Skip to main content
SourceTrustSign in

Help center

Guides for SourceTrust: Importing dependencies, reviewing licenses, external obligations, publishing attestation pages, billing, plain-language license explainers, and procurement-oriented explainers for common open-source licenses.

Mobile apps and in-app licenses

← All articles

Pick Distributed binary, export the right file, and surface it under Settings → Legal on iOS and Android.

Read about license duties across product types

Only owners and admins can restore archived projects. A project activated by publishing or exporting returns as active, subject to paid capacity or free-plan rules. A never-activated project returns as a draft without using active-project capacity. Restoring does not publish a public page.

If you ship an App Store or Google Play app that includes open-source dependencies, buyers and app-store reviewers often expect third-party notices inside the app (Settings → About / Legal / Open source licenses), not only on a public web page. This guide connects Distribution context, Export, and that in-app screen. It is practical guidance, not legal advice.

1. Pick Distribution context

Open Project settings → Distribution. This choice drives which obligation checkboxes and compatibility warnings you see while reviewing packages.

  • iOS or Android app (OSS inside the binary you ship): choose Distributed binary.
  • Mobile app plus a hosted backend where AGPL / network-copyleft may matter: choose Mixed.
  • Pure hosted product with no app binary on user devices: choose SaaS / hosted service.
  • You ship an SDK that other apps embed, including compiled or bundled delivery: choose Library or SDK. Source, Apache NOTICE and OFL checklists ask you to review actual delivery and satisfy applicable duties, or acknowledge after confirming that a stated trigger does not apply. A listed dependency alone does not prove redistribution.
Most mobile product teams should pick Distributed binary. SaaS is the wrong default when users install your app from a store.

2. Choose disclosure delivery, then review

On create and in Project settings, pick how this project delivers disclosure: Public attestation page (default), In-app / export only (no public page; Export is primary), or both. Distribution context stays separate. For in-app only, finish package review and Export from the live inventory. For public page or both, publish when you want a live URL. With both enabled, a NOTICE shipped inside a store build can lag behind the live public page after you republish.

3. Export the file for Settings → Legal

On the project page, open Export and pick a human-readable disclosure. Full format list: Help center → Download and export formats (Download and export formats).

  • iOS: PLIST (Acknowledgements.plist) for Xcode / CocoaPods-style Acknowledgements screens.
  • Android or any WebView: HTML (self-contained page with full license text). Markdown works if your app already renders .md.
  • Plain text NOTICE: compact attribution without full license bodies. Use when you only need short copyright blocks.

4. Put it in the app (high level)

  1. iOS: Add a Settings (or About) row such as Legal, Licenses, or Acknowledgements. Load the exported PLIST into your Acknowledgements-style UI, or open the HTML export in a WebView.
  2. Android: Add Settings → Legal / Open source licenses (or equivalent). Ship the HTML or Markdown file in assets and show it in a WebView or text screen.
  3. Re-export and update the bundled file when inventory or licenses change (and after you republish, if you also keep a public page).

Public page vs in-app notice

  • Public attestation URL and Print / Save as PDF help procurement and sharing outside the app.
  • In-app Legal usually needs a bundled export so offline users still see notices. Linking only to the live page is not always enough when a license expects notices in the distribution itself.
  • If you use both, treat the public page as the live source of truth and re-bundle exports when you ship a new store build.
SourceTrust does not replace counsel. Copyleft source-offer duties, store policy, and how you present notices remain your team's responsibility. See also Review source duties if you distribute this package and Review NOTICE duties if you distribute this package.