Last updated: 2026-06-11
This document contains legal notices, third-party license obligations, risk disclosures, and disclaimers for operators deploying Niles AI. It is intended to be distributed alongside the software.
- Niles AI License
- Third-Party Components & Licenses
- WhatsApp Integration — Risk Disclosure
- Signal Integration — License Obligations
- Vikunja — License Obligations
- Evolution API — License Obligations
- Data Privacy (GDPR / DSGVO)
- AI Disclosure (EU AI Act Art. 52)
- General Disclaimer
Niles AI is released under the GNU Affero General Public License v3.0 (AGPL-3.0-only). See LICENSE for the full text.
As a copyleft license, AGPL-3.0 requires that modified versions of the source code are made available under the same license. Additionally, Section 13 (Remote Network Interaction) requires that users interacting with the software over a network can obtain the source code.
⚠️ Re-audit needed. The figures below are from the last full audit (2026-03-03 viapip-licenses) and are now stale: they predate the addition oftiktoken,sentry-sdk, anddefusedxml, and the upgrade toopenaiv2. The transitive count and per-category counts no longer reflect the current tree. For the authoritative current set, seeuv.lock/ runpip-audit.
Last full audit performed 2026-03-03 via pip-licenses. At that time, all 148
transitive Python dependencies were verified and no GPL-only dependencies were
found in the Python dependency tree.
| License Category | Count | Compatibility |
|---|---|---|
| MIT | ~65 | Permissive — compatible with AGPL-3.0 |
| Apache-2.0 | ~30 | Permissive — compatible with AGPL-3.0, patent grant included |
| BSD (2/3-Clause) | ~25 | Permissive — compatible with AGPL-3.0 |
| MPL-2.0 | 3 | File-level copyleft — compatible with AGPL-3.0 |
| LGPL | 1 (psycopg2-binary) | Weak copyleft — compatible with AGPL-3.0 |
| ISC / PSF / Unlicense | ~5 | Permissive — compatible with AGPL-3.0 |
Conclusion: All Python dependencies are compatible with AGPL-3.0. No license conflicts detected.
psycopg2-binary (LGPL): Python imports are dynamic linking. The LGPL explicitly permits dynamic linking without triggering copyleft. Users can replace the library via pip/uv. No source disclosure required.
| Component | License | Notes |
|---|---|---|
| certifi | MPL-2.0 | Root CA bundle. File-level copyleft only. |
| pathspec | MPL-2.0 | Glob matching library. File-level copyleft only. |
| tqdm | MPL-2.0 + MIT | Dual-licensed. Progress bar (transitive via trafilatura). |
| tld | MPL-1.1 / GPL-2.0 / LGPL-2.1+ | Triple-licensed. Choose LGPL-2.1+. |
MPL-2.0 is file-level copyleft: if you modify MPL-licensed source files, those modifications must remain under MPL. Using the libraries unmodified (as Niles does) requires no source disclosure.
| Component | License | Distribution | Source |
|---|---|---|---|
| Ollama | MIT | Host-installed (not bundled) | github.com/ollama/ollama |
| PostgreSQL | PostgreSQL License | Docker image | postgresql.org |
| Caddy | Apache-2.0 | Docker image | caddyserver.com |
| SearXNG | AGPL-3.0 | Docker image | github.com/searxng/searxng |
| Evolution API | Modified Apache-2.0 | Docker image | github.com/EvolutionAPI/evolution-api |
| Vikunja | AGPL-3.0 | Docker image | vikunja.io |
| signal-cli-rest-api | MIT | Docker image | github.com/bbernhard/signal-cli-rest-api |
| signal-cli | GPLv3 | Bundled in signal-cli-rest-api image | github.com/AsamK/signal-cli |
| libsignal | AGPLv3 | Bundled in signal-cli | github.com/signalapp/libsignal |
Licenses marked in bold have copyleft obligations. Niles communicates with all Docker services exclusively via HTTP/WebSocket APIs — no linking. See sections 4, 5, and 6 below for detailed analysis.
Niles AI integrates with WhatsApp through the Evolution API, which uses an unofficial, reverse-engineered WhatsApp Web protocol. This integration is not endorsed or supported by Meta (WhatsApp).
Account suspension: WhatsApp may suspend or permanently ban accounts used with unofficial automation tools without prior warning. Account bans have been documented by multiple sources (see Baileys issue #1869).
Terms of Service violation: Using unofficial APIs to interact with WhatsApp violates the WhatsApp Terms of Service. Additionally, since January 2026, Meta explicitly prohibits AI providers from using even the official WhatsApp Business API for AI-powered message processing (see WhatsApp Business Solution Terms).
No recovery guarantee: Suspended WhatsApp accounts may not be recoverable. Loss of message history, contacts, and groups may be permanent.
By enabling the WhatsApp integration, the operator acknowledges:
- The WhatsApp integration uses unofficial, unsupported methods to communicate with WhatsApp servers.
- Use of this integration may result in account suspension or permanent ban at any time.
- The operator assumes full responsibility for any consequences arising from WhatsApp integration use, including but not limited to account loss, data loss, and business disruption.
- The software author provides no warranty or liability for WhatsApp-related account actions taken by Meta.
For commercial deployments, consider using Signal (included) or Telegram (planned) as primary messaging channels. These offer official APIs or documented integration paths with significantly lower risk.
Niles communicates with Signal through the signal-cli-rest-api Docker container. This container bundles:
- signal-cli — licensed under GPLv3 (full license)
- libsignal — licensed under AGPLv3 (full license)
- signal-cli-rest-api — licensed under MIT
Niles communicates with signal-cli-rest-api exclusively via HTTP REST API and WebSocket. Under established GPL interpretation, communication over network protocols (HTTP, WebSocket) does not constitute "linking" and therefore does not create a derivative work. The GPLv3/AGPLv3 obligations of signal-cli and libsignal do not propagate to Niles through API communication.
The AGPLv3 component (libsignal) is bundled inside signal-cli, which is bundled inside the signal-cli-rest-api Docker container. Niles does not link against libsignal directly — it communicates via HTTP.
No modifications are made to signal-cli, libsignal, or signal-cli-rest-api.
When distributing Niles AI (including the Docker Compose configuration that references signal-cli-rest-api), the following must be provided:
- signal-cli source code link: https://github.com/AsamK/signal-cli
- GPLv3 license text: https://www.gnu.org/licenses/gpl-3.0.html
- signal-cli-rest-api source code link: https://github.com/bbernhard/signal-cli-rest-api
- libsignal source code link: https://github.com/signalapp/libsignal
These obligations are fulfilled by this document.
Signal integration uses signal-cli as a Linked Device connected to the operator's existing Signal account. This is an unofficial integration not endorsed by the Signal Foundation. No SLA or availability guarantee is provided for Signal messaging functionality.
Vikunja is licensed under AGPL v3 (full license).
Niles communicates with Vikunja exclusively via its HTTP REST API (/api/v1/). Vikunja runs as a separate Docker container. Niles does not link against, modify, or bundle Vikunja source code.
Niles communicates with Vikunja exclusively via HTTP REST API. Under established AGPL interpretation, communicating with an AGPL-licensed service over a network API (HTTP) does not make the client a derivative work. Vikunja's AGPL copyleft obligations do not propagate to Niles through API communication.
The AGPL "network use" clause (Section 13) requires that users interacting with the AGPL software over a network can obtain its source code. This obligation applies to the Vikunja service itself, not to HTTP clients that call its API. (Niles is independently licensed under AGPL-3.0 by choice, not by obligation from Vikunja.)
No modifications are made to Vikunja.
When distributing Niles AI (including the Docker Compose configuration that references the Vikunja image):
- Vikunja source code: https://kolaente.dev/vikunja/vikunja
- AGPL v3 license text: https://www.gnu.org/licenses/agpl-3.0.html
These obligations are fulfilled by this document.
[Not verified] The legal assessment that HTTP API communication does not trigger AGPL copyleft is based on widely accepted interpretation but has not been tested in court for this specific configuration. If you plan commercial distribution at scale, independent legal counsel is recommended.
Evolution API is released under a modified Apache 2.0 license that includes a notification requirement.
The Evolution API license requires a visible notice in products that use it:
"Evolution API is being utilized in this product."
Source: Evolution API LICENSE
- Evolution API: https://github.com/EvolutionAPI/evolution-api
Niles AI is designed as an on-premise, self-hosted application. All data processing occurs locally on the operator's hardware:
- LLM inference: Runs locally via Ollama (no cloud API calls)
- Message storage: PostgreSQL database on local Docker volume
- Contact and calendar data: Synced from operator's own accounts, stored locally
When deploying Niles AI, the operator is the data controller under GDPR. The software author is not a data processor, as no data is transmitted to or processed by the author.
| Data Type | Storage | Source |
|---|---|---|
| WhatsApp messages | PostgreSQL (local) | Evolution API |
| Signal messages | PostgreSQL (local) | signal-cli-rest-api |
| Calendar events | PostgreSQL (local) | CalDAV / Google Calendar sync |
| Contacts | PostgreSQL (local) | CardDAV sync |
| Conversation history | PostgreSQL (local) | Web UI / messenger interactions |
| LLM memory (key-value) | PostgreSQL (local) | Agent tool calls |
The following outbound connections are made during normal operation:
| Destination | Purpose | Data Sent |
|---|---|---|
| WhatsApp servers | Message send/receive | Message content (E2E encrypted) |
| Signal servers | Message send/receive | Message content (E2E encrypted) |
| CalDAV provider | Calendar sync | Calendar credentials |
| CardDAV provider | Contact sync | Contact credentials |
| Google APIs (optional) | OAuth login, Calendar sync | OAuth tokens |
| Open-Meteo API (optional) | Weather data & geocoding | Latitude, longitude (public API, no auth) |
| Ollama (localhost) | LLM inference | Prompt text (local only) |
No data is sent to the software author or any analytics service.
Operators processing personal data of third parties (e.g., contacts, message contents) should maintain appropriate privacy documentation as required by GDPR, including a record of processing activities (Art. 30 GDPR).
Niles AI is an AI-powered personal assistant that uses a locally-hosted Large Language Model (LLM) for natural language understanding, task execution, and text generation.
| Property | Value |
|---|---|
| AI System | Niles AI (open-source, self-hosted) |
| Default Model | Llama 3.1 8B (via Ollama, locally hosted) |
| Processing | All LLM inference runs locally — no data sent to cloud AI providers |
| Purpose | Personal assistant: calendar management, messaging, task management, web search |
| Risk Category | Minimal risk (EU AI Act Art. 6) — personal productivity tool |
- All interactions with Niles AI are AI-generated responses.
- The system executes tool calls (send messages, create events, manage tasks) only after explicit user confirmation.
- LLM outputs may be inaccurate, incomplete, or inappropriate. Users should verify critical information independently.
- The operator can configure the specific LLM model used via settings.
- Niles AI does not perform autonomous decision-making with legal or significant personal effects.
- The system does not perform biometric identification, social scoring, or emotion recognition.
- Output quality depends on the locally deployed model and available hardware resources.
Niles AI is provided "as is", without warranty of any kind, express or implied. See the AGPL-3.0 License for the full warranty disclaimer.
In particular:
-
Third-party services: Niles AI integrates with third-party services (WhatsApp, Signal, Vikunja, calendar/contact providers). The availability, terms, and behavior of these services are outside the control of the software author.
-
Unofficial integrations: WhatsApp and Signal integrations use unofficial methods. Service disruption or account actions by the respective platform operators may occur without notice.
-
Legal compliance: The operator is solely responsible for ensuring that their use of Niles AI complies with applicable laws and regulations, including but not limited to GDPR, telecommunications regulations, and platform terms of service.
-
LLM output: Niles AI uses a local large language model for natural language processing. LLM outputs may be inaccurate, incomplete, or inappropriate. The operator should not rely on LLM outputs for critical decisions without independent verification.
-
No legal advice: This document provides general information about licenses and risks. It does not constitute legal advice. For specific legal questions, consult qualified legal counsel.