# Third-party dependencies & licences Phlip itself is **proprietary** ([[Notices/Licence]]), but the app includes and depends on third-party components that stay under **their own** licences. This page lists them and what each licence requires. It mirrors and expands the in-app **Third-party notices** (Settings → Legal). > [!note] Summaries, not the full texts > The licence descriptions below are summaries. The authoritative, full licence texts are available from each project (linked) and are reproduced in the app's in-app notices. Nothing here changes Phlip's proprietary licence, and nothing in Phlip's licence changes these third-party licences. ## Shipped inside the app (distributed to users) These are compiled into the APK or bundled as assets, so their licence terms travel with every install. | Component | Version | Purpose | Licence | |---|---|---|---| | AndroidX Core / Core-KTX | 1.12.0 | Core Android/Kotlin extensions | Apache-2.0 | | AndroidX Core SplashScreen | 1.0.1 | Launch splash screen | Apache-2.0 | | AndroidX AppCompat | 1.6.1 | Backward-compatible UI | Apache-2.0 | | Material Components for Android | 1.11.0 | Material UI widgets/theme | Apache-2.0 | | AndroidX WebKit | 1.10.0 | WebView asset loader (serves the web client) | Apache-2.0 | | Gson | 2.10.1 | JSON serialisation | Apache-2.0 | | Kotlin standard library | 1.9.22 | Kotlin runtime | Apache-2.0 | | NanoHTTPD | 2.3.1 | Embedded HTTP server (the host server) | BSD 3-Clause | | NanoHTTPD-Websocket | 2.3.1 | WebSocket support for the host server | BSD 3-Clause | | Lucide icons | (inline SVG) | Line icons in the web client | ISC | | cloudflared (Cloudflare Tunnel) | bundled binary (`libcloudflared.so`, arm64) | Optional Public hosting tunnel | Apache-2.0 | | Google Play Billing Library | 6.2.1 | Supporter Pack purchases (cosmetics only) | Google Play SDK Terms (proprietary) | | Google Play In-App Update (`app-update`, `app-update-ktx`) | 2.1.0 | Deliver app/security updates on Play installs | Google Play SDK Terms (proprietary) | ## Build- and test-only (not shipped to users) Used to build or test Phlip; **not** included in the installed app, so they carry no distribution obligations for end users. | Component | Version | Purpose | Licence | |---|---|---|---| | Android Gradle Plugin | 8.2.0 | Build system | Apache-2.0 | | Kotlin Gradle Plugin | 1.9.22 | Kotlin compilation | Apache-2.0 | | Gradle (wrapper) | — | Build tool | Apache-2.0 | | JUnit | 4.13.2 | Unit tests | Eclipse Public Licence 1.0 | ## First-party (no third-party licence) These are Phlip's own code, covered by the [[Licence|Phlip Proprietary Software Licence]]: - The web client — `index.html`, `app.js`, `style.css`, service worker, theme boot script. - `crypto-lite.js` — a first-party implementation of standard SHA-256 / PBKDF2 / AES-GCM, used only by browsers without Web Crypto on plain-HTTP LAN connections. - The Cloudflare edge Worker script. There are **no third-party JavaScript libraries** and **no bundled fonts** in the web client (it uses the device's system fonts). The only third-party asset in the client is the Lucide icon set (above). ## What each licence requires **Apache License 2.0** — *(most components above)* A permissive licence that allows use inside proprietary software. Requirements when redistributing: keep the licence text and any copyright/`NOTICE` attributions, and state significant changes made to the code. For Phlip this means retaining the attributions (done in the in-app notices) and, for the bundled **cloudflared** binary, shipping it with its licence/`NOTICE` and noting it is an unmodified upstream build (only renamed to `libcloudflared.so` for Android packaging). **BSD 3-Clause** — *(NanoHTTPD)* Permissive. Requirements: retain the copyright notice and licence text, and do not use the project's name to endorse or promote Phlip without permission. **ISC License** — *(Lucide icons)* Permissive, MIT-style. Requirement: retain the copyright and permission notice for the icon set. **Google Play SDK Terms** — *(Play Billing, Play In-App Update)* Proprietary Google components, not open source. Their use is governed by Google's **Play Core / Android Software Development Kit Licence Agreement** and the Google Play Terms of Service. They are used as part of a Google Play app and are not redistributed separately; there is no public attribution obligation, but Phlip is bound by Google's terms for them. **Eclipse Public Licence 1.0** — *(JUnit)* A weak-copyleft licence. Because JUnit is **test-only and not distributed** in the app, its distribution obligations do not apply to the shipped product. ## How Phlip complies - The app ships a **Third-party notices** screen (Settings → Legal) summarising these components and pointing to each project for full texts. - The **cloudflared** binary is bundled unmodified (aside from the Android filename) under Apache-2.0. Its full Apache License 2.0 text and an attribution note ship inside the app (`assets/licenses/`). Upstream cloudflared has no `NOTICE` file, so there is nothing further to reproduce under Apache-2.0 §4(d). - Public hosting through Cloudflare is additionally subject to **Cloudflare's own terms** for the account/domain you use — see [[Guides/5. Go public with Cloudflare]]. --- **Quicklinks:** [[Why Phlip|Home]] · [[Legal]] · [[Licence]] · [[Notices/Privacy]] · [[Terms]]