Third-Party Notices — Coii Voice
Effective 2026-08-30
Coii Voice is built on open-source software and runs speech-recognition models it did not train. This file lists them, states the licence each is under, and says what that licence requires of a paid product.
This document is the readable summary. The authoritative list is the generated
THIRD-PARTY-LICENSES.txtthat ships inside the app, produced from the actual dependency tree — several hundred crates once transitive ones are counted — while §2 below names only the direct dependencies, in the interest of being read. Where the two disagree, the generated file is right.
1. Can a paid app be built on all of this?
Yes. Everything in §2 is under MIT, Apache-2.0, BSD, ISC, Unicode or the public
domain; the models in §3 are Apache-2.0, MIT, CC-BY-4.0 and one attribution-only
model licence. Every one of those permits commercial use, selling, and
distribution in a closed-source product. No copyleft licence is present —
nothing here is GPL or LGPL, so nothing obliges us to publish our own source.
The two components that matter most, whisper.cpp and llama.cpp, are both
MIT; sherpa-onnx is Apache-2.0.
What they all require is attribution: the copyright line and the licence text have to travel with the binary, which they do — see §4. Two models, Parakeet and SenseVoice, ask for attribution by name as a condition of their own licences, and get it in §3.
2. Components compiled into the app
Shipped inside the .app bundle, so their notices must travel with it. Direct
dependencies only; the generated file has the whole tree.
Rust
| component | licence | role |
|---|---|---|
Tauri (+ plugin-opener, plugin-notification, plugin-global-shortcut) |
MIT OR Apache-2.0 | application framework, the tray, the hotkey |
| whisper.cpp, via whisper-rs | MIT | the Whisper engine; built from source at compile time, with Metal |
| llama.cpp | MIT | the bundled llama-server sidecar and its libggml* / libllama* / libmtmd libraries, which run the default engine |
| ggml | MIT | tensor library inside both of the above |
| sherpa-onnx, via sherpa-rs | Apache-2.0 | the Parakeet and SenseVoice engines |
| ONNX Runtime | MIT | arrives as a prebuilt library with sherpa-onnx; runs the ONNX models |
SQLite, via rusqlite |
public domain (SQLite); MIT (rusqlite) |
the dictation history |
cpal |
Apache-2.0 | microphone capture |
hound |
Apache-2.0 | WAV encoding for the audio handed to an engine |
tokio, reqwest, futures-util |
MIT (tokio, reqwest); MIT OR Apache-2.0 (futures-util) |
async runtime and HTTP — model downloads, the licensing calls, the trial clock |
serde, serde_json, chrono, anyhow, thiserror, parking_lot, crossbeam-channel, ulid, dirs, num_cpus, sha2, sys-locale |
MIT OR Apache-2.0 | general utilities |
keyring-core, apple-native-keyring-store |
MIT OR Apache-2.0 | licence key storage in the macOS keychain |
Apple's own frameworks — AppKit, AVFoundation, ApplicationServices (the accessibility API the text is typed through), Metal, Security — are used under the Apple SDK licence that comes with Xcode, and are not redistributed. The listening overlay and the text injection are hand-written Objective-C in this app, not a library.
JavaScript
| component | licence |
|---|---|
| React and React DOM | MIT |
@tauri-apps/api, @tauri-apps/plugin-opener, @tauri-apps/plugin-notification |
MIT OR Apache-2.0 |
Build-time only, not shipped: Vite (MIT), Tailwind CSS (MIT), TypeScript
(Apache-2.0), @tauri-apps/cli (MIT OR Apache-2.0).
3. Model weights, downloaded at runtime
Not bundled. The app fetches these onto your machine from Hugging Face when you choose an engine, and each is licensed by whoever trained it.
| model | source | licence |
|---|---|---|
Qwen3-ASR 1.7B (GGUF, with its mmproj audio projector) |
huggingface.co/ggml-org/Qwen3-ASR-1.7B-GGUF |
Apache-2.0 — the licence on Qwen/Qwen3-ASR-1.7B, the model the GGUF was converted from (checked 2026-08-30; the conversion repository declares none of its own) |
| Parakeet TDT 0.6B v3 (int8 ONNX) | huggingface.co/csukuangfj/sherpa-onnx-nemo-parakeet-tdt-0.6b-v3-int8 |
CC-BY-4.0 — NVIDIA's weights; attribution is the condition, and this line is it: Parakeet TDT 0.6B v3, © NVIDIA Corporation, CC-BY-4.0 |
| SenseVoice Small (int8 ONNX) | huggingface.co/csukuangfj/sherpa-onnx-sense-voice-zh-en-ja-ko-yue-2024-07-17 |
FunASR Model Open Source License v1.1 (Alibaba Group) — the licence on FunAudioLLM/SenseVoiceSmall, the weights the ONNX file was converted from (checked 2026-08-30). Not an OSI licence, but a short one: free to use, copy, modify and share, including commercially; the one condition is to attribute the source and author and keep the model's name, and this line is that: SenseVoice Small, © 2023–2028 Alibaba Group, FunASR Model Open Source License v1.1. The code around it is MIT |
Whisper large-v3 Turbo (q5_0) |
huggingface.co/ggerganov/whisper.cpp |
MIT — OpenAI released Whisper's weights under MIT, and the ggml conversions are MIT |
A quantisation is a derivative of the model it was made from and carries that
model's licence, which is why the GGUF and int8 files are listed under the
licence of the weights they were made from: the converter does not get to
relicense them. The FunASR licence also says its terms may be revised in the
official repository and take effect automatically; the bar in Coii Audio's
docs/models.md — no pass-through obligation the app has nowhere to perform —
is met, because the licence asks nothing of a downstream user beyond the
attribution above, but it is the one entry here whose text can change under us,
and is worth re-reading at each release.
A model you install yourself through a manifest you wrote (§12.2 of the Terms) is not in this table and is not ours to license.
Not a licence question, but adjacent
Hugging Face is not obliged to keep serving us. It can rate-limit, move or withdraw a file, and an install that depends on it will fail when it does. §11 of the Terms says so to the buyer; engines already installed keep working, because a model is a file on disk rather than a service.
4. How the notices are actually delivered
MIT, Apache-2.0, BSD and ISC all require the copyright notice and licence text to
be distributed with the binary. The condition is on the copy — MIT says the
notice "shall be included in all copies", and Apache-2.0 §4(a) says recipients
must be given a copy of the licence — so a link to a web page does not satisfy
it. Apache-2.0 §4(d) even enumerates the three acceptable places for a NOTICE
file's contents: a NOTICE text file in the distribution, the documentation
shipped with it, or a display the software itself generates. A URL is not among
them.
So the notices travel with the app, in both of the forms that count:
| The file | Contents/Resources/THIRD-PARTY-LICENSES.txt inside the .app, declared in tauri.conf.json under bundle.resources |
| The display | Settings → Legal → Open-source licences, which reads that same file — one copy, so the two can never disagree |
That file is not maintained by hand. desktop/scripts/gen-licenses.sh generates
it from the dependency tree the binary is actually built from — every Rust
crate, every npm package bundled into the frontend, and the native components
that appear in no manifest because they are compiled from source or arrive as
prebuilt libraries (llama-server and its dylibs, whose version is read off the
binary itself; sherpa-onnx; ONNX Runtime) — and gen-licenses.sh --check fails
when the committed copy has drifted.
5. Contact
Corrections to this file, or a licence claim you believe is wrong, to support@coii.io — they are worth fixing quickly.