# Licenses and attribution obligations

Nuvolari redistributes third-party data. Every obligation below is binding: the
Sources screen in the app must satisfy all of them, and none of them may be dropped
to save screen space.

## Summary

| Data | License | Mandatory credit | Notes |
|---|---|---|---|
| Radar-DPC rasters | CC BY-SA | "Radar-DPC" | **Share-alike propagates to our frames** |
| ARPA Piemonte data | CC BY 4.0, commercial OK | "Fonte: Arpa Piemonte - www.arpa.piemonte.it" | Radar volumes: licence not repeated on their page, access by email |
| ARPA Piemonte alerts | CC BY 4.0 (site notice) | as above, + link to the official bulletin | Levels republished verbatim |
| OpenStreetMap data | ODbL | "© OpenStreetMap contributors" | Must stay visible on the map |
| OpenMapTiles schema | BSD 3-Clause | "© OpenMapTiles" | Must stay visible on the map |
| OpenFreeMap service | MIT | "OpenFreeMap" — optional | Listed on the Sources screen |

## Share-alike is the constraint that shapes the backend

The Radar-DPC rasters are **CC BY-SA**. The PNG frames the worker produces — cropped,
reprojected, colourised — are a derived product, so they inherit CC BY-SA. Practical
consequences:

- The published frames and `manifest.json` are CC BY-SA and must be labelled as such.
- We cannot relicense them, and we cannot restrict their reuse.
- The share-alike obligation covers the **data**, not the app's source code or UI.

The manifest carries its own `attribution` string for exactly this reason: the credit
travels with the frames rather than being remembered at render time, and the app
displays whatever the publisher of those frames says to display.

## ARPA Piemonte: CC BY 4.0, stated in the legal notice

ARPA's legal notice at <https://www.arpa.piemonte.it/note-legali> releases environmental
and open data under **CC BY 4.0**, explicitly permitting commercial use, and requires the
credit *"Fonte: Arpa Piemonte - www.arpa.piemonte.it"*. Logos, institutional emblems,
registered trademarks and third-party content are excluded.

Both ARPA REST APIs — `api_realtime` and Meteoweb — link that notice from their OpenAPI
`description`, so anything served by them is covered without further correspondence.

The **radar volumes** are the one gap: their open-data page says only *gratuiti* and does
not repeat the licence, and the real-time access link is issued by email. Ask ARPA to
confirm both in the same message. Until then the radar adapter stays disabled — see
[data-sources.md](data-sources.md) section 2.

The credit string ARPA asks for is the full *"Fonte: Arpa Piemonte -
www.arpa.piemonte.it"*, not the bare name currently in the region config. Adopt the full
form the moment any ARPA-sourced data is actually displayed.

## Base map credits are not automatic

The OpenFreeMap style JSON has no `attribution` field, so MapLibre displays nothing on
its own. The app renders the credits itself:

- the always-visible attribution bar carries the two **mandatory** credits;
- the Sources screen lists all three with their licences and links.

The bar lists only what is actually on screen. With the offline fallback style there is
no OpenStreetMap data being displayed, so crediting OpenStreetMap there would be a false
attribution — the bar says "Mappa base non configurata" instead.

## Advertising, and why it still matters here

The app currently carries **no advertising**, so it is not a commercial product today.
Ads are a plausible future, though, and a source adopted now on non-commercial terms
would have to be ripped out then. Prefer sources that permit commercial use.

This is why **Open-Meteo's free tier** and **Blitzortung** remain listed as excluded even
though the features that would have used them are out of scope: both are
non-commercial-only, and neither should be reached for on the grounds that there are no
ads at the moment.

## Naming and independence

The app must never appear to be an official ARPA or Protezione Civile product:

- no ARPA/DPC logos, coats of arms or institutional branding;
- never the word "ufficiale" applied to the app itself (the *bulletin* is official —
  the *app* is not);
- the Sources screen carries an explicit disclaimer that Nuvolari is an independent
  app, not affiliated with, endorsed by, or operated by ARPA Piemonte or the
  Dipartimento della Protezione Civile;
- for civil-protection purposes the official channels always prevail, and the app
  says so next to every alert.