Music licensing

deadair is broadcast infrastructure. It grants you no rights to the music you play through it, and it ships with none. This page is the plain answer to the questions an operator actually asks before pointing a station at the internet. It is general information and not legal advice; if you run a station anybody can tune into, the person to ask is a media or intellectual-property lawyer in your own country.

Does owning the music cover it?

No, and this is the one that surprises people. Buying a download, ripping a CD you own, or holding a subscription to a streaming service covers private listening. Playing that same file to anybody else is a public performance, which is a separate right that nobody sells you along with the record.

The moment your stream is reachable by someone who is not you, you are the broadcaster.

Which rights, and how many?

Two, and they are administered separately, which is why one licence is rarely the whole answer:

• The composition — the song as written. Collected in the UK by PRS for Music, in the US by ASCAP, BMI and SESAC, and by an equivalent body nearly everywhere else.
• The sound recording — the specific master you are playing. Collected in the UK by PPL, in the US by SoundExchange under the statutory webcasting licence, which carries its own conditions on how often you may play the same artist or album in a row.

A licence covering one does not cover the other.

Does being non-commercial exempt me?

No. The rule is about public performance, not about money. A station with no adverts, no subscribers and four listeners is still performing publicly. Some collecting societies price a small or non-commercial webcaster very cheaply, which is a different thing from exempting one.

What about a private station?

Materially lower risk, and the distinction is real rather than a technicality: a stream only you can reach is closer to private listening than to broadcasting. deadair does not currently ship a listener-authentication gate on the mount — what it has is the leased mount and the audience gate, which are about not broadcasting to nobody rather than about keeping anybody out. So a private station today means keeping the address private: a LAN, a VPN, or a tunnel with authentication in front of it.

Note that "unlisted" is not "private". An address nobody has published is still reachable by anybody who finds it.

What is unambiguously clear?

Three kinds of material, and running a station on them needs nothing from anybody:

• Recordings you made or own outright, where you control both rights.
• Permissively licensed music — Creative Commons and the like — used within the terms of its licence. Read them: several forbid commercial use and several require attribution, which for a radio station means saying so on air or on the page.
• Public-domain recordings, remembering that the composition and the recording expire on different clocks. A 1920s song is very likely public domain; a 1990s recording of it is not.

Is there anything that helps if a question comes up later?

Yes, and it is worth switching on before you need it rather than after: the station records what it played. deadair.play_history holds every spin with its timestamp and its broadcast id, and the activity feed reads it back. If a collecting society asks what you played and when — which is what a reporting obligation usually amounts to — that is the record, and it exists whether or not anybody ever asks.

A note on where the music comes from

This page is about the rights to PLAY a record. There is a second question about the software that fetches one, and it is worth keeping separate because it is answered differently for each provider.

Spotify, Navidrome, Jellyfin, Emby and Plex talk to a published API, on terms their operators publish.

Deezer is read for suggestions and never for audio: the plugin asks which artists resemble one another and what to play by them, and every record it names is then fetched from whichever provider actually holds it. Its catalogue endpoints take no key and no account, and Deezer publishes no terms governing a caller like this one — which cuts both ways. Nothing here is licensed to you, and nothing stops Deezer changing or closing the endpoints, as Spotify closed the equivalent ones to new applications in November 2024. The station degrades quietly if that happens: with no similarity source it programmes from your own library.

YouTube Music does not. There is no published playback API for it, the plugin authenticates with a cookie copied from a browser, and the audio is resolved by ytaudio/, a bundled service built on yt-dlp. Three things follow, and none of them is the software's to decide for you:

• Its audio is fetched signed out. The cookie is used for search and your library only and never reaches the resolver, because YouTube serves signed-in sessions nothing the station can fetch. A record that only an account may play (age-gated, members-only, Premium-only) is skipped, and a paid account does not change that.
• Fetching this way is not something YouTube's terms contemplate. Whether that matters where you are, and to the account you use, is your call rather than this project's.
• yt-dlp's licence has two halves. Its source is public domain under the Unlicense, which is what the image installs. Its release binaries are GPLv3+, because they bundle other things. deadair depends on the source and is a wrapper around it.

The plugin ships disabled and is switched on deliberately, which is the point at which that decision gets made.

Pandora has no published API either. The plugin signs in with your email and password the way Pandora's own Android app does, using that app's partner profile from the unofficial API documentation, and then talks to the web app's API. The same three things follow:

• Playing a chosen record takes Pandora Premium. The station only ever plays chosen records, so a free or Plus account gives you search and playlists and nothing on air.
• Signing in and fetching this way is not something Pandora's terms contemplate, and Pandora can notice an account that does it. Whether that matters to you and the account you use is your call.
• It works only from the US, and it stops for everyone at once if Pandora retires that partner profile.

It too ships disabled.

Apple Music has a published catalogue API and no playback API a server may use. The plugin searches the catalogue; the audio comes from stream/apple-player, which plays each record in Apple's own web player, in Google Chrome, signed in to your subscription, and records what comes out of a sound device nobody listens to. Nothing is decrypted outside Apple's player and no protection is removed. Three things follow:

• Apple's terms are the question, not the software. MusicKit's terms expect playback a listener started, and do not expect a record talked over or synchronised with anything else, which is what a radio station does to every record. That is between you and Apple, as it is for every provider here.
• The -apple image tags contain Google Chrome, Google's own build, because only it carries the Widevine module Apple's player needs. It is Google's software under Google's terms, not part of what this repository's MIT licence covers. The other tags do not contain it.
• It plays in real time. A four-minute record takes four minutes to arrive, so a fresh station fills its cache slowly.

What deadair itself does about all this

Nothing, deliberately. It does not check licences, it does not know which country you are in, and it will happily play whatever your library holds. That is the same posture a mixing desk and a stream server take, and it is the honest one: the software cannot know what you are cleared for, and pretending to would be worse than saying so.