Close OSS self-host gaps: in-repo API docs, legal notes, and packaging.

Add MIT license and docs/api, strip SaaS status/admin remnants from robots and footer, align env/compose/README with payment-free product truth.

app/api/v1/route.ts

@@ -8,6 +8,9 @@ export async function GET() {
     authentication: "Authorization: Bearer <api_key>",
     requirements: ["YouTube account connected"],
     rateLimit: "100,000 requests per minute per account",
+    billing: false,
+    notes:
+      "OSS self-hosted: full entitlements, no Stripe/credits/paywall. In-repo docs: docs/api/",
     guidance: {
       recommended:
         "For most jobs (especially 5+ audio files): POST /api/v1/upload per file, then POST /api/v1/jobs with the returned paths",

app/layout.tsx

@@ -8,7 +8,7 @@ const inter = Inter({ subsets: ["latin"] });
 const SITE_NAME = "Songs2VID";
 const DEFAULT_TITLE = "Songs2VID";
 const DEFAULT_DESCRIPTION =
-  "Self-hosted audio-to-video creation and YouTube uploading.";
+  "Payment-free self-hosted audio-to-video creation and YouTube uploading.";
 
 export const metadata: Metadata = {
   title: DEFAULT_TITLE,

app/privacy/page.tsx

@@ -1,15 +1,76 @@
 import { LegalPageLayout } from "@/components/LegalPageLayout";
+import { LEGAL_OPERATOR } from "@/lib/legal/constants";
+import { DOCS_URL, GITEA_URL } from "@/lib/plans";
 
 export default function PrivacyPage() {
   return (
     <LegalPageLayout title="Privacy Policy">
       <p>
-        Songs2VID is self-hosted software. Your operator controls the deployment, database, uploads,
-        logs, and Google OAuth configuration. Songs2VID does not include payment processing.
+        This policy describes how a <strong>self-hosted Songs2VID</strong> instance typically
+        handles data. Songs2VID OSS does not include payment processing, plans, credits, or
+        Stripe. The person or organization that operates this deployment (the &quot;operator&quot;)
+        controls the server, database, uploads, logs, and Google OAuth configuration, and is
+        responsible for privacy compliance for their users.
       </p>
+
+      <h2>1. Who is responsible</h2>
       <p>
-        Google and YouTube process account and upload data according to their own policies. Contact
-        the operator of this instance for data access or deletion requests.
+        For this software package as published by {LEGAL_OPERATOR.legalName}, contact:{" "}
+        <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>. For data on{" "}
+        <em>this running instance</em>, contact the operator of the deployment you signed into —
+        not necessarily the hosted SaaS at songs2vid.com, which is a separate product with its own
+        policies.
+      </p>
+
+      <h2>2. Data this software processes</h2>
+      <ul>
+        <li>Account profile from Google sign-in (email, name, avatar)</li>
+        <li>YouTube OAuth tokens (encrypted at rest when configured) and channel metadata</li>
+        <li>Uploaded cover art, audio, optional logos/fonts, and derived video files</li>
+        <li>Job metadata (titles, tags, privacy, layouts, watermarks)</li>
+        <li>API key hashes and rate-limit counters</li>
+      </ul>
+
+      <h2>3. Google and YouTube</h2>
+      <p>
+        Google and YouTube process account and upload data under their own terms and policies.
+        Operators must configure OAuth correctly and respect{" "}
+        <a
+          href="https://developers.google.com/terms/api-services-user-data-policy"
+          target="_blank"
+          rel="noopener noreferrer"
+        >
+          Google API Services User Data Policy
+        </a>{" "}
+        and{" "}
+        <a
+          href="https://developers.google.com/youtube/terms/developer-policies"
+          target="_blank"
+          rel="noopener noreferrer"
+        >
+          YouTube API Services Policies
+        </a>
+        .
+      </p>
+
+      <h2>4. Your choices</h2>
+      <p>
+        Use <strong>Dashboard → Settings</strong> to export or delete your account data on this
+        instance, or ask the operator. You can also revoke Google access in your{" "}
+        <a
+          href="https://security.google.com/settings/security/permissions"
+          target="_blank"
+          rel="noopener noreferrer"
+        >
+          Google Account permissions
+        </a>
+        .
+      </p>
+
+      <h2>5. Documentation</h2>
+      <p>
+        Product docs: <a href={DOCS_URL}>{DOCS_URL}</a>. Source:{" "}
+        <a href={GITEA_URL}>{GITEA_URL}</a>.
       </p>
     </LegalPageLayout>
   );

app/robots.ts

@@ -1,12 +1,17 @@
 import type { MetadataRoute } from "next";
 
+function siteUrl() {
+  const raw = process.env.NEXTAUTH_URL?.trim() || "http://localhost:3000";
+  return raw.replace(/\/$/, "");
+}
+
 export default function robots(): MetadataRoute.Robots {
   return {
     rules: {
       userAgent: "*",
       allow: "/",
-      disallow: ["/admin", "/api/admin"],
+      disallow: ["/api/", "/dashboard", "/jobs"],
     },
-    sitemap: "https://songs2vid.com/sitemap.xml",
+    sitemap: `${siteUrl()}/sitemap.xml`,
   };
 }

app/sitemap.ts

@@ -1,17 +1,27 @@
 import type { MetadataRoute } from "next";
 
-const SITE_URL = "https://songs2vid.com";
+function siteUrl() {
+  const raw = process.env.NEXTAUTH_URL?.trim() || "http://localhost:3000";
+  return raw.replace(/\/$/, "");
+}
 
 export default function sitemap(): MetadataRoute.Sitemap {
+  const base = siteUrl();
   return [
     {
-      url: SITE_URL,
+      url: base,
       lastModified: new Date(),
-      changeFrequency: "daily",
+      changeFrequency: "weekly",
       priority: 1.0,
     },
     {
-      url: `${SITE_URL}/privacy`,
+      url: `${base}/privacy`,
+      lastModified: new Date(),
+      changeFrequency: "monthly",
+      priority: 0.3,
+    },
+    {
+      url: `${base}/terms`,
       lastModified: new Date(),
       changeFrequency: "monthly",
       priority: 0.3,

app/terms/page.tsx

@@ -1,15 +1,51 @@
 import { LegalPageLayout } from "@/components/LegalPageLayout";
+import { LEGAL_OPERATOR } from "@/lib/legal/constants";
+import { DOCS_URL, GITEA_URL } from "@/lib/plans";
 
 export default function TermsPage() {
   return (
     <LegalPageLayout title="Terms of Use">
       <p>
-        Songs2VID is provided as open-source, self-hosted software without warranty. The operator of
-        each instance is responsible for availability, configuration, and user access.
+        Songs2VID OSS is open-source, <strong>payment-free, self-hosted software</strong>. These
+        terms describe use of the software and of instances that run it. They are{" "}
+        <strong>not</strong> the paid cloud Terms of Service for songs2vid.com (a separate hosted
+        product with its own billing and policies).
       </p>
+
+      <h2>1. Software license and warranty</h2>
       <p>
-        You are responsible for the media you process and upload, including compliance with
-        copyright law and YouTube&apos;s terms.
+        The source is provided under the license in the repository <code>LICENSE</code> file. The
+        software is provided <strong>without warranty</strong> of any kind. The operator of each
+        instance is responsible for availability, security, backups, configuration, and who may
+        sign in.
+      </p>
+
+      <h2>2. No paid features in this edition</h2>
+      <p>
+        This edition has no Stripe integration, subscriptions, credits, pricing pages, or paywalls.
+        Full layout, watermark, API, and playlist features are available to signed-in users of the
+        instance. Any paid offering lives only on the separate hosted SaaS product.
+      </p>
+
+      <h2>3. Your content and YouTube</h2>
+      <p>
+        You are solely responsible for media you upload and for compliance with copyright law and
+        YouTube&apos;s terms. Connecting Google/YouTube authorizes the instance to upload on your
+        behalf within the scopes granted.
+      </p>
+
+      <h2>4. Acceptable use</h2>
+      <p>
+        Do not use the software to infringe rights, abuse YouTube or Google APIs, or circumvent
+        another party&apos;s security. Operators may suspend access on their instances.
+      </p>
+
+      <h2>5. Contact</h2>
+      <p>
+        Package / project contact:{" "}
+        <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>. Instance-specific
+        support: contact your operator. Docs: <a href={DOCS_URL}>{DOCS_URL}</a>. Source:{" "}
+        <a href={GITEA_URL}>{GITEA_URL}</a>.
       </p>
     </LegalPageLayout>
   );