@@ -36,6 +36,12 @@ Releases before 0.6.0 have their notes on the
 
 ### Changed
 
+- **The tracker is MIT.** `apps/tracker/` and the `oa.js` it builds now carry
+  the MIT licence ([`apps/tracker/LICENSE`](apps/tracker/LICENSE)); the rest of
+  the product stays AGPL-3.0. It is the one file that runs on your visitors'
+  browsers rather than on the server, so embedding it should never have raised
+  a copyleft question. The served bundle opens with a `/*! … MIT licensed … */`
+  line saying so; +69 bytes gzipped.
 - The poster's chart is drawn on a smooth curve with the dashboard's own glow,
   and the two brands no longer share one line: the site is the headline, the
   period sits in the corner, and Open Analytics signs on a small tab at the
 
@@ -23,6 +23,10 @@ anywhere else. What it grants is permission to ship your work under terms other
 than the AGPL, which is what lets the hosted service and the open project be one
 codebase. [CLA.md](CLA.md) says so in full, including why.
 
+One directory has its own licence: `apps/tracker/` is MIT, not AGPL, because it
+is the file that runs on other people's sites. A change there is released under
+MIT; the CLA already covers that.
+
 [Discussions](https://github.com/OpenLabs-so/openanalytics/discussions) are for
 questions and for ideas you want to talk through first; issues are for something
 that is wrong or missing.
 
@@ -166,6 +166,10 @@ Security reports: [SECURITY.md](SECURITY.md) — please not a public issue.
 Code: [AGPL-3.0](LICENSE). If you run a modified OpenAnalytics as a network
 service, the AGPL requires you to offer your modified source to its users.
 
+The browser tracker is the exception: `apps/tracker/` and the `oa.js` it builds
+are [MIT](apps/tracker/LICENSE), because it is the one file that runs on your
+site, not on the server. Embedding it creates no obligation under the AGPL.
+
 The "OpenAnalytics" name and the hosted service's domain identify the instance
 its authors operate and are **not** part of the license grant. A self-hosted
 instance runs the software, not the brand.
@@ -874,6 +874,11 @@ bug. A proxy or CDN in front of Caddy hands over its own address instead; see
 AGPL-3.0. If you run a modified OpenAnalytics as a network service, the license
 requires you to offer your modified source to its users.
 
+One exception: the browser tracker — everything under `apps/tracker/`, and the
+`oa.js` it builds — is [MIT](apps/tracker/LICENSE). It is the file your visitors
+download and the only part of the product that runs on your pages, so it carries
+no copyleft. The bundle says so on its first line.
+
 The "OpenAnalytics" name and the `getopen.so` domain identify the hosted service
 run by its operators and are **not** part of the license grant. Self-hosted
 instances run the software, not the brand.
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OpenLabs LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -2,6 +2,7 @@
   "name": "@openanalytics/tracker",
   "version": "0.0.0",
   "private": true,
+  "license": "MIT",
   "type": "module",
   "description": "Dependency-free browser tracker source and build output.",
   "exports": {
 
@@ -40,6 +40,18 @@ export const GZIP_BUDGET_BYTES = 9_728
 /** Uncompressed bytes. Bounds parse and compile cost, which gzip hides. */
 export const RAW_BUDGET_BYTES = 25_600
 
+/**
+ * The first line of the served bundle. The tracker is MIT while the rest of the
+ * product is AGPL-3.0 (`apps/tracker/LICENSE`), and the file a site owner's
+ * visitors download is the one place that fact has to be readable without
+ * opening the repository. `legalComments: 'none'` strips every comment the
+ * sources carry, so this is the only comment the bundle has, and it is added
+ * after minification. The `!` keeps it through any minifier a customer runs
+ * over their own assets.
+ */
+export const TRACKER_BANNER =
+  '/*! OpenAnalytics tracker. MIT licensed: github.com/OpenLabs-so/openanalytics/blob/main/apps/tracker/LICENSE */'
+
 const result = await build({
   entryPoints: [ENTRY],
   outfile: OUT_FILE,
@@ -50,6 +62,7 @@ const result = await build({
   // dragging in transpiler helpers for syntax we do not write.
   target: ['es2020', 'chrome80', 'firefox78', 'safari14', 'edge88'],
   legalComments: 'none',
+  banner: { js: TRACKER_BANNER },
   write: false,
 })
 
@@ -58,6 +71,10 @@ if (!output) {
   console.error('[tracker] esbuild produced no output')
   process.exit(1)
 }
+if (!output.text.startsWith(TRACKER_BANNER)) {
+  console.error('[tracker] the bundle does not open with its licence line')
+  process.exit(1)
+}
 
 mkdirSync(OUT_DIR, { recursive: true })
 writeFileSync(OUT_FILE, output.contents)
 
@@ -0,0 +1,42 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+/**
+ * `apps/tracker` is MIT while everything around it is AGPL-3.0 (README, "License
+ * and trademark"). The
+ * split lives in three files that nothing else reads — a LICENSE, a manifest
+ * field and the banner the build script prepends — so this is the one place
+ * that notices when one of them drifts from the other two.
+ */
+
+const ROOT = join(import.meta.dirname, '..', '..')
+const read = (...parts: string[]) => readFileSync(join(ROOT, ...parts), 'utf8')
+
+describe('the tracker licence', () => {
+  it('ships an MIT LICENSE naming the copyright holder', () => {
+    const licence = read('apps', 'tracker', 'LICENSE')
+    expect(licence.startsWith('MIT License\n')).toBe(true)
+    expect(licence).toContain('Copyright (c) 2026 OpenLabs LLC')
+    expect(licence).toContain('Permission is hereby granted, free of charge')
+  })
+
+  it('declares MIT in its manifest while the workspace root stays AGPL', () => {
+    const tracker = JSON.parse(read('apps', 'tracker', 'package.json')) as { license?: string }
+    const root = JSON.parse(read('package.json')) as { license?: string }
+    expect(tracker.license).toBe('MIT')
+    expect(root.license).toBe('AGPL-3.0-only')
+  })
+
+  it('opens the served bundle with a licence line that survives minifiers', () => {
+    // The build script is not importable (it builds on import), so its banner
+    // is read as text. `/*!` is the marker minifiers keep.
+    const script = read('scripts', 'build-tracker.mjs')
+    const banner = /export const TRACKER_BANNER =\s*'([^']+)'/.exec(script)?.[1]
+    expect(banner).toBeDefined()
+    expect(banner?.startsWith('/*!')).toBe(true)
+    expect(banner).toContain('MIT')
+    expect(banner).toContain('apps/tracker/LICENSE')
+    expect(script).toContain('banner: { js: TRACKER_BANNER }')
+  })
+})