Open-Source Licences
This document is the aggregated NOTICE file for third-party open-source software ("OSS") that Vezoft EOOD ("Vezoft", "TimerOS", "we", "us"), a single-member limited liability company incorporated in Bulgaria, distributes inside the TimerOS desktop application, the TimerOS public website, the client Portal, and the supporting backend services. We publish it to comply with the attribution and notice requirements that the MIT, BSD, Apache-2.0, MPL-2.0, ISC, and similar permissive licences impose on redistributors, and to be transparent about the third-party code that runs on your computer or processes data on your behalf. Because the entire legal purpose of this file is to identify the upstream packages whose copyright holders are owed attribution, the named framework, library, and crate identifiers below are intentional and are exempt from the public-policy "no-jargon" rule that applies elsewhere in policies-public/.
If you are looking for our own privacy and processor terms, see the Privacy Policy, the Sub-processors list, and the Data Processing Agreement.
1. How this notice is generated
We do not curate this list by hand. The per-package notice files are produced by the generators committed in legal/scripts/, run before each release, and their output is committed to the source tree under legal/notices/ alongside the build artefacts.
| Surface | Tool | Manifest input | Output committed to |
|---|---|---|---|
| TimerOS desktop application (compiled components) | cargo about generate (config: legal/scripts/about.toml) |
timeros-desktop/src-tauri/Cargo.lock |
legal/notices/desktop-rust-notices.md |
| TimerOS desktop application (web layer) | pnpm licenses list --prod --json |
timeros-desktop/pnpm-lock.yaml |
legal/notices/desktop-web-notices.md |
| Public website | license-checker-rseidelsohn --production --json |
timeros-website/package-lock.json |
legal/notices/website-notices.md |
| Client Portal | license-checker-rseidelsohn --production --json |
timeros-portal/package-lock.json |
legal/notices/portal-notices.md |
| API backend | license-checker-rseidelsohn --production --json |
timeros-api/package-lock.json |
legal/notices/api-notices.md |
The four JavaScript surfaces are rendered to Markdown by legal/scripts/generate-oss-notices.mjs; the Rust layer by cargo about using legal/scripts/about.toml and legal/scripts/about-md.hbs. The file server does not appear in this pipeline because it is neither distributed to end users nor part of the production deployment (see §8).
The generated files contain, for every component: package name, version actually shipped, copyright holder(s), SPDX licence identifier, and the verbatim licence text. This summary is published at timeros.ai/legal/open-source (linked from the website and Portal footers and from the desktop application's legal section). The full per-package notice files are published at timeros.ai/legal/notices/ for the four redistributed surfaces — the two desktop layers, the website, and the Portal — and the desktop application additionally bundles its own components' notices offline, viewable at Settings → Legal → Open-source notices. The API backend's dependency notices are committed to the source tree under legal/notices/ and shared on request (the API runs on our servers and is not redistributed — see §7).
If you have received a compiled copy of the TimerOS desktop application and want the corresponding source code for any LGPL or MPL-2.0 component, email [email protected] with the version number printed on the About screen; we will respond within 30 days with either a direct download URL or written instructions, at no charge beyond the cost of distribution.
2. Categories of licence in use, and what that means for you
Almost all the OSS we ship is under one of the permissive licences in the family below. We carry no copyleft code (GPL, AGPL, SSPL) in the desktop installer or in any client-facing artefact. A small number of LGPL and MPL-2.0 components may be present transitively in the desktop runtime; for these we comply by dynamic linking and by offering the corresponding object/source on request.
| SPDX identifier | Typical obligation we satisfy in this notice |
|---|---|
MIT, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD |
Reproduce copyright notice and licence text in this NOTICE file. No advertising restriction. |
Apache-2.0 |
Reproduce copyright notice, licence text, and the upstream NOTICE file where the project ships one. Preserve attribution of modifications. |
MPL-2.0 |
Provide source for unmodified MPL files on request; clearly identify any modifications we make. We do not modify MPL files. |
LGPL-2.1, LGPL-3.0 |
Dynamic linking only; offer object code / corresponding source for the LGPL component on request. |
Unicode-DFS-2016, CC-BY-4.0, OFL-1.1 |
Reproduce attribution; for OFL fonts, retain reserved-name clause. |
BlueOak-1.0.0, Zlib, WTFPL, Unlicense |
Permissive; attribution preserved as a courtesy. |
If any component we ship is later found to be under a licence we cannot lawfully bundle with a proprietary product (for example, a transitive dependency that switches to AGPL on a future release), we will remove or replace it in the next maintenance release and note the change in the Subprocessors changelog where the dependency is operationally relevant.
3. TimerOS desktop application — compiled components
The desktop application is built from a tree of approximately 350 compiled components resolved from Cargo.lock. The exhaustive list with verbatim licence text is in legal/notices/desktop-rust-notices.md, generated by cargo about. The most material components and their upstream licences are summarised below.
| Component | Upstream | Licence | Purpose in TimerOS Desktop |
|---|---|---|---|
Tauri (tauri, tauri-build, tauri-runtime, tauri-runtime-wry, wry) |
tauri-apps/tauri | MIT OR Apache-2.0 |
Desktop application shell; native window, IPC, packaging |
Tauri plugins (tauri-plugin-http, -opener, -dialog, -fs, -process, -store, -updater) |
tauri-apps | MIT OR Apache-2.0 |
First-party Tauri plugins for HTTP, link/file opening, dialogs, filesystem, process, store, and updates |
| WRY | tauri-apps/wry | MIT OR Apache-2.0 |
Cross-platform webview wrapper |
| WebKitGTK (Linux only; system-provided, dynamically linked) | webkit.org | LGPL-2.1-only OR BSD-2-Clause |
Webview on Linux. We do not bundle WebKitGTK on Windows or macOS — the system webview (WebView2 / WKWebView) is used. |
| Microsoft Edge WebView2 Loader (Windows only) | Microsoft | Distributable Code Terms | Bootstraps WebView2; redistribution permitted per Microsoft Distributable Code Terms |
serde, serde_json, serde_derive |
serde-rs | MIT OR Apache-2.0 |
Serialization for IPC and persistent state |
tokio, tokio-util |
tokio-rs | MIT |
Async runtime used by HTTP plugin and background tasks |
reqwest, hyper, hyper-rustls, rustls, webpki-roots |
seanmonstar, rustls | MIT OR Apache-2.0, ISC, CDLA-Permissive-2.0 |
HTTPS client for the API, with rustls TLS (no OpenSSL) |
windows-sys, windows-targets, windows-result |
Microsoft | MIT OR Apache-2.0 |
Windows API bindings |
objc2, objc2-foundation, objc2-app-kit, block2 |
madsmtm | MIT |
macOS API bindings |
gtk, gdk, glib, gio, cairo-rs, pango (via gtk-rs) |
gtk-rs | MIT |
Linux GTK bindings |
png |
image-rs | MIT OR Apache-2.0 |
Tray-icon and screenshot-thumbnail decoding |
chrono, time |
chronotope | MIT OR Apache-2.0 |
Time arithmetic |
regex, regex-syntax, aho-corasick, memchr |
rust-lang/regex | MIT OR Apache-2.0 |
Substring matching inside the scored rule engine |
unicode-segmentation |
unicode-rs | MIT OR Apache-2.0 |
Title tokenisation for the on-device classifier |
sha2, digest |
RustCrypto | MIT OR Apache-2.0 |
Hashing for the in-process update verifier |
rand, rand_core, rand_chacha, getrandom |
rust-random | MIT OR Apache-2.0 |
Deterministic seed so the on-device classifier is reproducible across installs |
log, tracing |
rust-lang/log, tokio-rs | MIT OR Apache-2.0 |
Diagnostic logging |
anyhow, thiserror |
dtolnay | MIT OR Apache-2.0 |
Error types |
dirs, dirs-sys |
soc | MIT OR Apache-2.0 |
Resolves local-only storage paths for the on-device classifier |
The on-device classifier itself is not third-party. The scored rule engine and the small on-device statistical classifier are Vezoft-authored, proprietary, and ship without any third-party model file. A small set of weights is trained at first run from a built-in seed dataset and stored only locally on your computer; your corrections to the classifier's output are likewise stored only locally on your computer and are never transmitted. Because we do not redistribute a third-party machine-learning model, no model card, no Hugging Face licence, no Llama Community Licence, and no Apache-2.0 model attribution applies to the classifier. The third-party crates listed above are the only third-party code paths the classifier touches, and they are covered by the table above. We maintain a model card and an EU AI Act applicability assessment for the classifier (covering training data, model architecture, and evaluation metrics), available to competent authorities on request.
4. TimerOS desktop application — Web layer
The web layer is a single-page application packaged inside the desktop installer. Dependencies are resolved from timeros-desktop/pnpm-lock.yaml. Key components:
| Component | Upstream | Licence | Purpose |
|---|---|---|---|
react, react-dom |
facebook/react | MIT |
UI framework |
vite, @vitejs/plugin-react |
vitejs | MIT |
Build tool and dev server |
@tauri-apps/api, @tauri-apps/plugin-http, @tauri-apps/plugin-opener, @tauri-apps/plugin-dialog, @tauri-apps/plugin-fs, @tauri-apps/plugin-process, @tauri-apps/plugin-store, @tauri-apps/plugin-updater |
tauri-apps | MIT OR Apache-2.0 |
JavaScript bindings to the Rust Tauri plugins |
@tanstack/react-query |
TanStack | MIT |
Server-state cache; per-resource hooks |
zustand |
pmndrs | MIT |
Client-state stores (auth, theme); persisted locally on your computer |
react-router-dom |
remix-run | MIT |
Routing in the dashboard window |
react-hook-form |
react-hook-form | MIT |
Forms |
zod, @hookform/resolvers |
colinhacks, react-hook-form | MIT |
Schema validation |
lucide-react |
lucide-icons/lucide | ISC |
Icons |
tailwindcss |
tailwindlabs | MIT |
Styling |
recharts, d3-shape, d3-scale, d3-array, d3-time |
recharts, d3 | MIT, ISC |
Charts on the dashboard window |
date-fns |
date-fns | MIT |
Date utilities |
clsx, tailwind-merge |
lukeed, dcastil | MIT |
Class-name composition |
5. Public website (timeros-website)
| Component | Upstream | Licence |
|---|---|---|
next, next/font |
vercel/next.js | MIT |
react, react-dom |
facebook/react | MIT |
tailwindcss, autoprefixer, postcss |
tailwindlabs | MIT |
lucide-react |
lucide-icons | ISC |
axios |
axios/axios | MIT |
react-hook-form, zod, @hookform/resolvers |
react-hook-form, colinhacks | MIT |
| Self-hosted webfonts (Inter, JetBrains Mono) | rsms, JetBrains | OFL-1.1 |
The website does not bundle Google Analytics, Meta Pixel, HubSpot, Mixpanel, Segment, or any other third-party analytics or marketing scripts at the version date above. If we add one, it will appear here and in the Cookie Policy.
6. Client Portal (timeros-portal)
| Component | Upstream | Licence |
|---|---|---|
react, react-dom |
facebook/react | MIT |
vite, @vitejs/plugin-react |
vitejs | MIT |
react-router-dom |
remix-run | MIT |
axios |
axios/axios | MIT |
lucide-react |
lucide-icons | ISC |
The Portal does not include analytics scripts. Per-tenant branding (colour palette, logo, favicon) is loaded from the TimerOS API at runtime — no third-party CSS framework other than Tailwind utility classes is bundled.
7. API backend (timeros-api)
The API runs on our servers and is not redistributed to end users, so strict attribution duties under the MIT/BSD/Apache families do not technically attach to its dependencies. We list the principal components here for transparency and for the SBOM that we share with Customers' security teams on request.
| Component | Upstream | Licence |
|---|---|---|
@nestjs/core, @nestjs/common, @nestjs/platform-express, @nestjs/config, @nestjs/jwt, @nestjs/passport, @nestjs/swagger, @nestjs/throttler, @nestjs/mongoose, @nestjs/bullmq |
nestjs/nest | MIT |
mongoose |
Automattic/mongoose | MIT |
passport, passport-jwt |
jaredhanson | MIT |
bcrypt |
kelektiv | MIT |
class-validator, class-transformer |
typestack | MIT |
bullmq, ioredis |
taskforcesh, luin | MIT |
stripe (Node SDK) |
stripe/stripe-node | MIT |
helmet, cors |
express | MIT |
The per-tenant database router and connection-pooling layer are Vezoft-authored and not third-party.
8. File server (timeros-file-server)
| Component | Upstream | Licence |
|---|---|---|
express |
expressjs | MIT |
multer |
expressjs/multer | MIT |
cors |
expressjs/cors | MIT |
mime-types, mime-db |
jshttp | MIT |
Uploaded project files are stored in Cloudflare R2 object storage (bucket pinned to the EU via jurisdiction=eu), not on the host's local disk; see the Sub-processors list for Cloudflare's role and transfer mechanism. The timeros-file-server component listed above is a legacy local upload service and is not part of the production deployment; uploads are handled by the API and stored in Cloudflare R2. Because it is neither distributed to end users nor deployed, no separate generated NOTICE file is produced for it; the components above are listed for transparency only.
9. Fonts and icon sets
| Asset | Upstream | Licence | Where used |
|---|---|---|---|
| Inter | rsms (Rasmus Andersson) | OFL-1.1 |
Website, desktop dashboard, Portal |
| JetBrains Mono | JetBrains s.r.o. | OFL-1.1 |
Code samples on the marketing site |
| Lucide Icons | lucide-icons | ISC (forked from Feather Icons, also MIT) |
All frontends — every icon in the apps |
The OFL "Reserved Font Name" clause requires that we not distribute modified versions of Inter or JetBrains Mono under the original family name. We ship the upstream files unmodified.
10. Hosted services that are not OSS components but appear in the binary
For completeness, the desktop installer's auto-updater downloads update manifests from a Vezoft-controlled HTTPS endpoint. The connection uses the rustls TLS library with a bundled webpki-roots (CDLA-Permissive-2.0) trust store. No third-party crash-reporter or error-monitoring SDK (for example, Bugsnag or Crashlytics) is embedded in the desktop installer. If we add one, this notice and the Privacy Policy Section 2.3 ("When you use the desktop app as an employee of a TimerOS Customer") will be updated before the release ships.
11. How we keep this file accurate
Before each release we regenerate this file's per-package notices and review the diff:
cargo about generate --config legal/scripts/about.toml legal/scripts/about-md.hbs— fails if any crate carries a licence outside the allow-list inabout.toml(MIT,Apache-2.0includingWITH LLVM-exception,BSD-2-Clause,BSD-3-Clause,ISC,0BSD,MPL-2.0,Zlib,CC0-1.0,Unicode-DFS-2016,Unicode-3.0,CDLA-Permissive-2.0). This is the gate that keeps copyleft (GPL/AGPL/SSPL) out of the desktop installer.node legal/scripts/generate-oss-notices.mjsregenerates the JavaScript-surface notices viapnpm licenses list --prod --json(desktop web layer) andlicense-checker-rseidelsohn --production --json(website, Portal, API).- Differential review against the previously committed notice files: any added, removed, or licence-changed package is reviewed before the change is merged, and any copyleft or non-commercial licence appearing in a production tree blocks the release.
- The regenerated NOTICE files are committed to
legal/notices/; the two desktop-layer files are also embedded in the desktop application (readable offline), and the four redistributed surfaces are published attimeros.ai/legal/notices/.
If you spot a missing attribution or a licence mis-classification, please email [email protected] with the package name and version, and we will publish a correction within 30 days.
12. Contact
- Open-source compliance and source-code requests:
[email protected] - Security vulnerabilities in a bundled OSS component:
[email protected](we coordinate with the upstream maintainer under our coordinated-disclosure process) - Postal: Vezoft, with registered office in Kardzhali, Bulgaria (see Imprint for the full registered address)
The complete, machine-generated, per-package licence text is published at timeros.ai/legal/notices/ (and bundled offline in the desktop application at Settings → Legal → Open-source notices); the API backend's notices are committed to our source tree under legal/notices/ and available on written request to [email protected]. This summary document is informational; in any conflict between this summary and the verbatim upstream licence text in the generated notices, the upstream licence text prevails.