Open Source Licenses
NiniBite acknowledges the following open source projects and public-domain data sources that make this app possible. Where required, license text or the original license file is linked from each row. This page mirrors LICENSES.md at the root of the NiniBite repository, the source of truth for all third-party license obligations.
iOS
- Apple SDKs (SwiftUI, Foundation, UIKit, Swift Charts, WidgetKit, UserNotifications)Apple SDK License (implicit via Xcode)
Proprietary — permitted use
Zero external SPM package dependencies — founding project decision, verified via project.pbxproj inspection across 19+ sprints.
View license - SF Pro (system font)Apple SDK License
Proprietary — free for iOS apps
View license
Backend
- fastapiMIT
Permissive
View license - uvicornBSD-3-Clause
Permissive
View license - pydanticMIT
Permissive
View license - pydantic-settingsMIT
Permissive
View license - sqlalchemyMIT
Permissive
View license - alembicMIT
Permissive
View license - asyncpgApache-2.0
Permissive
Include NOTICE if modified (we don't modify)
View license - psycopg[binary]LGPL-3.0-or-later
Weak copyleft
Dynamic-link use as a library — no obligation
View license - python-jose[cryptography]MIT
Permissive
View license - passlib[bcrypt]BSD-2-Clause
Permissive
View license - bcryptApache-2.0
Permissive
View license - python-multipartApache-2.0
Permissive
View license - bleachApache-2.0
Permissive
View license - httpxBSD-3-Clause
Permissive
View license - python-dotenvBSD-3-Clause
Permissive
View license - pypdfBSD-3-Clause
Permissive
View license - tqdmMPL-2.0 + MIT (file-level dual)
Weak copyleft (file-level) / Permissive
Consumed unmodified as pip dep — no obligation. NiniBite documents the MIT-side choice.
View license - langchainMIT
Permissive
View license - langchain-openaiMIT
Permissive
View license - langchain-communityMIT
Permissive
View license - langgraphMIT
Permissive
View license - openai (Python SDK)Apache-2.0
Permissive
View license - chromadbApache-2.0
Permissive
View license - sentry-sdk[fastapi]BSD-2-Clause
Permissive
View license - prometheus-fastapi-instrumentatorISC
Permissive
View license - langfuse (Python SDK, ~=4.12)MIT
Permissive
ee/ folders excluded — enterprise, not used
View license - stripe (Python SDK)MIT
Permissive
Pending activation (Phase 5)
View license
Web
- nextMIT
Permissive
View license - reactMIT
Permissive
View license - react-domMIT
Permissive
View license - typescriptApache-2.0
Permissive
View license - tailwindcssMIT
Permissive
View license - @radix-ui/react-* (dialog, alert-dialog, avatar, dropdown-menu, label, progress, separator, slot, tabs, toast)MIT
Permissive
View license - react-hook-formMIT
Permissive
View license - zodMIT
Permissive
View license - rechartsMIT
Permissive
View license - lucide-reactISC
Permissive
View license - @sentry/nextjsMIT
Permissive
View license - clsxMIT
Permissive
View license - class-variance-authorityApache-2.0
Permissive
View license - tailwind-mergeMIT
Permissive
View license - remark-gfmMIT
Permissive
View license - react-markdownMIT
Permissive
View license - @hookform/resolversMIT
Permissive
View license - shadcn/ui components (copy-pasted into frontend/src/components/ui/)MIT
Permissive (copy-paste pattern)
Keep copyright header in source files; no UI-visible attribution required
View license
Docker Infrastructure
- postgres:16-alpinePostgreSQL License
Permissive (BSD-style)
Used as-is for app + Langfuse
View license - langfuse/langfuse:3MIT (core; ee/ folders excluded)
Permissive
View license - langfuse/langfuse-worker:3MIT
Permissive
View license - clickhouse/clickhouse-serverApache-2.0
Permissive
Langfuse dependency for trace storage
View license - redis:7-alpineBSD-3-Clause (Redis 7.x line)
Uncertain — LOW risk
Internal-only, unmodified use behind Langfuse. Pin to specific digest for reproducibility. Redis 8 branched to RSAL/SSPL/AGPL tri-license — watch on upgrade.
View license - minio/minioAGPLv3
Strong copyleft (network) — LOW risk
Used unmodified as an internal-only S3-compatible object store for Langfuse's blob payloads. Not linked into the NiniBite app codebase, not modified, not offered as a service to third parties — AGPL network-copyleft trigger not applicable. Repo archived April 2026; migration off MinIO tracked as ops follow-up.
View license
Bundled Data
- CDC-hosted WHO-standard Child Growth Standards dataPublic domain (US federal government work)
Public domain
Bundled as NiniBite/NiniBite/Resources/GrowthChartData/*.json. Migrated 2026-07-21 from WHO-poster-derived data; see docs/GROWTH_DATA_PROVENANCE.md.
View license - CDC Recommended Immunization Schedule + HRSA Bright Futures Periodicity SchedulePublic domain (US federal government work)
Public domain
Bundled as NiniBite/NiniBite/Core/Data/WellBabyVisitSchedule.swift. Re-anchored 2026-07-21 from AAP's Bright Futures citation.
View license - USDA FoodData Central APIPublic domain (US federal government work)
Public domain
Free API, no attribution required (cited in Terms of Service).
View license
Not legal advice. This inventory is an informational engineering risk record. See LICENSES.md for the full audit trail.