Open-Source Licences
policies-public/open-source-licenses.mdOpen-Source Software Notices and Licences
Version 1.0 - Effective 2026-05-28 - Last reviewed 2026-06-17 - Owner: Vezoft - Status: Published
This document is the aggregated NOTICE file for third-party open-source software ("OSS") that Vezoft (a company registered in Bulgaria under company number (EIK) 202823109, with its registered office in Kardzhali, Bulgaria) ("Vezoft", "TimerOS", "we", "us") distributes inside the TimerOS desktop application, the TimerOS public website, the client Portal, and the supporting backend services. We publish it to comply with the attribution and notice requirements that the MIT, BSD, Apache-2.0, MPL-2.0, ISC, and similar permissive licences impose on redistributors, and to be transparent about the third-party code that runs on your computer or processes data on your behalf. Because the entire legal purpose of this file is to identify the upstream packages whose copyright holders are owed attribution, the named framework, library, and crate identifiers below are intentional and are exempt from the public-policy "no-jargon" rule that applies elsewhere in policies-public/.
If you are looking for our own privacy and processor terms, see the Privacy Policy, the Sub-processors list, and the Data Processing Agreement.
1. How this notice is generated
We do not curate this list by hand. It is produced by the following automated tooling each time we cut a release, and the output is committed to the source tree alongside the build artefacts.
| Surface | Tool | Manifest input | Output committed to |
|---|---|---|---|
| TimerOS desktop application (compiled components) | cargo about generate |
timeros-desktop/src-tauri/Cargo.lock |
legal/notices/desktop-rust-notices.html and .md |
| TimerOS desktop application (web layer) | pnpm licenses list --json (or license-checker-rseidelsohn) |
timeros-desktop/pnpm-lock.yaml |
legal/notices/desktop-web-notices.md |
| Public website | npx license-checker-rseidelsohn --production --json |
timeros-website/package-lock.json |
legal/notices/website-notices.md |
| Client Portal | npx license-checker-rseidelsohn --production --json |
timeros-portal/package-lock.json |
legal/notices/portal-notices.md |
| API backend | npx license-checker-rseidelsohn --production --json |
timeros-api/package-lock.json |
legal/notices/api-notices.md |
| File server | npx license-checker-rseidelsohn --production --json |
timeros-file-server/package-lock.json |
legal/notices/file-server-notices.md |
The generated files contain, for every component: package name, version actually shipped, copyright holder(s), SPDX licence identifier, and the verbatim licence text. They are linked from the "Open-source notices" menu inside the desktop app (Help → About → Open-source notices), from the website footer at timeros.ai/legal/open-source-licenses, and from the Portal's footer.
If you have received a compiled copy of the TimerOS desktop application and want the corresponding source code for any LGPL or MPL-2.0 component, email legal@vezoft.com with the version number printed on the About screen; we will respond within 30 days with either a direct download URL or written instructions, at no charge beyond the cost of distribution.
2. Categories of licence in use, and what that means for you
Almost all the OSS we ship is under one of the permissive licences in the family below. We carry no copyleft code (GPL, AGPL, SSPL) in the desktop installer or in any client-facing artefact. A small number of LGPL and MPL-2.0 components may be present transitively in the desktop runtime; for these we comply by dynamic linking and by offering the corresponding object/source on request.
| SPDX identifier | Typical obligation we satisfy in this notice |
|---|---|
MIT, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD |
Reproduce copyright notice and licence text in this NOTICE file. No advertising restriction. |
Apache-2.0 |
Reproduce copyright notice, licence text, and the upstream NOTICE file where the project ships one. Preserve attribution of modifications. |
MPL-2.0 |
Provide source for unmodified MPL files on request; clearly identify any modifications we make. We do not modify MPL files. |
LGPL-2.1, LGPL-3.0 |
Dynamic linking only; offer object code / corresponding source for the LGPL component on request. |
Unicode-DFS-2016, CC-BY-4.0, OFL-1.1 |
Reproduce attribution; for OFL fonts, retain reserved-name clause. |
BlueOak-1.0.0, Zlib, WTFPL, Unlicense |
Permissive; attribution preserved as a courtesy. |
If any component we ship is later found to be under a licence we cannot lawfully bundle with a proprietary product (for example, a transitive dependency that switches to AGPL on a future release), we will remove or replace it in the next maintenance release and note the change in the Subprocessors changelog where the dependency is operationally relevant.
3. TimerOS desktop application — compiled components
The desktop application is built from a tree of approximately 350 compiled components resolved from Cargo.lock. The exhaustive list with verbatim licence text is in legal/notices/desktop-rust-notices.html, generated by cargo about. The most material components and their upstream licences are summarised below.
| Component | Upstream | Licence | Purpose in TimerOS Desktop |
|---|---|---|---|
Tauri (tauri, tauri-build, tauri-runtime, tauri-runtime-wry, wry) |
tauri-apps/tauri | MIT OR Apache-2.0 |
Desktop application shell; native window, IPC, packaging |
Tauri plugins (tauri-plugin-http, -shell, -dialog, -fs, -os, -process, -store, -window-state, -autostart, -updater, -notification, -global-shortcut, -clipboard-manager, -single-instance) |
tauri-apps | MIT OR Apache-2.0 |
First-party Tauri plugins for HTTP, shell, dialogs, filesystem, OS info, store, window state, autostart, updates, notifications, global shortcuts, clipboard, single-instance |
| WRY | tauri-apps/wry | MIT OR Apache-2.0 |
Cross-platform webview wrapper |
| WebKitGTK (Linux only; system-provided, dynamically linked) | webkit.org | LGPL-2.1-only OR BSD-2-Clause |
Webview on Linux. We do not bundle WebKitGTK on Windows or macOS — the system webview (WebView2 / WKWebView) is used. |
| Microsoft Edge WebView2 Loader (Windows only) | Microsoft | Distributable Code Terms | Bootstraps WebView2; redistribution permitted per Microsoft Distributable Code Terms |
serde, serde_json, serde_derive |
serde-rs | MIT OR Apache-2.0 |
Serialization for IPC and persistent state |
tokio, tokio-util, tokio-tungstenite |
tokio-rs | MIT |
Async runtime used by HTTP plugin and background tasks |
reqwest, hyper, hyper-rustls, rustls, rustls-pemfile, webpki-roots |
seanmonstar, rustls | MIT OR Apache-2.0, ISC |
HTTPS client for the API, with rustls TLS (no OpenSSL) |
windows-sys, windows-targets, windows-result |
Microsoft | MIT OR Apache-2.0 |
Windows API bindings |
objc2, objc2-foundation, objc2-app-kit, block2 |
madsmtm | MIT |
macOS API bindings |
gtk, gdk, glib, gio, cairo-rs, pango (via gtk-rs) |
gtk-rs | MIT |
Linux GTK bindings |
image, png, jpeg-decoder, tiff, webp |
image-rs | MIT OR Apache-2.0 |
Tray-icon and screenshot-thumbnail decoding |
notify, notify-debouncer-mini |
notify-rs | CC0-1.0 OR Artistic-2.0 |
Filesystem watchers for project-file uploads |
chrono, time |
chronotope | MIT OR Apache-2.0 |
Time arithmetic |
regex, regex-syntax, aho-corasick, memchr |
rust-lang/regex | MIT OR Apache-2.0 |
Substring matching inside the scored rule engine |
unicode-segmentation, unicode-normalization, unicode-width |
unicode-rs | MIT OR Apache-2.0 |
Title tokenisation for the on-device classifier |
sha2, sha1, digest, hmac |
RustCrypto | MIT OR Apache-2.0 |
Hashing for the in-process update verifier |
rand, rand_core, rand_chacha, getrandom |
rust-random | MIT OR Apache-2.0 |
Deterministic seed so the on-device classifier is reproducible across installs |
log, env_logger, tracing, tracing-subscriber |
rust-lang/log, tokio-rs | MIT OR Apache-2.0 |
Diagnostic logging |
anyhow, thiserror |
dtolnay | MIT OR Apache-2.0 |
Error types |
directories, dirs, dirs-sys |
soc | MIT OR Apache-2.0 |
Resolves local-only storage paths for the on-device classifier |
The on-device classifier itself is not third-party. The scored rule engine and the small on-device statistical classifier are Vezoft-authored, proprietary, and ship without any third-party model file. A small set of weights is trained at first run from a built-in seed dataset and stored only locally on your computer; your corrections to the classifier's output are likewise stored only locally on your computer and are never transmitted. Because we do not redistribute a third-party machine-learning model, no model card, no Hugging Face licence, no Llama Community Licence, and no Apache-2.0 model attribution applies to the classifier. The third-party crates listed above are the only third-party code paths the classifier touches, and they are covered by the table above. We maintain a model card and an EU AI Act applicability assessment for the classifier (covering training data, model architecture, and evaluation metrics), available to competent authorities on request.
4. TimerOS desktop application — Web layer
The web layer is a single-page application packaged inside the desktop installer. Dependencies are resolved from timeros-desktop/pnpm-lock.yaml. Key components:
| Component | Upstream | Licence | Purpose |
|---|---|---|---|
react, react-dom |
facebook/react | MIT |
UI framework |
vite, @vitejs/plugin-react |
vitejs | MIT |
Build tool and dev server |
@tauri-apps/api, @tauri-apps/plugin-http, @tauri-apps/plugin-shell, @tauri-apps/plugin-dialog, @tauri-apps/plugin-fs, @tauri-apps/plugin-os, @tauri-apps/plugin-store, @tauri-apps/plugin-window-state, @tauri-apps/plugin-autostart, @tauri-apps/plugin-updater, @tauri-apps/plugin-notification, @tauri-apps/plugin-global-shortcut, @tauri-apps/plugin-clipboard-manager |
tauri-apps | MIT OR Apache-2.0 |
JavaScript bindings to the Rust Tauri plugins |
@tanstack/react-query, @tanstack/react-query-devtools |
TanStack | MIT |
Server-state cache; per-resource hooks |
zustand |
pmndrs | MIT |
Client-state stores (auth, theme); persisted locally on your computer |
react-router-dom |
remix-run | MIT |
Routing in the dashboard window |
react-hook-form |
react-hook-form | MIT |
Forms |
zod, @hookform/resolvers |
colinhacks, react-hook-form | MIT |
Schema validation |
lucide-react |
lucide-icons/lucide | ISC |
Icons |
tailwindcss, @tailwindcss/forms, @tailwindcss/typography, autoprefixer, postcss |
tailwindlabs | MIT |
Styling |
recharts, d3-shape, d3-scale, d3-array, d3-time |
recharts, d3 | MIT, ISC |
Charts on the dashboard window |
date-fns, date-fns-tz |
date-fns | MIT |
Date utilities |
clsx, tailwind-merge |
lukeed, dcastil | MIT |
Class-name composition |
framer-motion |
framer | MIT |
Animations |
5. Public website (timeros-website)
| Component | Upstream | Licence |
|---|---|---|
next, next/font |
vercel/next.js | MIT |
react, react-dom |
facebook/react | MIT |
tailwindcss, @tailwindcss/typography, autoprefixer, postcss |
tailwindlabs | MIT |
lucide-react |
lucide-icons | ISC |
axios |
axios/axios | MIT |
react-hook-form, zod, @hookform/resolvers |
react-hook-form, colinhacks | MIT |
clsx, tailwind-merge |
lukeed, dcastil | MIT |
| Self-hosted webfonts (Inter, JetBrains Mono) | rsms, JetBrains | OFL-1.1 |
The website does not bundle Google Analytics, Meta Pixel, HubSpot, Mixpanel, Segment, or any other third-party analytics or marketing scripts at the version date above. If we add one, it will appear here and in the Cookie Policy.
6. Client Portal (timeros-portal)
| Component | Upstream | Licence |
|---|---|---|
react, react-dom |
facebook/react | MIT |
vite, @vitejs/plugin-react |
vitejs | MIT |
react-router-dom |
remix-run | MIT |
axios |
axios/axios | MIT |
lucide-react |
lucide-icons | ISC |
clsx |
lukeed | MIT |
The Portal does not include analytics scripts. Per-tenant branding (colour palette, logo, favicon) is loaded from the TimerOS API at runtime — no third-party CSS framework other than Tailwind utility classes is bundled.
7. API backend (timeros-api)
The API runs on our servers and is not redistributed to end users, so strict attribution duties under the MIT/BSD/Apache families do not technically attach to its dependencies. We list the principal components here for transparency and for the SBOM that we share with Customers' security teams on request.
| Component | Upstream | Licence |
|---|---|---|
@nestjs/core, @nestjs/common, @nestjs/platform-express, @nestjs/config, @nestjs/jwt, @nestjs/passport, @nestjs/swagger, @nestjs/throttler, @nestjs/mongoose, @nestjs/bullmq |
nestjs/nest | MIT |
mongoose |
Automattic/mongoose | MIT |
passport, passport-jwt, passport-local |
jaredhanson | MIT |
bcrypt |
kelektiv | MIT |
class-validator, class-transformer |
typestack | MIT |
bullmq, ioredis |
taskforcesh, luin | MIT |
stripe (Node SDK) |
stripe/stripe-node | MIT |
helmet, compression, cors |
express | MIT |
winston, nest-winston |
winstonjs, gremo | MIT |
The per-tenant database router and connection-pooling layer are Vezoft-authored and not third-party.
8. File server (timeros-file-server)
| Component | Upstream | Licence |
|---|---|---|
express |
expressjs | MIT |
multer |
expressjs/multer | MIT |
cors |
expressjs/cors | MIT |
mime-types, mime-db |
jshttp | MIT |
Uploaded project files are stored in Cloudflare R2 object storage (bucket pinned to the EU via jurisdiction=eu), not on the host's local disk; see the Sub-processors list for Cloudflare's role and transfer mechanism. The timeros-file-server component listed above is an upload-handling service whose continued role in the production deployment is being confirmed.
9. Fonts and icon sets
| Asset | Upstream | Licence | Where used |
|---|---|---|---|
| Inter | rsms (Rasmus Andersson) | OFL-1.1 |
Website, desktop dashboard, Portal |
| JetBrains Mono | JetBrains s.r.o. | OFL-1.1 |
Code samples on the marketing site |
| Lucide Icons | lucide-icons | ISC (forked from Feather Icons, also MIT) |
All frontends — every icon in the apps |
The OFL "Reserved Font Name" clause requires that we not distribute modified versions of Inter or JetBrains Mono under the original family name. We ship the upstream files unmodified.
10. Hosted services that are not OSS components but appear in the binary
For completeness, the desktop installer's auto-updater downloads update manifests from a Vezoft-controlled HTTPS endpoint. The connection uses the rustls TLS library with a bundled webpki-roots (BSD-3-Clause OR MPL-2.0) trust store. No third-party crash-reporter or error-monitoring SDK (for example, Bugsnag or Crashlytics) is embedded in the desktop installer. If we add one, this notice and the Privacy Policy Section 2.3 ("When you use the desktop app as an employee of a TimerOS Customer") will be updated before the release ships.
11. How we keep this file accurate
Each release pipeline runs the following gate before producing a signed installer:
cargo about generate --config about.toml --output-file desktop-rust-notices.html— fails the build if any crate carries a licence that is not on the allow-list (MIT,Apache-2.0,BSD-*,ISC,0BSD,MPL-2.0,Unicode-DFS-2016,Zlib,CC0-1.0).pnpm licenses list --prod --jsonandnpx license-checker-rseidelsohn --production --failOn 'GPL;AGPL;SSPL;CC-BY-NC-*'— fails the build on any copyleft or non-commercial licence in the production dependency tree.- Differential check against the previously committed notice file. Any added, removed, or licence-changed package opens a PR comment for legal review before merge.
- The generated NOTICE artefacts are copied into the installer's resource directory (
resources/legal/) so they are accessible from Help → About → Open-source notices even when the application is offline.
If you spot a missing attribution or a licence mis-classification, please email legal@vezoft.com with the package name and version, and we will publish a correction within 30 days.
12. Contact
- Open-source compliance and source-code requests:
legal@vezoft.com - Security vulnerabilities in a bundled OSS component:
security@timeros.ai(we coordinate with the upstream maintainer under our coordinated-disclosure process) - Postal: Vezoft, with registered office in Kardzhali, Bulgaria (see Imprint for the full registered address)
The complete, machine-generated, per-package licence text is published alongside this summary at /legal/notices/ and is also available from inside the desktop app at Help → About → Open-source notices. This summary document is informational; in any conflict between this summary and the verbatim upstream licence text in the generated notices, the upstream licence text prevails.