream ONNX Runtime third-party notice is retained because the WASM binary can contain compiled dependencies beyond the JavaScript package tree. Type-only packages such as `@types/node` and `undici-types` are development inputs and are not represented as production browser runtime code. ## MediaPipe Hand Landmarker model: verified Apache-2.0 evidence The Hand Landmarker model has provenance and license evidence separate from the MediaPipe Tasks Vision program code: - File: `public/mediapipe/hand_landmarker.task` - Official overview: - Official Web guide: - Official Model Card: - Versioned upstream URL: - Official latest alias: - Version path: Hand Landmarker float16, version `1` - Size: `7,819,105` bytes - SHA-256: `fbc2a30080c3c557093b5ddfc334698132eb341044ccee322ccf8bcf3607cde1` - Changes: none; the same-origin file is byte-for-byte identical to both official Google bundle URLs above. - License: Apache License, Version 2.0 - Complete license text: [`Apache-2.0.txt`](public/licenses/Apache-2.0.txt) Google's official overview identifies `HandLandmarker (full)` as a float16 bundle and links, in the same model row, both the official latest bundle and the Model Card above. The Model Card covers the Lite and Full hand-tracking pipelines and states `LICENSED UNDER Apache License, Version 2.0`. The official Web guide tells developers to download a selected model, store it within the project directory, and load it through a relative or absolute model path. On 2026-09-01 the version `1` URL, the `latest` URL, and the checked-in same-origin file were independently read back. All three were exactly `7,819,105` bytes and had the SHA-256 recorded above. The reviewed Model Card was `358,044` bytes with SHA-256 `43127ff8a92e22717f0d8c30dab3efef4641a29cbf50b15ae3de001be94ab76b`. This resolves the former model-license/self-hosting release gate for this exact unmodified bundle. The model's Apache-2.0 terms apply only to that Google-supplied third-party model. They do not license the proprietary MicroDuck Web application. Apache License 2.0 section 6 grants no trademark permission, and attribution to Google or Pollen Robotics does not imply affiliation, review, endorsement, or support. The current upstream MediaPipe privacy notice also says Tasks APIs may send performance and utilization metrics. Whether and how that statement applies to the exact pinned Web package `1.0.1` is not authoritatively documented in its npm tarball. Camera disclosure and permission, on-device inference, non-persistence of frames/landmarks, and production consent/privacy treatment therefore remain a separate review item; the model-license evidence does not infer that answer. ## Reproducibility Run `npm run licenses:sync` after installing the exact lockfile. The script checks package versions, copies package-carried texts, downloads only pinned or canonical upstream texts, normalizes them to UTF-8/LF, and publishes this notice under `/licenses/`. Runtime asset identity remains enforced separately by `public/runtime/manifest.json` and its tests.