Licensing

The short answer

Granularity is distributed under the Apache License 2.0 with an additional ethical use clause. It is a source-available licence and it is not OSI-approved.

For the overwhelming majority of commercial uses there is no restriction: you may use it in a closed-source product, you do not have to publish your code, and you do not have to pay. The clause prohibits use by a specific and narrow set of actors, listed verbatim below.

There is one situation where the licence genuinely blocks you, and it is stated plainly rather than buried: Granularity cannot be a dependency of an OSI-licensed library, because the restriction travels to derivative works.

What is added to Apache-2.0

Three things, in plain language.

A prohibition on use by particular actors. Nazi and fascist movements, organisations practising genocide or systemic persecution, and those who materially support them. The full list is quoted below, because a paraphrase of a prohibition is worth nothing.

Automatic termination. Rights end by themselves upon prohibited use — no notice, no procedure.

The author’s choice of forum. Disputes are heard under the law of the author’s domicile, at the author’s election.

Everything else is ordinary Apache-2.0: patent grant, no copyleft, no attribution beyond the usual notice.

Who the prohibition covers

Quoted verbatim from paragraph 1 of the clause. The Software must not be used, in whole or in part, by:

(a) Any individual, group, organization, regime, movement, political party, paramilitary or military formation, or state actor that professes, promotes, endorses, or practices Nazi, neo-Nazi, fascist, white-supremacist, or any other ideology that classifies human beings into hierarchies of worth, dignity, or rights based on ethnicity, race, nationality, national origin, skin color, language, religion or absence thereof, caste, gender, sexual orientation, gender identity, disability, or any other inherent human characteristic;

(b) Any person or entity engaged in genocide, ethnic cleansing, forced deportation, apartheid, systemic persecution, incitement to hatred or violence against any of the groups described in (a), or any other act recognized as a crime against humanity under international law;

(c) Any person or entity acting on behalf of, providing material support to, or operating infrastructure for, the parties described in (a) or (b).

Paragraph 4 states the counterpart explicitly: academic research, journalism, education, historical documentation and human-rights advocacy that critically examine these ideologies are not restricted.

What changed

On 2026-08-31 the author accepted a revision of the clause, and the version you install today ships it: the LICENSE file of core 0.53.1 no longer contains two paragraphs of the earlier text:

• the mandatory compensation of at least 10% of a violator’s gross revenue;
• the non-severability of the clause from the licence.

The prohibition itself (paragraph 1) stays, and so do automatic termination (paragraph 3), the carve-out for research and journalism (paragraph 4) and the author’s choice of forum (paragraph 5). The reason was practical: in a legal review, a prohibition on use by Nazis rarely draws an objection, while a disproportionate monetary penalty draws one every time. Most refusals came from the two removed paragraphs, not from the position the licence exists to express.

The operative text is always the LICENSE file of the version you installed. Versions published before the revision carry the earlier text, compensation paragraph included; this page describes the current one, and the build checks that the description matches the installed file byte for byte.

Frequently asked

Can I use it in a closed commercial product? Yes.

Do I have to publish my source? No. There is no copyleft of any kind.

Do I have to pay? No.

Does an ordinary company fall under the restriction? No. Read paragraph 1 above: it describes ideological and criminal actors, not industries, countries or company sizes.

I have read about a 10% compensation paragraph. Where is it? It was in the earlier revision and is gone from the current text. If the version you installed still carries the old LICENSE, that paragraph applies only to the actors in paragraph 1 — nobody else.

What do I put in our licence register? The package declares SEE LICENSE IN LICENSE in package.json; there is no SPDX expression on npm to copy. For an internal register use the custom identifier:

LicenseRef-Granularity-EUC-1.1

Versions with the earlier text keep LicenseRef-Granularity-EUC-1.0.

Is it compatible with MIT, Apache or GPL when I distribute derivatives? For your own product, yes — you are distributing your product, not relicensing ours. But you cannot make Granularity a dependency of a library you publish under an OSI licence: the restriction travels to derivative works, and that is incompatible with the OSI definition. This is the real cost of the licence, and it is not softened by the revision.

Why not plain Apache-2.0? Because the author does not wish to grant the freedoms of the licence to those described in paragraph 1. That is a value judgement, not an oversight, and it is stated here rather than explained away.

Where is the authoritative text? In the LICENSE file of the repository and of every published package. This page explains it; it does not replace it, and it deliberately does not reproduce it. Two copies of a licence text are two texts that can drift apart, and the one people install must win.

For vendor questionnaires

Copy-paste answers:

• Licence: Apache License 2.0 with an Ethical Use Addendum (source-available, not OSI-approved).
• Register identifier: LicenseRef-Granularity-EUC-1.1 (-1.0 for versions with the earlier text).
• Copyleft: none. No obligation to disclose source.
• Cost: none. No royalties, no per-seat fees.
• Patent grant: yes, per Apache-2.0 §3.
• Runtime dependencies: none. The core ships zero runtime dependencies, so the transitive licence audit is empty.
• Restrictions: use is prohibited for the actors listed in paragraph 1 of the addendum; not applicable to ordinary commercial use.
• Known incompatibility: cannot be a dependency of an OSI-licensed library.

Machine-readable versions of the last two rows, generated on every build rather than maintained by hand:

• /api/v1/sbom.json — CycloneDX 1.6 inventory of what the portal installs.
• /api/v1/licenses.json — the same, grouped by licence.

Note the scope stated in those files: they cover the portal’s own dependency closure, most of which is build tooling. The library itself brings none of it — the core declares zero runtime dependencies, and you can see that in the same file.

Materials on this site

The licence above covers the library’s code. The site’s own materials do not:

The first row matters practically. Without it, copying an example would formally inherit the library’s licence with the whole clause attached — obviously not the intent, so it is written down.

Contact

Questions from legal and compliance teams: [email protected]. We aim to reply within five working days.