I work on an Android app which is only used by customers. Anyone can download the app from the Play Store but if they don't have credentials then they will just see a login screen and won't be able to get past that. (Registration process is handled separately and not in the app.) My app uses multiple open source libraries and I will have a button which opens the list of open source licenses. Ideally I don't want to have to add this button to the login screen as it has a fairly clean design. Is it acceptable to add the button to my app's "about" screen which is only accessible post-authentication? This will however mean that people who are not customers will not be able to access this license information, but there would be nothing they could do with the app anyway. Are there some precedents here with how other major apps have approached this?
-
3What licence is the app itself distributed under?– MadHatter ♦Jun 25, 2021 at 12:05
-
And what (type of) licenses are the libraries under?– Bart van Ingen SchenauJun 25, 2021 at 12:07
-
1@MadHatter app itself is a proprietary app, not open source. the libraries are using various types of license (not GPL) such as Apache 2, MIT and ISC– Adam BurleyJun 25, 2021 at 12:10
-
3Why not make it a simple link, leading to a website, below the "Log In" button? Here you can explain why no registration, all the privacy rules, licenses etc.– kiler129Jun 25, 2021 at 22:31
1 Answer
I would strongly suggest that compliance-related information is immediately accessible, without requiring a log in. This includes documents such as your contact details, your terms of service, your privacy policy, and yes, open source attributions.
The intent of most open source licenses is that you have to at least attribute the various open source components you are using. This attribution is due whenever an end user receives your app, even if they are not logged in. For example, the Apache License 2.0 is quite clear:
You must give any other recipients of the Work or Derivative Works a copy of this License
Your app includes the Apache-covered Work, thus the end user who has downloaded your app is a recipient of this Work even if they're not logged in.
It might be sufficient to provides these notices and licenses in documentation for your app, for example by linking it from the app description in whatever app store you use. But I'm not necessarily convinced that this would always be compliant with all open source licenses. Including these notices directly with each copy of the app, and making them accessible to the typical user without any hurdles, is the safest path towards license compliance.
-
I think the last sentence is exactly the point I was trying to make in my original post. The "typical user" is someone who will have login details. I think 99.9% of people who download the app are our customers who will already have such login details. There is simply no reason for anyone who is not a customer to download and install the app, as it will be of no use to them. So I felt that by displaying a screen in the app, even behind the login screen, we absolutely are making the notices accessible to the typical user. Jun 28, 2021 at 11:51
-
@AdamBurley I should rephrase. By “typical user” I did not mean “a type of user who is likely to use your app” but “a user with a typical level of mental capability and technical skills should be able to access the licensing information”. For example, making licensing information inaccessible unless the user scores >120 points on an IQ test would clearly violate the license even if the app is intended for Mensa members; an app where licenses are accessible only over ADB would be a violation even if its target audience is Android developers.– amonJun 28, 2021 at 12:08