The Licence Layer of Our Terms Page: 19 Off-Site Links, 12 Hosts, 17 Distinct Link Texts

I work on OnePassApps, the team behind app.onepassapps.com. This is our own Terms page, read and counted today, 9 November 2026.

Every link we publish carries tracking parameters. This post is about the other kind of link: the ones on our Terms page that point away from our own domain, at the licences and source policies behind the text our apps quote.

One page carries all of them

I fetched all 56 URLs in our own sitemap.xml over plain HTTPS - no session, no cookies, no JavaScript - and counted every anchor in the served HTML.

• 1,058 anchors in total across the 56 pages.
• 19 of them point at another host.
• All 19 are on one page: our Terms.
• The other 55 pages in the sitemap carry no off-site link at all, and neither do the five pages we keep off the sitemap (/apps, /support, /sign-in, /sign-up, /account), which I fetched as well.

That is a statement about the served HTML, not about the running app. 33 of our pages ship the pre-JavaScript fallback card - that is where the 33 empty hrefs come from - and the panels that replace it are drawn in the browser. Nothing here says what a panel adds once the script runs.

The link text is the licence, not "read more"

Here are all 19, in the order the page serves them, with the host each one points at:

Twelve distinct hosts. Eight of the 19 go to creativecommons.org, and those eight cover five distinct licence pages: CC0 1.0, CC BY 3.0, CC BY 4.0, CC BY-SA 4.0 and CC BY 2.0 Germany. CC BY 3.0 and CC BY 2.0 Germany are each linked twice, because two different feeds are covered by the same licence. 17 of the 19 link texts are distinct.

The other hosts are the upstream policies themselves: the arXiv API terms, the NIST public-information reuse policy, the NSF digital policy, the BEA reuse notice, the Open Government Licence v3.0 at the National Archives, the Federal Reserve public-domain notice, the Wikidata licensing page, the KinoCheck API, the TVmaze API, the Lemon Squeezy charge explanation, and the UK Information Commissioner's complaints page.

The licence sits next to what we did with the text

The point of naming a licence rather than "sources" is that the page says what was done with the text next to it. Three sentences, quoted from the page:

• "NewsFlow includes arXiv research feeds. We use titles, authors and abstracts under CC0, as described in arXiv's API terms."
• "Historical GOV.UK news feed and Content API article text was reused and adapted into briefs and synthetic speech under the Open Government Licence v3.0, except where otherwise stated, with source credit and original links."
• "Historical Federal Reserve Board press-release text was reused and adapted with Board credit under its public-domain notice, except material identified as belonging to others."

The same shape runs through the rest. CC BY 3.0 and CC BY 4.0 cover the feed text that the briefs summarise. CC BY-SA 4.0 covers the Wikipedia introductions, CC BY 2.0 Germany the omdb.org abstracts and community credits, and the CC0 structured-data dedication the Wikidata scores. The agency feeds carry their own reuse notice instead of a Creative Commons licence, and the paragraph says so: "A public feed is not itself a licence for every use." The catalogue keeps media permissions apart from metadata licences - KinoCheck supplies trailer previews under its own permission, and the page says those preview frames are not offered under a Creative Commons licence at all.

Where those links point today

I fetched each of the 19 targets as well. Eighteen answered HTTP 200. The Information Commissioner's complaints page answered 403 Forbidden to an automated request, so I could not read it from here and I am not claiming anything about how it answers a browser.

What this does not cover

An earlier post of ours counted these same 19 links for their rel attributes; this one is about what they say. One build, one day, 9 November 2026, plain HTTPS from one IP with no cookies and no JavaScript. The counts are of the served HTML, so they say nothing about the panels that replace the fallback card. The 19 external targets were fetched once each, so a target that rate-limits a later reader was not seen.

I work on OnePassApps, so this is our own copy. The app guides cover the browser-local tools; the Terms page itself is the source for everything quoted above.