Licenses and open source

The code of the Patepang app and core has been set to use the GNU Affero General Public License version 3 (AGPL-3.0-only). This license is required, because both use libsignal, which has the same license. Patepang's server code also uses AGPL-3.0-only, as a choice for openness.

The core is the part of the app written in Rust: that is where keys, end-to-end encryption, and signatures work. The core links libsignal, the Signal protocol library, so an app that includes it must use the same license. The server code includes its two enclaves, one for tempel and one for account recovery. The moderator console and the root key holders' app, two tools for moderation, are also licensed AGPL-3.0-only. The word “only” means version 3 alone, not later versions. [License of the code of Patepang's websites: awaiting the owner's decision]

Patepang's code will be opened at the public launch, after a security audit by an outside party. Until then, the code is not yet open to the public. [How Patepang meets the conditions of AGPL-3.0 for an app distributed through the App Store and Google Play: awaiting review by legal counsel]

Once the code is opened, you may use, study, modify, and share it. If you share a modified version, or run it as a service for other people over a network, you must make its source code available under the same license.

The license also asks that copyright and license notices stay intact in every copy, and that a modified version be marked as modified. The license has its own provisions on warranty and liability (sections 15 to 17 of its text), for code you receive under it. Your rights as a user of the Patepang app are governed by the Terms and conditions.

The code license gives no permission to use the Patepang name, wordmark, or icon. A modified version must not present itself as Patepang; the rules are in the Intellectual property policy.

The full text of the license is on the GNU website (another site).

When the code is opened, the code of the app, core, and server becomes available to the public in Patepang's repositories. [Address of the source code repositories, and how to request the source code of the app version you installed: coming when the code is opened]

One part already carries its own source information: the export file opener page. You can save that page from the export screen in the app, to open your export file on a computer without the internet. It contains the AGPL-3.0-only text, the name of the repository and the commit of the code that built it, and the list of third-party components inside it with their licenses. From that commit, the same page can be rebuilt exactly. That repository, too, opens only at the public launch.

Next.js

MIT License, for the site framework. Version 16.4.2, © 2025 Vercel, Inc.

React and React DOM

MIT License, for the site interface. Version 19.3.0, © Meta Platforms, Inc. and affiliates.

Phosphor Icons

MIT License, for icons. Package @phosphor-icons/react 2.1.10, © 2020 Phosphor Icons.

Plus Jakarta Sans

SIL Open Font License 1.1, for the typeface, © 2020 The Plus Jakarta Sans Project Authors.

Next.js includes other open-source components, each under its own license. The Plus Jakarta Sans typeface is served from Patepang's own websites; its license is at openfontlicense.org (another site).

Patepang's websites are static files. The two tables below list every third-party package installed for the websites, according to their dependency lock file (pnpm-lock.yaml), divided by whether its content reaches your browser.

5.1 What reaches your browser

Next.js also carries some components inside its own package, for example a stand-in for process in the browser (MIT License, © 2013 Roman Shtylman).

5.2 What is only used to build the websites

Next.js also installs sharp 0.35.5 (Apache-2.0) and the libvips library (LGPL-3.0-or-later) as an option for processing images. Patepang's websites do not use them: their images are served as they are. Code checking tools, such as TypeScript, ESLint, and Prettier, are only used during development and do not go into the websites.

Copyright notices: Next.js and styled-jsx © Vercel, Inc.; React, React DOM, and scheduler © Meta Platforms, Inc. and affiliates; PostCSS © 2013 Andrey Sitnik; nanoid © 2017 Andrey Sitnik; picocolors © 2021-2024 Oleksii Raspopov, Kostiantyn Denysov, Anton Verinov; source-map-js © 2009-2011 Mozilla Foundation and contributors; tslib © Microsoft Corporation. The packages licensed under Apache-2.0 and CC-BY-4.0 carry their license text inside their own package.

The Patepang app and websites use the same typeface, Plus Jakarta Sans, by The Plus Jakarta Sans Project Authors (github.com/tokotype/PlusJakartaSans (another site)), under the SIL Open Font License 1.1. That license allows the typeface to be used, embedded, and shared with software, as long as its copyright notice and license come along; the typeface itself may not be sold on its own. The websites serve a Latin subset in seven files (weights 400, 500, 600, 700, and 800, plus italics 400 and 700), copied from the npm package @fontsource/plus-jakarta-sans 5.3.0. The app uses four files, weights 400 to 700.

The icons in the app and on the websites come from the Phosphor Icons family, under the MIT License: in the app through phosphor-react-native 3.0.6 (© 2020 Dustin Do), on the websites through @phosphor-icons/react 2.1.10 (© 2020 Phosphor Icons). The MIT License allows those icons to be reused, as long as their copyright notice and license come along.

The Sundanese-script wordmark and the Patepang app icon are not made from third-party fonts or icons: both are drawn from their own geometry. Both are Patepang marks, not part of the code license (section 8).

The Patepang app uses libsignal (AGPL-3.0-only) and other open-source software. Below are its main components, with the versions and licenses recorded in the app and core repositories.

7.1 Core

• libsignal v0.105.1 (libsignal-protocol and signal-crypto), from Signal's repository, for the end-to-end encryption protocol: AGPL-3.0-only.
• SparsePostQuantumRatchet v1.6.0, the post-quantum ratchet libsignal uses: AGPL-3.0-only.
• uniffi 0.32.2, which connects the core with the app's Kotlin and Swift code: MPL-2.0.
• The Rust standard library, from the Rust 1.99.0 toolchain: mainly Apache-2.0 or MIT.
• Other Rust crates in the core use permissive licenses: MIT, Apache-2.0 (also with the LLVM exception), BSD-3-Clause, ISC, Unicode-3.0, or Zlib.

7.2 App

• React Native 0.86.3 and React 19.2.3, the app framework: MIT.
• Expo SDK 57 and its modules, for the camera, files, sound, video, notifications, motion sensors, and other phone features: MIT.
• React Navigation 7, Reanimated 4.5.1, react-native-svg 15.15.4, react-native-screens 4.26.2, and react-native-safe-area-context 5.7.0, for screens, motion, and drawing: MIT.
• expo-iap 6.0.3, for purchases through the App Store and Google Play: MIT.
• phosphor-react-native 3.0.6, for icons: MIT.
• @expo-google-fonts/plus-jakarta-sans 0.4.2, for the Plus Jakarta Sans typeface: SIL Open Font License 1.1 for the typeface.
• qrcode-generator 2.0.4 for tempel QR codes, unicode-segmenter 0.17.3 for counting letters and emoji, and zod 4.6.6 for checking the server's answers: MIT.
• @noble/curves, @noble/hashes, and @noble/post-quantum, for checking the protocol's signatures and hashes: MIT.
• @bufbuild/protobuf 2.16.0, for the protocol's message format: Apache-2.0 and BSD-3-Clause.

7.3 Other

The Android app also includes Google libraries for notifications (Firebase Cloud Messaging 25.0.1), app authenticity checks (Play Integrity 1.6.0), and purchases (Google Play Billing Library 9.1.0). On iPhone, the app uses Apple services built into the system, such as StoreKit for purchases and App Attest for authenticity checks. The emoji list and the Indonesian emoji names in the emoji picker come from Unicode data (Emoji 17.0 and CLDR 48). The terms and licenses of all of these will be given in the full list. [Full list of third-party notices for the app: coming later]

App Store is a trademark of Apple Inc. Google Play is a trademark of Google LLC. iPhone is a trademark of Apple Inc., and Android is a trademark of Google LLC. Other product and company names mentioned in the Patepang app and on its websites belong to their respective owners; mentioning them does not mean they endorse Patepang.

The Patepang name, the wordmark in Sundanese script, and the Patepang icon are marks we use for our service. How to use them is in the Intellectual property policy.

Questions about licenses, third-party notices that are missing or wrong, and, once the code is opened, requests for source code: [email protected]. Questions can also be asked by phone, +62 851-6101-1651. Security vulnerabilities: [email protected], as described on the Security page. Post: PT Pakuan Teknologi Pangrango, Jl. Cihideung Udik RT 004/RW 009, Desa Cihideung Udik, Kecamatan Ciampea, Kabupaten Bogor, Jawa Barat 16620, Indonesia.

Every version that is published stays at its own address. The address without a date, legal.patepang.com/licenses, shows the version in force.