# Third-party notices

Privacy Tools is GPL-3.0-or-later. Dependencies retain their own licences. A
production build generates `LICENSES/npm-runtime-licenses.txt` from the exact
locked runtime packages and copies every available licence/notice text into the
release.

Material runtime components include:

| Component                        | Version | Licence          | Purpose/source                                                                                     |
| -------------------------------- | ------- | ---------------- | -------------------------------------------------------------------------------------------------- |
| ExifReader                       | 4.44.0  | MPL-2.0          | Secondary metadata parser; <https://github.com/mattiasw/ExifReader/tree/v4.44.0>                   |
| fflate                           | 0.8.2   | MIT              | Bounded PNG metadata inflation and ZIP creation; <https://github.com/101arrowz/fflate/tree/v0.8.2> |
| `@add-ideas/toolbox-helpers`     | 0.2.0   | GPL-3.0-or-later | Hashing, safe names, download and deterministic JSON primitives                                    |
| `@add-ideas/toolbox-contract`    | 0.3.0   | Apache-2.0       | Toolbox manifest contract                                                                          |
| `@add-ideas/toolbox-shell-react` | 0.3.0   | Apache-2.0       | Shared application shell                                                                           |
| React / React DOM                | 19.2.8  | MIT              | User interface                                                                                     |

ExifReader is used unmodified. Its MPL-2.0 covered source remains available at
the exact upstream link above and through the npm package resolved by the
lockfile. The bundled executable does not relicense or restrict the MPL-covered
files. Consult the generated licence inventory for the full MPL-2.0 text and
the exact notices shipped with every runtime package.