Every value shown on this site comes from one of the sources below. This page is generated from the same register the application reads at runtime, so it cannot drift from what the code actually uses.
Sources in use (11)
U.S. Geological Survey (USGS)
In use
Data
Earthquake events: magnitude, depth, epicentre, place, event time
No restriction stated. Feeds regenerate roughly every 60s; we cache 60s.
Retention
No restriction stated. Internal policy: normalised events kept 30 days.
Personal data
Static feed URLs fetched server-side. No visitor data is transmitted.
Risk level
low
Reasoning
USGS states its authored data is in the U.S. Public Domain; commercial reuse is unrestricted. We ingest feed JSON only, never USGS-hosted imagery, which is the one carve-out USGS notes for third-party copyrighted media.
20 requests/second per application; 429 then blocking on violation. Identifying User-Agent with contact info is mandatory. Coordinates must be truncated to at most 4 decimals.
Caching
CONTRACTUAL: must respect the Expires header and not re-request before it passes; must cache locally and use If-Modified-Since with the exact previous Last-Modified value; must not issue HEAD followed by GET.
Retention
No restriction stated.
Personal data
Coordinates sent are our own fixed city list, never visitor geolocation. Requests originate server-side, so no visitor IP reaches MET Norway.
Risk level
low
Reasoning
CC BY 4.0 permits commercial use with attribution. Replaces Open-Meteo, whose free tier forbids commercial use. Note the caching and User-Agent obligations are contractual, not advisory.
NWS states its web content is public domain and usable without charge for any lawful purpose. Constraints honoured in UI: no claim of ownership, no implied NOAA/NWS endorsement (name and visual identifier are trademarked), no modified data presented as an official product.
No API key required and no published limit. Self-imposed poll: 15 minutes.
Caching
No restriction stated. Cached 15 minutes.
Retention
No restriction stated.
Personal data
Server-side fetch, no visitor data transmitted.
Risk level
low
Reasoning
NASA content is generally not copyrighted in the US and no API key is required. Constraints honoured: no implied NASA endorsement, NASA insignia and logotype never displayed (they are NOT public domain), and no NASA-hosted imagery is ingested. EONET is itself an aggregator, so each event's upstream sources are preserved and displayed.
No restriction stated. Cached 1 hour; upstream updates once per working day.
Retention
No restriction stated.
Personal data
Static XML fetched server-side.
Risk level
low
Reasoning
ECB permits free reuse provided it is cited as the source and modifications are disclosed. UI MUST label these as daily reference rates, not live market data. MONETISATION GATE: if this data ever appears in a paid product, buyers must be told before payment and on each access that it is obtainable free of charge from the ECB website.
Public instance states there are no limits on map views or requests. No API key, no account.
Caching
Standard browser HTTP caching. We do not redistribute tile archives.
Retention
Not applicable.
Personal data
THE ONLY third-party request made by the visitor's browser. Tile requests necessarily expose the visitor's IP address and viewed map area to the tile host. Disclosed in /privacy. No cookies are set. Eliminated entirely by self-hosting tiles - MAP_STYLE_URL is the single switch.
Risk level
low-medium
Reasoning
OpenFreeMap explicitly permits commercial use with no request limits and no API key. Attribution is mandatory and rendered permanently visible on the map. Operational risk (donation-funded, no SLA) is mitigated by MAP_STYLE_URL being a single configuration value.
Not published as a number - the project states limits are dynamic based on load, and that 4xx responses mean the caller is doing something wrong. We issue 3 regional queries every 15 minutes - 6 every 5 minutes returned HTTP 429. An API key tied to feeding data is signalled as a future requirement.
Caching
No restriction stated. Cached 15 minutes. Rate limits are described as dynamic with load; measured in practice, 6 regions every 5 minutes was refused and 3 every 15 minutes is accepted.
Retention
Aircraft positions are transient and are NOT stored. Only the aggregate count reaches the page.
Personal data
Server-side fetch; no visitor data is transmitted. We keep aggregates only - no per-aircraft history and no tracking of individual registrations, which is the part of ADS-B data that could bear on an aircraft owner rather than an airline.
Risk level
low-medium
Reasoning
Their own API documentation states 'License: ODbL 1.0' and 'The API is available to everyone'. ODbL permits commercial use with attribution - the same licence family as the OpenStreetMap data already behind our basemap. This is what OpenSky could not offer: OpenSky's free tier is research and non-commercial only. ODbL share-alike attaches to a published derivative DATABASE; we publish a produced work (a count on a card) and store no positions, so there is no derived database to share. Residual risk: access may move behind a feeder-linked API key, which would end this integration rather than breach the licence.
Documented as at most ONE call per second per application, enforced with X-RateLimit headers and HTTP 429. An identifying User-Agent of the form 'name/version (contact)' is mandatory - requests without one 'may be blocked without further notice'. We make one call every 30 minutes.
Caching
No restriction stated. Cached 30 minutes. The sitewide statistics are produced by a WEEKLY batch job that was observed running about a fortnight behind on the review date, so polling faster would only burn their rate limit. The UI shows the period the chart covers rather than implying it is current.
Retention
No restriction stated. We keep only the current chart, never a listen history.
Personal data
The sitewide endpoints are aggregates over all users - no username, no per-user listen and nothing that identifies a listener is requested or stored. Server-side fetch, so no visitor data is transmitted either.
Risk level
low-medium
Reasoning
ListenBrainz listen data is released under CC0, and the recording titles and artist names we display are MusicBrainz CORE data, which is also CC0. CAREFUL CARVE-OUT: MusicBrainz SUPPLEMENTARY data and the Live Data Feed are CC BY-NC-SA 3.0 and would be unusable here, and Cover Art Archive images are third-party artwork - so we read only track_name, artist_name and listen_count, and the caa_id fields in the response are deliberately ignored. MONETISATION GATE: CC0 imposes no legal duty, but MetaBrainz asks any company 'with a current revenue stream or an expected revenue stream' to take a paid supporter tier. This site is ad-supported, so a MetaBrainz commercial supporter account is owed before the music panel runs at scale, and this record is the reminder.
No numeric limit published for the analytics endpoints, but the User-Agent policy is CONTRACTUAL - it is incorporated into the Terms of Use by reference, and a missing or generic User-Agent is answered with HTTP 403 or blocked without notice. We issue at most a dozen requests every 30 minutes.
Caching
No restriction stated. Cached 30 minutes. Upstream, the 'top' endpoint is a daily aggregate and the hourly series lags one to two hours - we report the source timestamp rather than implying the figure is from this second.
Retention
No restriction stated. Only the current chart is kept.
Personal data
Aggregate counts only. No per-reader data exists in these endpoints, and the requests are server-side, so no visitor IP reaches Wikimedia.
Risk level
low
Reasoning
This is the answer to 'what is the internet talking about' that does not require scraping anybody: it is a metric Wikimedia publishes about itself, from an official API, with no key. Article titles are CC BY-SA 4.0, so each trending entry is attributed and links back to the article, which satisfies the licence's credit requirement; we display the title and the view count only, never article prose, so no share-alike derivative is created. Excluded by design: Main_Page and the Special: namespace, which are navigation artefacts rather than topics.
The API answers an over-eager caller with a plain-text notice asking for at most one request every 5 seconds - we saw exactly that during the review. We make one request every 15 minutes.
Caching
No restriction stated. Cached 15 minutes, which also keeps us inside their request-spacing guidance.
Retention
Headlines are not stored. Only the current set reaches the page and it is replaced on the next fetch.
Personal data
Server-side fetch of an aggregate news index. No visitor data is transmitted.
Risk level
medium
Reasoning
GDELT states that 'all datasets released by the GDELT Project are available for unlimited and unrestricted use for any academic, commercial, or governmental use of any kind without fee', conditional only on citing GDELT and linking to their site - which we do. THIS IS NOT SCRAPING AND MUST NOT BECOME IT: we call a published API, and we display only what GDELT itself publishes as index metadata - headline, publisher domain and link - never article body text, never an article image (the socialimage field is deliberately discarded), and never a copy that could substitute for reading the publisher. Every headline links to the publisher, so traffic goes to them, not away from them. The residual risk is that a headline is a publisher's own text; displaying it as an attributed link to the original is the narrowest possible use and the one the GDELT licence contemplates.
None published - it is a static object on public object storage, about 700 kB. The 60-second provider interval recomputes the position from the ephemeris already in memory and issues NO network request; a download happens only when the cached table is more than 6 hours old.
Caching
No restriction stated. The published file covers 15 days, so it is downloaded at most once every 6 hours and the position is interpolated from the cached table between downloads.
Retention
No restriction stated. The ephemeris is held in memory only.
Personal data
Server-side fetch of a static file.
Risk level
low
Reasoning
Chosen over the live-position APIs precisely because its provenance is verifiable: NASA publishes the raw ephemeris, NASA content is generally not copyrighted in the US, and the conversion to a latitude and longitude is our own arithmetic rather than somebody else's undocumented service. Same NASA constraints as EONET are honoured: no implied endorsement, and the NASA insignia and logotype are never displayed because those are NOT public domain. See wheretheiss-at for the alternative that was rejected for having no stated terms.
These were researched and deliberately not integrated. They are listed so that exclusions are auditable, and so the reasoning is not lost.
TheSportsDB (free tier)
Rejected — not used
Data
Live scores, fixtures and results across many sports
Licence
Proprietary terms of use; free tier limited to development
Commercial use
Not permitted
Rate limits
Tier-dependent; the commercial-use restriction on the free tier is dispositive.
Caching
Not applicable - source is not used.
Retention
Not applicable.
Personal data
Not applicable - source is not used.
Risk level
high
Reasoning
The terms limit the free tier to development: it may be used to 'lookup data and artwork for your development projects', and publishing an application requires a paid subscription. A public, commercially-intended website is publishing. Reselling the API is prohibited outright. UNBLOCK PATH: this is a price, not a prohibition - a paid subscriber tier permits exactly what we want, so this record flips to USE the day a subscription exists, with the artwork carve-out still to be handled (their artwork is licensed per item via strCreativeCommons, and trademarked club logos are not ours to restyle).
Free API restricted to research and non-commercial purposes
Commercial use
Not permitted
Rate limits
Not assessed; the commercial-use restriction is dispositive.
Caching
Not applicable - source is not used.
Retention
Not applicable.
Personal data
Not applicable - source is not used.
Risk level
high
Reasoning
The free API is for research and non-commercial purposes only; commercial use requires a separate agreement. RIGHT NOW is commercially intended, so this would be a terms breach. OpenSky also blocks cloud provider IP ranges, and circumventing that would breach our no-circumvention rule independently. Consequence: the aviation card ships disabled with a 'Pending licensing review' state.
The DATA licence (CC BY 4.0) is permissive but the SERVICE terms state the free API may only be used for non-commercial purposes, and it is the service terms that bind an API consumer. This distinction is the most common licensing mistake in this category. MET Norway covers the same need under CC BY 4.0. Revisit only with a paid Open-Meteo commercial plan.
Some redistribution agreements require per-viewer reporting, which would itself create a privacy obligation this MVP is designed to avoid.
Risk level
high
Reasoning
Real-time exchange data requires a paid licence plus a redistribution agreement for public display. Disproportionate for an MVP in both cost and compliance overhead. The markets card ships with ECB daily reference rates instead, clearly labelled as such. Placeholder record: docs/terms URLs point at the ECB record because this is a category-level decision with no single provider.
Football fixtures, live scores and standings for major competitions
Licence
Unverified - no terms of service page could be located on the review date
Commercial use
Unclear
Rate limits
Free tier is documented as 10 requests/minute across 12 competitions.
Caching
Unknown pending review.
Retention
Unknown pending review.
Personal data
Would be a server-side fetch with no visitor data.
Risk level
medium
Reasoning
The site says access to the top competitions 'is and will be free forever', which is a statement about price, not about permitted use. /terms and /terms-and-conditions both returned HTTP 404 on 2026-09-08 and no licence, attribution rule or redistribution rule could be found anywhere on the site. This is the same failure mode as GDACS: probably permissive, but likelihood is not permission. Consequence: the live-matches card ships in its 'Pending licensing review' state rather than showing a number we have no right to show. Unblock by obtaining written terms from the operator, whose contact address is published on the site.
Pre-computed live ISS latitude, longitude, altitude and velocity
Licence
Unverified - the developer page states no licence and no terms of use
Commercial use
Unclear
Rate limits
Documented as roughly 1 request per second. No authentication required.
Caching
Unknown pending review.
Retention
Unknown pending review.
Personal data
Would be a server-side fetch with no visitor data.
Risk level
medium
Reasoning
Convenient and widely used, but the developer page publishes a rate limit and nothing else - no licence, no terms, no statement on commercial use. Under our own rule an unverifiable source is not integrated. This one costs us nothing to refuse: NASA publishes the underlying ISS ephemeris in the public domain, so we take the raw trajectory from nasa-iss-trajectory and do the orbital arithmetic ourselves. Recorded here so it is not re-proposed as the easy option.
Global air-quality measurements aggregated from government and research networks
Licence
Indeterminate at aggregate level - effective licence is per upstream source
Commercial use
Unclear
Rate limits
API-key based; specifics not confirmed.
Caching
Unknown pending review.
Retention
Unknown pending review.
Personal data
Would be a server-side fetch with no visitor data.
Risk level
medium
Reasoning
OpenAQ states data is public but that the consumer is responsible for complying with applicable third-party terms. The effective licence is therefore per upstream network and no blanket commercial-reuse permission can be established for the aggregate. Unblock by pinning ingestion to named upstream networks whose own terms have been read, each registered separately.
Unverified - terms page returned HTTP 404 on the review date
Commercial use
Unclear
Rate limits
Unknown pending review.
Caching
Unknown pending review.
Retention
Unknown pending review.
Personal data
Would be a server-side fetch with no visitor data.
Risk level
medium
Reasoning
The disclaimer/terms page returned HTTP 404 on 2026-09-05, so terms could not be verified. An intergovernmental humanitarian source is very likely permissive, but likelihood is not permission. Unblock by locating the current terms page or obtaining a written statement.
Weekly volcanic activity reports and eruption catalogue
Licence
Unverified - site returned HTTP 403 to automated access on the review date
Commercial use
Unclear
Rate limits
Unknown pending review.
Caching
Unknown pending review.
Retention
Unknown pending review.
Personal data
Not applicable - source is not used.
Risk level
high
Reasoning
The site returned HTTP 403 to automated access on 2026-09-05. That is a deliberate access control and we do NOT work around it - no user-agent spoofing, no proxying, no headless browsing. Terms are consequently also unverified. Volcano coverage is meanwhile partially served by NASA EONET. Unblock only via an official API or written permission.