Third-Party & Open-Source Notices
Effective 2026-08-18 · Version 2.7The Lonzo service (the "Service"), operated by Vista del Lago Software LLC, includes open-source and other third-party software components that are licensed to us under their own license terms. Those licenses — which include the MIT, BSD (1-, 2- and 3-clause), Apache License, Version 2.0, ISC, Unicode-3.0, Zlib, Boost Software License 1.0, CC0-1.0, MIT-0, 0BSD, Unlicense, CDLA-Permissive-2.0, and SIL Open Font License 1.1 licenses, and the LLVM-exception to Apache-2.0 — continue to govern the components they cover, and several of them require that we reproduce the applicable copyright and permission notices. This document collects those notices and attributions.
This document is referenced from, and supplements, the Terms of Use (§ 19.13) and the Copyright, DMCA & Trademark Policy (§ 7). Nothing in the Terms of Use or those policies limits any right you have under an applicable open-source license with respect to the component it covers; in the event of a conflict between those terms and an applicable open-source license as to that component, the open-source license controls for that component.
The components below are drawn from the software that ships as part of the Service, including:
- the Android app (the Lonzo Android application and its bundled Gradle dependencies) — Android ships first;
- the web shell (the browser-side JavaScript application, its bundled dependencies, and the typeface the interface is set in — all served from our own storage, none from a public CDN); and
- the native server components that ship with the Service and their compiled dependencies.
There is a fourth plane, and this document's silence about it was not an answer. An iOS app is in development. Its Swift layer is a package in our own repository, and as of 2026-08-18 it depends on no third-party code at all — no external package, no vendored library, no bundled binary — so there is nothing about it to list here and no notice it owes anyone. That is a fact about the software rather than a scope decision, so it is stated rather than left to be inferred from three bullets that do not mention it. It is also one line from being false: adding a dependency to a Swift package is a single entry in a manifest, and none of the checks described below would have read it. Since 2026-08-18 one does, and it fails the change until this document lists the component with its license and notice. No third-party component will be in the iOS app before it appears here.
This document is the notices artifact. There is no separate notices file inside the app and no in-app "Open source licenses" screen; the notices are published here, at a stable URL, and the app links to this page. Earlier revisions of this document described both of those artifacts, and neither existed — corrected 2026-08-16 (see "Scan currency").
The Rust census below is measured, not maintained by hand: scripts/license_scan.py reads the resolved dependency graph from Cargo.lock and reports every license expression in it, and its --check mode fails when this page's crate count or license set disagrees with that graph. The Android and browser components are still enumerated by hand, because neither has an equivalent machine-readable license index — but since 2026-08-17 their completeness is checked automatically against the software that actually ships: an automated check reads the Android app's distributed dependencies and the web shell's own bundled files, and fails if a component that ships is not listed here, if a component listed here does not ship, or if a version stated here is not the version built. Since 2026-08-18 a further check reads the iOS Swift package the same way, and fails if it acquires a dependency, a vendored library, or a second dependency manifest of any kind while this document still says it has none. The license identifier and copyright line in each row remain a human determination, not a machine's.
Components and Notices
The Rust components below are as measured on 2026-08-18 by scripts/license_scan.py; the Android and browser components are as enumerated by hand on the same date, and their completeness has been held to the shipped software by an automated check since 2026-08-17 (see "Scan currency" below).
Every open-source dependency is under a permissive license, and we take on no copyleft obligation. There are no GPL, AGPL, or MPL obligations in the distributed code; one crate (r-efi) offers an LGPL option among others and we elect MIT, as recorded below. Separately, four Google components in the Android app are not open-source: they ship under Google's own SDK terms rather than an open-source license, and are listed as such.
Android app (Gradle dependencies)
| Component | License | Copyright / Notice |
|---|---|---|
| AndroidX libraries | Apache-2.0 | Copyright The Android Open Source Project. Preserve NOTICE-file contents (Apache-2.0 §4). |
| Jetpack Compose | Apache-2.0 | Copyright The Android Open Source Project. |
| Material Components for Android | Apache-2.0 | Copyright The Android Open Source Project / Google LLC. |
| kotlinx-coroutines | Apache-2.0 | Copyright JetBrains s.r.o. and contributors. |
| Coil (coil-compose, coil-svg 2.7.0) | Apache-2.0 | Copyright Coil Contributors. |
androidx.credentials 1.3.0 (incl. credentials-play-services-auth) | Apache-2.0 | Copyright The Android Open Source Project. |
| jsoup 1.23.1 | MIT | Copyright (c) 2009-2025 Jonathan Hedley. |
Android app (Google SDK components — not open-source)
These four ship in the app and are licensed by Google under its own SDK terms, not under an open-source license, so no open-source notice obligation attaches to them and none is reproduced here. They are listed because the app distributes them.
| Component | Terms |
|---|---|
Google Play Billing Library 9.1.0 (com.android.billingclient:billing) | Google Play Billing Library Terms of Service |
Google Play services Auth 21.6.0 (com.google.android.gms:play-services-auth) | Android Software Development Kit License Agreement / Google APIs Terms of Service |
Google Identity googleid 1.1.1 | Android Software Development Kit License Agreement / Google APIs Terms of Service |
ML Kit GenAI Summarization 1.0.0-beta1 (com.google.mlkit:genai-summarization) | ML Kit Terms of Service / Google APIs Terms of Service |
Web shell (third-party assets, served from our own origin)
Every third-party file the browser loads is a committed copy served from our own storage — as of 2026-08-17 none of them is fetched from a public CDN at runtime. Versions and byte hashes are recorded alongside the files themselves.
That sentence said 2026-08-15 until 2026-08-17, and it was not true on either date. The rendering libraries below stopped being CDN-loaded on 2026-08-15, but the Inter typeface was still fetched from Google's font CDN on every session, which this page did not list as a component and simultaneously denied was happening. Both halves are fixed in the same change and in the direction that makes the sentence true rather than weaker: the font files are now committed and served from our own storage like everything else, and Inter is listed below with its license. What made the error survive review is worth naming, because it is the failure mode of any completeness claim — the Cookie & Local Storage Notice and the Sub-processors page both disclosed the font request correctly and in detail throughout, so nothing a reader compared this page against was wrong; only this page's summary of it was.
| Component | License | Copyright / Notice |
|---|---|---|
| morphdom 2.7.8 | MIT | Copyright (c) Patrick Steele-Idem. |
| KaTeX 0.16.22 | MIT | Copyright (c) Khan Academy and other contributors. |
| highlight.js 11.9.0 | BSD-3-Clause | Copyright (c) Ivan Sagalaev and other contributors. |
| Mermaid 10.9.6 | MIT | Copyright (c) Knut Sveidqvist and contributors. |
Inter (web font — seven woff2 subsets) | SIL OFL 1.1 | Copyright 2020 The Inter Project Authors (github.com/rsms/inter). Full license text below; the license file is also served verbatim beside the fonts at /vendor/inter-fonts/OFL.txt. |
The Inter files are unmodified, so no Modified Version exists and the OFL's reserved-name and renaming conditions are not engaged. The stylesheet that declares them (/vendor/inter.css) is ours, generated from the font CDN's own @font-face output with the source URLs repointed at our storage; it is not Font Software.
Test and build tooling (vitest, jsdom, coverage) is dev-only and is not distributed.
Rust workspace (509 external crates)
509 external crates are in the resolved dependency graph (536 packages in Cargo.lock less the 27 workspace members). The count is the graph's, not a per-binary link analysis: it is over-inclusive by design, since an over-inclusive notice harms nobody and an under-inclusive one is a compliance failure.
| Component set | License | Copyright / Notice |
|---|---|---|
| 509 external crates (compiled dependencies) | MIT / Apache-2.0 (some with LLVM-exception) / BSD-1-Clause / BSD-2-Clause / BSD-3-Clause / ISC / Unicode-3.0 / Zlib / BSL-1.0 / CC0-1.0 / MIT-0 / 0BSD / Unlicense / CDLA-Permissive-2.0 | All permissive. Each crate's copyright and license text (MIT/BSD/ISC) applies as published with that crate, and Apache-2.0 NOTICE contents are preserved (Apache-2.0 §4). The per-crate expressions are reproducible with scripts/license_scan.py. |
| webpki-roots 1.0.8 | CDLA-Permissive-2.0 (sole license — no MIT/Apache election available) | This crate packages the Mozilla CA certificate set. CDLA-Permissive-2.0 is a permissive data license; it imposes no copyleft obligation and no source-availability offer. Text: cdla.dev/permissive-2-0. |
| r-efi 6.0.0 (UEFI stub, triple-licensed) | MIT (elected) / Apache-2.0 / LGPL-2.1-or-later — LGPL option not elected | Copyright the r-efi Authors. This crate offers an LGPL option; we elect MIT and take on no LGPL obligation for it. scripts/license_scan.py re-checks this election on every run and fails if any crate offers no permissive alternative. |
Full License Texts
The verbatim license texts below cover the components listed above, grouped by license. The per-component copyright lines are in the tables above; where a component publishes its own copyright line with its distribution, that line applies as published. This page reproduces the license texts in full — it is the only notices artifact, so nothing here defers to a second document.
MIT License
Covers: morphdom 2.7.8; KaTeX 0.16.22; Mermaid 10; and the MIT-licensed Rust crates.
MIT License
Copyright (c) <year> <copyright holders>
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
BSD 3-Clause License
Covers: highlight.js 11.9.0; and the BSD-3-Clause-licensed Rust crates.
BSD 3-Clause License
Copyright (c) <year>, <copyright holder>
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
3. Neither the name of the copyright holder nor the names of its contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Apache License, Version 2.0
Covers: the AndroidX libraries, Jetpack Compose, Material Components for Android, kotlinx-coroutines, and Coil (Android); and the Apache-2.0-licensed Rust crates. For Apache-2.0 components, the contents of any NOTICE file distributed with the component are preserved and distributed with that component, as Apache-2.0 §4 requires.
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
The text above is the complete verbatim Apache License, Version 2.0 (an earlier revision of this document abridged it and pointed at two artifacts that did not exist). Each Apache-2.0 component's NOTICE-file contents, where it publishes one, are preserved and distributed with that component as Apache-2.0 §4 requires. The canonical text is also published at www.apache.org/licenses/LICENSE-2.0.
SIL Open Font License, Version 1.1
Covers: the Inter web font (seven woff2 subsets, unmodified), served from our own storage.
Reproduced here because OFL §2 requires it: a redistributed copy of the Font Software must carry the copyright notice and this license, either as a stand-alone text file or as a human-readable header. We do both — the verbatim upstream file is served at /vendor/inter-fonts/OFL.txt beside the fonts it covers, and the text is repeated below so that this page remains the single notices artifact and nothing here defers to a second document.
Copyright 2020 The Inter Project Authors (https://github.com/rsms/inter)
This Font Software is licensed under the SIL Open Font License, Version 1.1.
This license is copied below, and is also available with a FAQ at:
https://scripts.sil.org/OFL
-----------------------------------------------------------
SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
-----------------------------------------------------------
PREAMBLE
The goals of the Open Font License (OFL) are to stimulate worldwide
development of collaborative font projects, to support the font creation
efforts of academic and linguistic communities, and to provide a free and
open framework in which fonts may be shared and improved in partnership
with others.
The OFL allows the licensed fonts to be used, studied, modified and
redistributed freely as long as they are not sold by themselves. The
fonts, including any derivative works, can be bundled, embedded,
redistributed and/or sold with any software provided that any reserved
names are not used by derivative works. The fonts and derivatives,
however, cannot be released under any other type of license. The
requirement for fonts to remain under this license does not apply
to any document created using the fonts or their derivatives.
DEFINITIONS
"Font Software" refers to the set of files released by the Copyright
Holder(s) under this license and clearly marked as such. This may
include source files, build scripts and documentation.
"Reserved Font Name" refers to any names specified as such after the
copyright statement(s).
"Original Version" refers to the collection of Font Software components as
distributed by the Copyright Holder(s).
"Modified Version" refers to any derivative made by adding to, deleting,
or substituting -- in part or in whole -- any of the components of the
Original Version, by changing formats or by porting the Font Software to a
new environment.
"Author" refers to any designer, engineer, programmer, technical
writer or other person who contributed to the Font Software.
PERMISSION & CONDITIONS
Permission is hereby granted, free of charge, to any person obtaining
a copy of the Font Software, to use, study, copy, merge, embed, modify,
redistribute, and sell modified and unmodified copies of the Font
Software, subject to the following conditions:
1) Neither the Font Software nor any of its individual components,
in Original or Modified Versions, may be sold by itself.
2) Original or Modified Versions of the Font Software may be bundled,
redistributed and/or sold with any software, provided that each copy
contains the above copyright notice and this license. These can be
included either as stand-alone text files, human-readable headers or
in the appropriate machine-readable metadata fields within text or
binary files as long as those fields can be easily viewed by the user.
3) No Modified Version of the Font Software may use the Reserved Font
Name(s) unless explicit written permission is granted by the corresponding
Copyright Holder. This restriction only applies to the primary font name as
presented to the users.
4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
Software shall not be used to promote, endorse or advertise any
Modified Version, except to acknowledge the contribution(s) of the
Copyright Holder(s) and the Author(s) or with their explicit written
permission.
5) The Font Software, modified or unmodified, in part or in whole,
must be distributed entirely under this license, and must not be
distributed under any other license. The requirement for fonts to
remain under this license does not apply to any document created
using the Font Software.
TERMINATION
This license becomes null and void if any of the above conditions are
not met.
DISCLAIMER
THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
OTHER DEALINGS IN THE FONT SOFTWARE.
The text above is the complete SIL Open Font License 1.1 as distributed with Inter. The only difference from the served file is one trailing space removed from a line of the preamble, which markdown would have stripped in any case; the byte-exact copy is the one at /vendor/inter-fonts/OFL.txt.
Other permissive licenses (Rust workspace)
Rust crates also appear under ISC, Unicode-3.0, Zlib, Boost Software License 1.0 (BSL-1.0), CC0-1.0, MIT-0, 0BSD, BSD-1-Clause, BSD-2-Clause, the Unlicense, and CDLA-Permissive-2.0; some Apache-2.0 crates carry the LLVM-exception, which only widens the grant. Each is permissive, and each crate's own copyright and license text applies as published with that crate. r-efi is triple-licensed and we elect MIT (its LGPL option is not elected). The full set is reproducible with scripts/license_scan.py, and --check fails if a crate ever appears with no permissive alternative.
Scan currency
Re-issued 2026-08-18 (v2.7). Three components were upgraded for published security advisories, and the versions stated here moved with them. KaTeX went from 0.16.9 to 0.16.22 (CVE-2025-23207, a maxExpand bypass in the vulnerable release), jsoup from 1.18.3 to 1.23.1, and Coil from 2.6.0 to 2.7.0 — jsoup and Coil because they are the parsers that read untrusted input, which is where an upgrade is worth the risk of one. The recorded byte hashes for the two KaTeX files were re-taken from the release actually downloaded; the twenty font binaries are unchanged between those two releases and their hashes are unchanged too. No license changed and no legal position on this page changed in v2.7 — what changed is that three version numbers on this page now name the code that ships.
Twenty-eight Rust package entries were also removed in v2.7, and the census moved with them: 537 → 509. Two independent changes, no additions in either:
Fifteen went with the browser leg's QPACK codec, which was rewritten as self-contained Rust after the ls-qpack binding's extern "C" callbacks were found to abort the process on a hostile field octet. That dropped ls-qpack and ls-qpack-sys together with the thirteen-crate bindgen toolchain they pulled in at build time (bindgen, cexpr, clang-sys, glob, lazycell, libloading, linux-raw-sys, peeking_take_while, prettyplease, rustc-hash, rustix, shlex, which).
Thirteen went with the retirement of an end-of-life TLS and HTTP stack that the AWS SDK crates were resolving alongside the current one: rustls 0.21, hyper 0.14, h2 0.3 and their companions (rustls-webpki 0.101, sct, hyper-rustls 0.24, tokio-rustls 0.24, socket2 0.5), plus a duplicated certificate-parsing set unified on one version (x509-parser, asn1-rs, asn1-rs-derive, der-parser, oid-registry). Twelve of these thirteen were second copies of a crate that remains in the graph at a current version; one — sct, whose function moved into rustls itself — is gone entirely.
No license identifier left the enumerated set in either change: every removed package was already covered by the permissive set above, so no notice this page owed has been withdrawn. The count is stated three times here and all three moved; scripts/license_scan.py --check is what caught that they had to.
Re-issued 2026-08-18 (v2.6). A fourth inventory existed and this document did not mention it. The scope list named three planes — Android, the web shell, the server components — and an iOS app has been in development alongside them. Nothing on this page was false: the iOS Swift package depends on no third-party code, so it owed no notice. But the reason the page was complete was a fact about a manifest, not a scope decision, and the two are not the same thing to a reader: a scope list that omits a plane reads as a decision about what this document covers, which would have kept reading correctly on the day the plane acquired a dependency. Adding one is a single .package(url:) line, and every check described above reads Gradle output, browser files, or Cargo.lock — none of them reads that manifest. The position is now stated, and a check reads the manifest, the target graph, and the whole iOS tree for a second dependency manifest or a vendored binary, failing the change while this page still says there is none. No component, license, notice or legal position on this page changed in v2.6.
Re-issued 2026-08-17 (v1.9). The reason this page gave for two of its three inventories going unchecked no longer holds. Every correction recorded below is a drift in one of the two hand-enumerated lists — under-listed twice (Inter, and jsoup plus androidx.credentials plus four Google SDK components) and over-listed once (tech.kwik:kwik and Chaquopy, carrying an LGPL-3.0 source-availability offer for code that was never distributed) — while the census that stopped drifting is the one that stopped being maintained by hand. This revision closes that asymmetry: the Android app's distributed dependencies and the web shell's bundled files are now read from the build itself and compared against the tables above in both directions, and a stated version is compared against the version built. Nothing about the components, licenses, notices or legal positions on this page changed in v1.9; what changed is that the completeness this page asserts is now something that fails a build rather than something a reader has to trust.
Re-issued 2026-08-17 (v1.7). One component was missing, and the sentence that should have caught it was the sentence asserting nothing was missing. The Inter web font was fetched from Google's font CDN on every browser session and appeared nowhere in the web-shell component table, while the same section stated that no browser asset was fetched from a public CDN at runtime and the introduction described the shell as "including assets loaded at runtime from a public CDN" — a page contradicting itself in two places about one fact. The fix moves the code rather than the text: the seven woff2 subsets are now committed and served from our own storage, so no such request is made, and Inter is listed above under the SIL OFL 1.1 with its license reproduced in full. That addition post-dated the counsel review this document recorded at the time, and added a component and a verbatim license text without changing any legal position taken here. The Cookie & Local Storage Notice and the Sub-processors page were re-issued in the same change to record that the request is gone — that direction matters, and it is the one this page had wrong: we removed the disclosures only after removing the request, never before.
Re-issued 2026-08-17 (v1.8). The approval record outlived the text it approved. This document's internal approver field still recorded a counsel review of the version published before v1.7, and nothing detected that the reviewed bytes were no longer the published ones. The field has been returned to its pending state, because an approval record's only value is being true, and the paragraph above now describes that review in the past tense. No license notice, component listing or legal position changed in v1.8.
Re-issued 2026-08-16 (v1.6). Three classes of correction, all in the direction of describing what actually ships:
- Two artifacts that did not exist were removed. This document claimed an in-app "Open source licenses" screen (6 references) and an auto-generated notices file shipped with each artifact (4 references), and deferred the complete Apache-2.0 text to both. The Android app has no such screen and no such file. This page is now the notices artifact and reproduces the full Apache-2.0 text itself.
- The Rust census was wrong and is now measured. It said 362 external crates; the resolved graph had 537 when that correction was made (it is 509 today — see the v2.7 note above, which records the twenty-eight package entries removed since). The enumerated license set omitted CDLA-Permissive-2.0 — the sole license of
webpki-roots, with no MIT/Apache election available — along with BSD-1-Clause, BSD-2-Clause, MIT-0, 0BSD, the Unlicense and the LLVM-exception.scripts/license_scan.pynow produces the census fromCargo.lockand--checkfails when this page disagrees with it, because a hand-maintained census with no generator drifts again. - Four Google SDK components were missing, and one open-source component. Play Billing 9.1.0, Play services Auth 21.6.0,
googleid1.1.1 and ML Kit GenAI Summarization ship in the app under Google's own SDK terms, not an open-source license; they are now listed as such, and the sentence "every distributed dependency is under a permissive license" — which they contradicted — has been narrowed to open-source dependencies. jsoup 1.18.3 (MIT) and androidx.credentials 1.3.0 (Apache-2.0) were also absent. The browser assets were listed as loaded from a public CDN at runtime; since 2026-08-15 they are committed copies served from our own origin, and Mermaid is 10.9.6, not "10".
Corrected 2026-08-14. An earlier revision of this document listed two Android components that the app does not ship: tech.kwik:kwik 0.10.10 (a Kotlin QUIC library) and Chaquopy 15.0.1 (an embedded-Python build plugin). Both were removed from the app before release — the Kotlin transport layer was replaced by the app's own native component, and the app embeds no Python interpreter — and neither appears in the shipped dependency tree. Their attributions have been removed, together with an LGPL-3.0 compliance section (source-availability offer, relinking notice, and license text) that applied only to tech.kwik:kwik. No corresponding-source offer is made or required, because no LGPL-licensed code is distributed. If you previously relied on that offer, note that there is no such component in the app to obtain source for; the components actually shipped are listed above, and their license texts are reproduced in this document.
Lonzo own-code copyright
Except for the third-party components listed above (which remain governed by their own licenses), the Lonzo software is © 2026 Vista del Lago Software LLC. All rights reserved.
Contact
Vista del Lago Software LLC 18381 Vista del Lago, Yorba Linda, CA 92886, USA Email: legal@lonzo.ai