Third-Party Notices

Coii Audio

Effective effective date

Coii Audio is built on open-source software and runs machine-learning models it did not train. This file lists them, states the licence each is under, and says what that licence requires of a paid product.

This document is the readable summary. The authoritative list ships with the app, as THIRD-PARTY-LICENSES.txt inside the bundle and under Settings → Open source. That one is generated from the actual dependency tree — several hundred crates once transitive ones are counted — while §2 below names only the direct dependencies, in the interest of being read. Where the two disagree, the generated file is right. How it is produced and kept current: development.md.

1. Can a paid app be built on all of this?

Yes. Everything in §2 and §3 is under MIT, Apache-2.0, ISC, BSD or the public domain, and every one of those permits commercial use, selling, and distribution in a closed-source product. No copyleft licence is present — nothing here is GPL or LGPL, so nothing obliges us to publish our own source. The two components that matter most, whisper.cpp and llama.cpp, are both MIT.

What they all require is attribution: the copyright line and the licence text have to travel with the binary, which they do — see §4.

Two models were removed to get to that answer, on 2026-08-27, rather than carrying their conditions into a paid product:

• gemma-3-4b-it — under Google's Gemma Terms of Use, not open source. Commercial use is permitted, but the terms and a Prohibited Use Policy that Google may revise must reach every downstream user, and any distribution must carry a set notice. The app does not redistribute the weights — the user's machine fetches them from Hugging Face — but the app initiates that download and then uses the model on the user's behalf, so the pass-through would have been ours to perform, and there is nowhere in a Settings model card to perform it. qwen3-4b-instruct-2507 is the same size, Apache-2.0, and was already the catalogue's recommended pick.
• wespeaker-cam++ (wespeaker_en_voxceleb_CAM++.onnx) — Apache-2.0 code, but the weights are trained on VoxCeleb, which is distributed for research use only. Whether a research-only dataset restricts commercial use of a model trained on it is genuinely unsettled and differs by jurisdiction. An unsettled question is not a licence, and it was the third voice-print model when the bilingual default already covers English.

The reasoning, and the bar anything new has to clear, is in models.md. The short version: check the weights' licence, not the repository's, and check what the weights were trained on.

Not a licence question, but adjacent

Model hosts are not obliged to keep serving us. huggingface.co and the sherpa-onnx GitHub releases can rate-limit, move or withdraw a file, and a first-run setup that depends on them will fail when they do. §11 of the Terms says so to the buyer. Mirroring the weights ourselves is a reliability decision nobody has needed to make yet, and is permitted for everything now in the catalogue.

2. Components compiled into the app

Shipped inside the .app bundle, so their notices must travel with it.

Rust

Apple's own frameworks — ScreenCaptureKit, AVFoundation, Metal, Security — are used under the Apple SDK licence that comes with Xcode, and are not redistributed.

JavaScript

Every Tiptap package used here is from its open-source core. Tiptap also sells commercial "Pro" extensions under a different licence; none is used.

Build-time only, not shipped: Vite (MIT), Tailwind CSS (MIT), TypeScript (Apache-2.0), @tauri-apps/cli (MIT OR Apache-2.0).

3. Model weights, downloaded at runtime

Not bundled. The app fetches these onto your machine from third-party hosts when you choose them, and each is licensed by whoever trained it.

A quantisation is a derivative of the model it was made from and carries that model's licence, which is why the Unsloth GGUF files are Apache-2.0: the quantiser does not get to relicense Qwen3.

The full catalogue, including what was removed and why, is in models.md.

4. How the notices are actually delivered

MIT, Apache-2.0, BSD and ISC all require the copyright notice and licence text to be distributed with the binary. The condition is on the copy — MIT says the notice "shall be included in all copies", and Apache-2.0 §4(a) says recipients must be given a copy of the licence — so a link to a web page does not satisfy it. Apache-2.0 §4(d) even enumerates the three acceptable places for a NOTICE file's contents: a NOTICE text file in the distribution, the documentation shipped with it, or a display the software itself generates. A URL is not among them.

So the notices travel with the app, in both of the forms that count:

That file is not maintained by hand. It is generated from the dependency tree the binary was actually built from — every Rust crate, every npm package bundled into the frontend, and the native components that appear in no manifest because they are compiled from source or linked as prebuilt binaries. A release cannot be cut while it disagrees with that tree. The mechanics are in development.md.

Two obligations beyond plain attribution, both stated in the generated file's header:

• Apache-2.0 NOTICE files travel inside the licence text reproduced for each crate that ships one.
• MPL-2.0 covers four crates that arrive through Tauri (cssparser, selectors, dtoa-short, and option-ext via dirs). It is copyleft per file, not per program, and explicitly permits combination with proprietary code — nothing of ours falls under it. Its §3.2 does require that recipients can obtain the source of those files; they are used unmodified, so the header points at crates.io for each. Vendoring a patched copy of one of them would change that, and is the thing to avoid.

5. Contact

Corrections to this file, or a licence claim you believe is wrong, to support@coii.io — they are worth fixing quickly.