License
Mailwoman is dual-licensed: AGPL-3.0-only, or LicenseRef-Commercial under a paid agreement. Both branches are offered for every release, and the branch that applies to an installation is the one it can show a key for. The offer reaches the code and model artifacts Sister Software authors, to the extent it holds or controls the rights in them. Third-party components distributed with Mailwoman, and reference data you download, stay under the terms of whoever published them, and neither branch of this offer changes those terms. The two sections below, on reference data and on what a pretrained package contains, state where to read them.
The open-source branch
Under the AGPL, three obligations attach. You keep the copyright notices (attribution). A modified
copy stays under the same license (share-alike). And if people use your modified copy over a network,
they are entitled to its corresponding source (the source offer, section 13). mailwoman doctor
reports these three by name for the installation it runs on.
Without a license key, every mailwoman command ends with a two-line notice on stderr that states the
branch. Every HTTP response from the native API and the drop-in servers includes a Server header naming
the branch and a Link: rel="license" header pointing here. JSON responses include the same in an
engine object. The notice records which branch applies, and every command runs the same with or
without a key. The AGPL grants those rights directly, so exercising them requires no key.
The commercial branch
A commercial license releases you from the source offer and the share-alike condition on the code and model artifacts we author, so you can build closed products and services on Mailwoman. The agreement you accept at checkout is the commercial license agreement, published at its own address and never edited after publication. It is the agreement that binds, and it is the document to read for what you owe and what you are owed. This page and the site terms of service describe the website and the catalog, and neither replaces a term of the agreement you accepted. What each tier covers, and the enterprise and OEM tiers, are on the pricing page.
COMMERCIAL-LICENSE.md
in the repository is a reference template, and its own opening notice states that it is not self-executing and
grants no rights on its own. It has the same ten sections in the same order, and four of them read
differently from commercial-2026-10: the template defines the licensee generically where the
published agreement identifies the entity given at checkout, the template leaves fees and term open where
the published agreement states the subscription price and the key-period mechanics, and the template's
attribution section contains a paragraph limiting the waiver to Sister Software's own attribution that
the published agreement states only in its grant section. Read the published version for a purchase
made under it. The template is where a negotiated agreement starts.
What the commercial grant does not cover
Section 2 of the agreement limits the grant to the code and model artifacts Sister Software authors.
It does not extend to third-party components distributed with Mailwoman. Those components stay under their own
licenses, and any attribution or share-alike obligation attaching to those components continues to
apply. A commercial license does not waive or relicense them.
THIRD_PARTY_NOTICES.md
lists the components we distribute and the terms that apply to each one. Reference data an operator
downloads separately is under the terms of whoever published it, and the next section states what those
terms are for each bundle we host.
Reference data you download
The resolver needs a gazetteer, and no npm package includes one. Four bundles are published for
download (candidate, poi, fr and us), and each one contains rows another party published.
Each copy engages that publisher's terms:
| Bundle | Published by | Expression | Terms as the publisher names them |
|---|---|---|---|
candidate | Who's On First; GeoNames; Overture Maps Foundation, for its Divisions theme; OpenStreetMap contributors, for the Northern Ireland postcode fold | ODbL-1.0 AND CDLA-Permissive-2.0 AND CC-BY-4.0 | Who's On First: Creative Commons Zero covers the format and structure, in those words, and the dataset is also a modification of existing open data whose sources carry their own terms. The text as retrieved on 2026-09-21 is archived at packages/corpus/data/licenses/whosonfirst-licenses.md. GeoNames: Creative Commons Attribution 4.0, the version its export readme names. Its about page names the license without a version. Both as retrieved on 2026-09-21, archived at packages/corpus/data/licenses/geonames-publication.md. Overture Maps Divisions: the Open Database License. Overture's attribution page gives its Divisions theme `License for theme: ODbL`, read 2026-09-25. The published artifact's own layer_manifest records `license = ODbL-1.0 AND CDLA-Permissive-2.0 AND CC-BY-4.0` and derives from admin-global-priority@2026-08-25, read over HTTP range requests on 2026-09-27. The admin gazetteer under that name folds Overture Divisions. On the lab host's 2026-09-15 chain, where each fold's synthetic id range makes the rows countable, Overture Divisions contributed 1,590,314 of 4,921,635 admin places, 32.31%, and all 1,590,314 reach that chain's candidate database as 18.25% of its 8,714,235 places. OpenStreetMap, for the Northern Ireland postcode fold: the Open Database License, with the credit `© OpenStreetMap contributors` and https://www.openstreetmap.org/copyright. The fold is an independent part of a collective database, so the license governs the fold and the rest of the file keeps its own terms. Read-only queries against the published artifact on 2026-10-17 found 9,514 fold rows for 4,757 places, ids 9800000000000 to 9800000004756, whose names, coordinates and bounding boxes equal the rows of postalcode-ni-osm-2026-08-05.db. They carry region 0, population 0 and no importance or name role. No row outside the fold shares a name key or a coordinate with them, and the fold has no row in candidate_ancestor or candidate_interval. The fold step runs after every pass over the admin rows and reads no other row. The fold is published by itself under the Open Database License, as the section 4.6 offer, at https://huggingface.co/datasets/sister-software/mailwoman-osm-ni-postcode-fold. The 22 Prague district rows from GeoNames share the ids 9800000000000 to 9800000000021 with the fold because both builders used one id base at the build revision 2b9894111, and they are excluded from that dataset by country and placetype. |
poi | Overture Maps Foundation | CDLA-Permissive-2.0 | Overture Places theme: CDLA-Permissive-2.0. The text as retrieved on 2026-09-21 is archived at packages/corpus/data/licenses/cdla-permissive-2.0.md. |
fr | DINUM and IGN, for Base Adresse Nationale | etalab-2.0 | Licence Ouverte 2.0, the attribution-only half of BAN's dual grant. The text as retrieved on 2026-09-21 is archived at packages/corpus/data/licenses/licence-ouverte-2.0.md. |
us | United States Department of Transportation, for the National Address Database, reaching these rows through the Overture Maps Foundation; 119 county and state bodies, for the rows OpenAddresses collected from them, likewise through Overture; United States Census Bureau, for the TIGER/Line interpolation databases in this bundle | LicenseRef-USGov-Public-Domain AND LicenseRef-OpenAddresses-PerSource | National Address Database: a work of the federal government carrying no copyright under 17 U.S.C. § 105, and the same page states it is not intended for use as a mailing list and is subject to state statutes prohibiting that use. The text as retrieved on 2026-09-21 is archived at packages/corpus/data/licenses/national-address-database.md. OpenAddresses: per-source terms that differ, which THIRD_PARTY_NOTICES.md records as commonly requiring attribution and share-alike. Every row names its contributing body. TIGER/Line: a work of the United States Government, which carries no copyright under 17 U.S.C. § 105. |
The table above is rendered from the bundle registry in the mailwoman package rather than typed here.
mailwoman data bom writes the same record as a CycloneDX 1.5 document with one data component per
artifact, under docs/static/sbom/mailwoman-data-<version>.cdx.json, and each component states whether its
license expression came from the artifact's own layer_manifest or from this registry.
What each bundle obliges you to do, and what no one has established about it:
candidate
You must:
- Link back to the Who's On First license. Its own text makes the link required and crediting the project recommended, which is the one place those two differ.
- Attribute GeoNames.
- Credit OpenStreetMap contributors for the Northern Ireland postcode fold, and keep the Open Database License on that fold and on any database derived from it.
- Read the Open Database License before redistributing this database or a database derived from it. Its share-alike term for the Overture Divisions rows is the first unresolved question below.
Unresolved:
- Whether the Open Database License's share-alike term reaches the rest of this database through the Overture Divisions rows. The expression on the artifact records ODbL-1.0, and what that requires of a redistributor depends on whether those rows form a Derivative Database with the others, an independent part of a Collective Database, or an extraction below the threshold the license sets. The Northern Ireland postcode fold is settled in the terms above.
- Whether the published 2026-08-25 artifact carries the same Overture share as the 2026-09-15 chain measured above, and which Overture Divisions release reached it. Its manifest names its admin source but not that source's own sources, and the 2026-08-25 admin gazetteer is not published, so answering either needs the 2.88 GB download.
- Which Overture record each of those places came from. `fold-overture` writes a concordance under `wd:id` alone and discards the GERS id, so no row here can be traced back to its Overture division. That bears on whether an alteration file is producible.
- Which upstream project each row's name came from. Who's On First records a geometry source per record and the corpus adapters read none of it — see docs/engineering/reference/artifact-rights-inventory.mdx.
- Whether the Ordnance Survey notice in Who's On First's source list reaches any row in this bundle. The list names Ordnance Survey of Northern Ireland under Open Government Licence v3.0 and Ordnance Survey Ireland under its own portal terms, and names Royal Mail nowhere.
- Which of the 102 sources the Who's On First list names contributed to a given record. The list was generated 2020-02-21 and the dataset has moved since, so it is evidence of what contributed up to that date.
poi
You must:
- Supply the text of the agreement with the data if you share it. That is the condition §2.1 states on sharing, and it asks for the agreement rather than for a contributor's name.
- Nothing is required of a model trained on these rows. §3.1 states the agreement imposes no restriction or obligation on Results, and §5.4 defines Results to include machine learning models.
Unresolved:
- Which upstream projects the Overture Places theme drew each row from, and what each of those requires. §3.1 is a statement about this agreement and reaches no other source's terms.
fr
You must:
- Name the source, at minimum the licensor, and the date of the last update — the condition the license states in those words.
- Do not suggest the licensor endorses the use.
Unresolved:
- Whether the election of the attribution-only half binds a redistributor of this database, since BAN is dual-licensed and the other half carries share-alike.
us
You must:
- Do not use these rows as a mailing list. That restriction is stated on the National Address Database's own page and arises from state statutes rather than from copyright, so no copyright status discharges it.
- Read the terms of the contributing body for the rows you use. The 119 OpenAddresses publishers are not one grant.
Unresolved:
- What each of the 119 contributing bodies requires. The rows name who published them and nothing here records what each one asks.
- Which state or local body supplied a given National Address Database row. Those rows read `overture:NAD` and go no further, and the database's own page states it is aggregated from state data which is aggregated from local data.
- Which state statutes the mailing-list restriction refers to, and whether any of them reaches a use other than a mailing list.
No command downloads a bundle for you. mailwoman serve and mailwoman geocode with no gazetteer print
the command to run and stop. The download happens when you run mailwoman data pull <bundle>, and that
command prints each bundle's publishers, its terms, what it obliges you to do, and what no one has
established about it, before any bytes move. mailwoman data --list prints each bundle's description, file
count, size and destination, and states no terms.
Two paths do fetch without a prompt and are not this command: a page running the browser engine
loads its model and database assets from public.mailwoman.ai as it starts, and a map surface loads fonts
and sprites from the same origin.
A commercial key does not reach any of this. The publishers above are not parties to your agreement with us, and their attribution and share-alike conditions apply to you whichever branch you are on.
What a pretrained package already contains
A model's inputs are fixed when it is trained. If you install @mailwoman/neural-weights-en-us without
pulling a single bundle still gives you artifacts built from the sources that package records, and
skipping a runtime download leaves them unchanged. To use different inputs, install a different
package.
Every published weights package includes two generated files in its tarball. LICENSE.md states the
terms above. PROVENANCE.json records each artifact it ships with its digest or unrecorded, the
sources its model card attributes with the license each one names, the base package a data-only overlay
decodes through together with that base's own sources, and the questions the record leaves open. Read
it as a record of what the model card holds: a package recording no attribution is a package whose card
records none. That is a different statement from a package with no attributable inputs. Neither file
states that an artifact is cleared for a particular use.
For the installation in front of you:
mailwoman license attribution
It reads the PROVENANCE.json of every weights package present in node_modules and prints the sources, the
inherited lineage, and what each record leaves unresolved. It names what it does not cover: reference
data you pulled separately, and whether a recorded entry is the whole of what that source requires.
Purchase a license
Checkout asks for the licensee's legal name and your acceptance of the commercial agreement. After payment you land on a page that shows your key and a refresh secret, and the same key arrives by email. Change the card, the plan, or cancel at the billing portal.
For enterprise terms, seats, or a negotiated agreement, email us about a license.
Get a key by declaration or evaluation
Three routes issue a key. Each writes it to $MAILWOMAN_CONFIG_ROOT/license/key with its refresh
secret beside it. The purchase route is above. The other two stay on the open-source branch: the key
admits the paid tiers, the source offer still applies, and the notice states it. The declare,
evaluate and setup commands ship in the release after 10.7.0, and npm view mailwoman version tells
you which release you have.
Declare an open-source, non-profit, academic or student use. An open-source project gives its public source URL and receives the key in the response. The other intents give an organization and an address at it, and the key arrives by email while the command waits for it.
mailwoman license declare --intent open-source --name "Your project" --project https://github.com/you/project
mailwoman license declare --intent academic --name "Dr You" --organization "Your University" --email you@example.edu
An open-source or non-profit key expires on the next quarter lead date at least eleven weeks after it is
issued. The lead dates are 11 March, 10 June, 10 September and 11 December. From 28 days before the
date, mailwoman license refresh re-issues the key, and the notice counts the days down. An academic or
student key lasts one year. An expired key leaves every artifact on disk working and stops new downloads
until it is re-issued.
Evaluate for thirty days with an email address. An address receives one evaluation, and the key is not re-issued. After it, declare or buy.
mailwoman license evaluate --name "Your team" --email you@example.com
mailwoman setup runs the first parse, lists the tiers for the countries you name with their size and
whether each is free or licensed, and offers these routes. A geocode that a tier would have resolved
further states the tier and the mailwoman data pull command that fetches it.
Configure and check a key
A key is a signed token verified offline against the public keys each release ships.
export MAILWOMAN_LICENSE_KEY="mwl1.…"
mailwoman license verify --online
mailwoman doctor
license verify reports valid, expired, unknown_key or invalid, and with --online also whether
mailwoman.ai still lists the key id as active and, for a self-service license, whether the license
still stands. doctor reports the branch that applies and the obligations that branch imposes. With a valid
key the notice is silent and engine.license reads LicenseRef-Commercial.
Keep the key current
A self-service license renews with its subscription, and each renewal issues a new key whose date is the paid period's end plus 14 days. The purchase page and the first email contain a refresh secret. Adopt the key once:
mailwoman license adopt "mwl1.…" --secret "<refresh secret>"
That writes the key to $MAILWOMAN_CONFIG_ROOT/license/key, which mailwoman reads when
MAILWOMAN_LICENSE_KEY is unset, and the secret to refresh.json beside it with owner-only
permissions. After a renewal, fetch the current key:
mailwoman license refresh
license verify --online and mailwoman doctor report the license's online status as one word:
active, lapsed, revoked, unknown, or unreachable.
Refunds and disputes
A full refund or a payment dispute marks the license revoked online at once. The key you hold keeps
verifying offline until its date: it is a signed statement about a period that was paid for when it
was signed, and revoking it early would break the installation of a customer whose dispute is later
decided in their favor. A dispute decided in your favor returns the license to its subscription's
state. Online checks are how a revocation reaches an installation before the key's date.