Legal

Open-source licences

Whose work we use, and on what terms.

Third-party software

Ksefly is built on other people’s work. Below is what travels with the app and with our service, and under which licence. If something is not here, it is because we do not ship it — the last section says plainly what stays on our side.

The iPhone app

Stripe Terminal iOS SDK 5.7.0 — Copyright (c) 2018– Stripe, Inc. — MIT License. The SDK’s licence file adds a sentence we repeat because it is part of it: “Use of this SDK is subject to the Stripe Terminal Terms: https://stripe.com/terminal/legal”.

It is the only third-party library in the app, and it is not a choice: a contactless payment on iPhone is read by the system, and only a certified payment provider’s SDK is permitted to decrypt that read. The version is pinned exactly (exactVersion) rather than by range — in code that drives a card reader, a silent version change between two builds of the same commit is not a convenience.

The app’s other packages — Models, AppSecurity, KSeFKit, Persistence, DesignSystem — are ours. Apple’s frameworks (SwiftUI, SwiftData, StoreKit, ProximityReader, LocalAuthentication, CoreLocation and the other system frameworks) are part of the platform and need no separate notice; Apple’s trademarks are credited separately, in the attribution block.

⟨TO CONFIRM at release: whether the downloaded SDK artefact (a binary xcframework) carries its own third-party notices file. The SDK repository at the pinned revision does not — it holds only LICENSE, README, CHANGELOG and SUPPORT — but a binary artefact is not the same thing as a repository.⟩

The backend service

Direct dependencies, at the versions in the project files:

PackageVersionLicence
Azure.Extensions.AspNetCore.Configuration.Secrets1.3.2MIT
Azure.Identity1.21.0MIT
Azure.Monitor.OpenTelemetry.Exporter1.8.1MIT
FluentValidation11.11.0Apache-2.0
FluentValidation.DependencyInjectionExtensions11.11.0Apache-2.0
Microsoft.AspNetCore.Authentication.JwtBearer10.0.0MIT
Microsoft.AspNetCore.OpenApi10.0.0MIT
Microsoft.EntityFrameworkCore10.0.0MIT
Microsoft.Extensions.DependencyInjection.Abstractions10.0.0MIT
Microsoft.Extensions.Http10.0.0MIT
Microsoft.Extensions.Logging.Abstractions10.0.0MIT
Microsoft.Extensions.Options.ConfigurationExtensions10.0.0MIT
Microsoft.OpenApi2.7.5MIT
Npgsql.EntityFrameworkCore.PostgreSQL10.0.0PostgreSQL License
OpenTelemetry.Exporter.OpenTelemetryProtocol1.16.0Apache-2.0
OpenTelemetry.Extensions.Hosting1.16.0Apache-2.0
OpenTelemetry.Instrumentation.AspNetCore1.16.0Apache-2.0
OpenTelemetry.Instrumentation.Http1.16.0Apache-2.0
Serilog.AspNetCore8.0.3Apache-2.0
System.IdentityModel.Tokens.Jwt8.2.1MIT

The service runs on .NET 10 / ASP.NET Core (Microsoft, MIT) and on PostgreSQL (PostgreSQL License), as the Azure Database for PostgreSQL service.

Those packages pull in dependencies of their own, which ship with the service too — among them Azure.Core, Azure.Security.KeyVault.Secrets, Microsoft.Identity.Client, the Microsoft.IdentityModel family, the Npgsql driver, the Serilog sinks, the OpenTelemetry core, and the Microsoft.Extensions.* and System.* packages. In the dependency graph restored for this repository every one of them is MIT, Apache-2.0 or the PostgreSQL License — there is no copyleft and no commercially restricted licence in it.

⟨TO ADD before a full notice is published: generate the exact, complete list of transitive dependencies and their versions from the Ksefly.Api.deps.json produced by dotnet publish. That file could not be produced in the environment where this document was written (no .NET SDK present), so the table above is the list of DIRECT dependencies, and the sentence about transitive licences rests on the restored graph rather than on a release artefact.⟩

The ksefly.app website

The site is built with Astro 5.12 (MIT) and the @astrojs/sitemap 3.4 integration (MIT). Both are build tools: the built site sends no third-party code to the browser — the build output contains not one library .js file, the stylesheet is ours, and the text renders in system font stacks (-apple-system, system-ui, ui-monospace and their fallbacks). We load no webfont and embed no font file, so there is no font licence to name here.

Marks and artwork that are not software

  • The “Download on the App Store” badge (Polish and English) — Apple’s official asset from Apple Marketing Tools, used unaltered, per Apple’s identity guidelines.
  • The “Powered by Stripe” badge — Stripe’s official asset from Stripe’s brand assets, used unaltered, in exactly one place in the app.
  • The Contactless Symbol — a trademark of EMVCo, LLC, used with permission; it is credited by Apple’s disclaimer that accompanies contactless payments taken with the phone.

These assets are not licensed to us — they belong to their owners and may be used only in the ways and places those owners permit. They may never be redrawn, recoloured or reproduced by hand.

Public register data

PKD/NACE division names, legal-form names and the bank directory recognised from an account number come from public information (GUS, the Ministry of Finance). The Ministry’s published FA(3) schemas are in the repository as test material only; the schema the service validates a document against before sending is our own subset. These are data, not software, and carry no licence that could be quoted here.

What we do NOT ship — and therefore is not listed above

  • XcodeGen (MIT, Copyright (c) 2018 Yonas Kolb) — generates the Xcode project at build time. It is vendored in the repository but is not part of the app.
  • Test libraries — xunit and its modules (Apache-2.0), Microsoft.NET.Test.Sdk (MIT), Microsoft.AspNetCore.Mvc.Testing (MIT), Microsoft.EntityFrameworkCore.Sqlite (MIT) and SQLitePCLRaw (Apache-2.0). They compile into the test projects only.
  • Microsoft.EntityFrameworkCore.Design (MIT) — the design-time migrations tool, marked PrivateAssets=all in the project file, so it is deliberately not published with the service.

If any of them ever reaches a released artefact, its place is in the tables above, not here.