A better solution would be hosting it online and then caching it on the client.<p>With the added benefit of bring able to tell when someone else accesses your content by failing to supply a special request header.<p>I would start by trying to talk to him. If that didn't work, I would call his school and make them aware of their student's shady doings. Then I would go to Apple and point out Apple is helping this guy to infringe on your copyright (the database is comprised of public data, but your work compiling it is non-trivial).<p>If the data were kept on-line and cached in the client, you could, as a final step of escalation, render his app useless. Or worse: make it supply wrong routes.