docs(about): state the GeoLite2 licence in full

The credits page named CC BY-SA 4.0 alone. MaxMind stopped distributing
GeoLite2 under that licence by itself: the databases ship under the
GeoLite End User License Agreement, which incorporates CC BY-SA 4.0 by
reference and controls wherever the two disagree. Name both, in that
order, and link the EULA. The attribution string was already there and
is unchanged; the e2e page check now asserts both licences rather than
the one that no longer stands alone.

Reconcile the self-hosting guide with the same wording, point it at the
current EULA URL, and say why the `/about` page must stay reachable — it
is where an operator's own attribution lives.

Correct the project licence line while on the page: it still claimed
AGPL-3.0, which the page's own footer contradicts. The trunk has been
PolyForm Noncommercial 1.0.0 since v1.15.19.

docs/self-hosting/geolite2.md

@@ -100,9 +100,16 @@ not immediately. A weekly `geoipupdate` followed by
 
 The databases are downloaded under your own MaxMind account, so their
 terms are between you and MaxMind — read what your account agrees to at
-<https://www.maxmind.com/en/geolite2/eula>. HealthLog's own attribution
-("this product includes GeoLite2 data created by MaxMind") is already on
-the `/about` page and covers an instance that uses them.
+<https://www.maxmind.com/en/geolite/eula>. That agreement, the GeoLite
+End User License Agreement, incorporates CC BY-SA 4.0 by reference and
+controls wherever the two disagree; both require you to attribute the
+data to MaxMind if you make it available to anyone else.
+
+HealthLog's own attribution ("This product includes GeoLite2 data
+created by MaxMind, available from https://www.maxmind.com") is already
+on the `/about` page and covers an instance that uses them. Keep that
+page reachable — it is what carries the attribution for your deployment,
+and it is served without a session for exactly that reason.
 
 ## Troubleshooting
 

e2e/v1427-public-pages.spec.ts

@@ -41,6 +41,12 @@ test.describe("v1.4.27 — public pages", () => {
     // GeoLite2 attribution is the load-bearing reason this page exists.
     await expect(page.getByText(/GeoLite2/).first()).toBeVisible();
     await expect(page.getByText(/MaxMind/).first()).toBeVisible();
+    // Both licences, because naming only the Creative Commons one understates
+    // the terms: the GeoLite EULA is what governs and CC BY-SA 4.0 rides
+    // inside it.
+    await expect(
+      page.getByText(/GeoLite End User License Agreement/i),
+    ).toBeVisible();
     await expect(page.getByText(/Attribution-ShareAlike 4\.0/i)).toBeVisible();
   });
 

src/app/about/page.tsx

@@ -8,9 +8,11 @@ import Link from "next/link";
  *
  *   1. The runtime image bundles MaxMind GeoLite2-City and
  *      GeoLite2-ASN databases for offline IP-to-location and
- *      IP-to-ASN lookups. The CC BY-SA 4.0 licence requires the
- *      attribution to be reachable from the running application,
- *      not just the source repository.
+ *      IP-to-ASN lookups. They ship under the GeoLite End User
+ *      License Agreement, which incorporates CC BY-SA 4.0 by
+ *      reference and controls over it; both want the attribution
+ *      reachable from the running application, not just from the
+ *      source repository.
  *   2. A general home for open-source credits as the project
  *      accumulates more third-party data sources (already true for
  *      the upcoming ICD-10 reference table in the iOS Health import
@@ -35,7 +37,7 @@ import Link from "next/link";
 // weakening the CSP with `unsafe-inline`.
 export const dynamic = "force-dynamic";
 
-const LAST_UPDATED = "2026-05-15";
+const LAST_UPDATED = "2026-08-02";
 
 export const metadata: Metadata = {
   title: "About — HealthLog",
@@ -119,7 +121,9 @@ export default function AboutPage() {
             >
               github.com/MBombeck/HealthLog
             </a>{" "}
-            and is licensed under the GNU Affero General Public License v3.0.
+            and is licensed under the PolyForm Noncommercial License 1.0.0.
+            Releases up to and including v1.15.18 were published under AGPL-3.0
+            and stay available under it.
           </p>
         </Section>
 
@@ -156,6 +160,15 @@ export default function AboutPage() {
             ) power the offline IP-to-location and IP-to-carrier lookups that
             decorate the admin login-overview audit table. They are distributed
             under the{" "}
+            <a
+              href="https://www.maxmind.com/en/geolite/eula"
+              target="_blank"
+              rel="noopener noreferrer"
+              className="text-primary hover:underline"
+            >
+              GeoLite End User License Agreement
+            </a>
+            , which incorporates the{" "}
             <a
               href="https://creativecommons.org/licenses/by-sa/4.0/"
               target="_blank"
@@ -163,8 +176,9 @@ export default function AboutPage() {
               className="text-primary hover:underline"
             >
               Creative Commons Attribution-ShareAlike 4.0 International License
-            </a>
-            .
+            </a>{" "}
+            by reference and controls wherever the two disagree. The attribution
+            above is what that licence asks for.
           </p>
         </Section>