Version 1.0, 2026-11-05. Prepared by Moves Media Ltd. with AI assistance, for review by a BC lawyer.
Open-Source and Third-Party Licence Register
and Customer Notice
Moves Media Ltd. — KidBox · Register version 1.0, 2026-11-05 · Applies to: card image built by tools/kidbox-build-image from Raspberry Pi OS Lite (arm64, Debian 13 "trixie"), Box software (requirements.lock.txt, generated 2026-09-21), App (webapp/), Cloud Functions (functions/), sound library (sounds/)
Owner: Blaise Sack. Update: for every released card image and every release bundle (tools/kidbox-release).
Part A — What ships, and what does not
| Channel | Distributed to the customer? | Why it matters |
|---|---|---|
| The microSD card in every Box (OS + venv + golden copy of the KidBox code) | Yes, a copy is in the customer's hands | Triggers GPL/LGPL source obligations and notice obligations |
Release bundles sent to Boxes by over-the-air update (tools/kidbox-release) |
Yes (KidBox code and sounds only; no OS packages) | Contains only Company code and CC0 sounds; no copyleft code (checked for every release under C2) |
| App (served by Firebase Hosting to browsers) | Yes, as JavaScript in the browser | The Firebase JS SDK is loaded from Google's servers (gstatic.com), not redistributed by the Company; Apache-2.0 notice good practice |
Cloud Functions (functions/) |
No: runs on Google's servers | No distribution, so GPL-type obligations do not arise; no AGPL code is used |
Enclosure design tools (enclosure/kidbox_enclosure.py: numpy, trimesh, manifold3d) |
The script is in the golden copy; the libraries are not installed on the card | Only the STL designs reach the customer (as a printed case) |
Part B — The register
B1. Operating system and system packages (card image)
The base is the stock Raspberry Pi OS Lite image, copied unchanged, plus three packages. The full list of packages on any image is produced by dpkg-query -W -f='${Package} ${Version}\n' against the image root (C1, step 1). The packages below are the ones that matter for compliance, with licences read from /usr/share/doc/<package>/copyright on the dev box (same OS release) on 2026-11-05.
| Component | Version (dev box, 2026-11-05) | Licence | Obligations when distributed | Added by KidBox? |
|---|---|---|---|---|
Linux kernel (linux-image-rpi-v8) |
6.18.x+rpt | GPL-2.0 | Source or written offer; licence text | No (stock) |
Raspberry Pi firmware / bootloader (raspi-firmware) |
1.20260521 | Proprietary (Broadcom/Raspberry Pi), binary redistribution allowed only for use on a Raspberry Pi; parts GPL-2.0+ | Reproduce copyright notice and disclaimer in documentation; no modification; Raspberry Pi use only | No (stock) |
Wi-Fi/Bluetooth firmware (firmware-brcm80211) |
20260519 | Binary-redistribution licences (Broadcom-wifi, Cypress), others | Reproduce notices as their licences require | No (stock) |
| GNU C library, coreutils, util-linux, etc. | Debian 13 | LGPL-2.1+ / GPL-2.0+ / GPL-3.0+ | Source or written offer; licence texts | No (stock) |
| bash | Debian 13 | GPL-3.0+ | Source or written offer; Installation Information for a User Product | No (stock) |
| systemd | Debian 13 | LGPL-2.1+ (parts GPL-2.0, CC0) | Source or written offer | No (stock) |
NetworkManager (network-manager) |
Debian 13 | GPL-2.0+ / LGPL-2.1+ | Source or written offer | No (stock); configured by KidBox (etc/NetworkManager/) |
dnsmasq (dnsmasq-base) |
2.91 | GPL-2.0 or GPL-3.0 | Source or written offer | No (stock); configured for the setup hotspot |
ALSA utilities (alsa-utils: arecord, aplay, amixer) |
Debian 13 | GPL-2.0 (parts LGPL-2.0+) | Source or written offer | Listed in apt-packages.txt (may also be in the stock Lite image) |
lgpio (python3-lgpio, liblgpio1) |
Debian 13 | Unlicense (public domain dedication) | None | Yes (apt-packages.txt) |
| overlayroot (read-only card with RAM overlay) | 0.18.debian14 | GPL-3.0+ | Source or written offer; Installation Information | Yes (installed by kidbox-build-image) |
| Python 3.13 (system interpreter) | 3.13.5 | PSF License (and others for bundled parts) | Include licence text | No (stock) |
OpenSSL (libssl3t64, openssl) |
Debian 13 | Apache-2.0 | Licence text and NOTICE | No (stock) |
| Other Debian packages in Raspberry Pi OS Lite | — | Various (GPL, LGPL, BSD, MIT, Apache, others) | As each licence requires | No (stock) |
B2. Box software dependencies (/opt/kidbox-venv, from requirements.lock.txt)
Licences read from each package's installed metadata on 2026-11-05 (/home/bsack/kidbox-venv-clean, built from the same lock file).
| Package | Version | Licence | Notes |
|---|---|---|---|
| firebase_admin | 7.4.0 | Apache-2.0 | |
| google-api-core | 2.38.0 | Apache-2.0 | |
| google-auth | 2.55.1 | Apache-2.0 | |
| google-cloud-core | 2.7.0 | Apache-2.0 | |
| google-cloud-firestore | 2.28.0 | Apache-2.0 | |
| google-cloud-storage | 3.12.0 | Apache-2.0 | |
| google-crc32c | 1.8.0 | Apache-2.0 (from the project; the package metadata has no licence field) | Compiled extension |
| google-resumable-media | 2.10.2 | Apache-2.0 | |
| googleapis-common-protos | 1.75.3 | Apache-2.0 | |
| grpcio, grpcio-status | 1.83.1 | Apache-2.0 | Wheel bundles third-party C libraries (e.g. BoringSSL, zlib, c-ares, abseil, re2) under their own permissive licences |
| protobuf | 7.36.2 | BSD-3-Clause | |
| proto-plus | 1.28.4 | Apache-2.0 | |
| opentelemetry-api | 1.44.0 | Apache-2.0 | |
| cryptography | 43.0.0 | Apache-2.0 OR BSD-3-Clause | Wheel bundles OpenSSL (Apache-2.0) |
| cffi | 2.1.1 | MIT-0 | |
| pycparser | 3.0 | BSD-3-Clause | |
| requests | 2.34.2 | Apache-2.0 | |
| urllib3 | 2.8.0 | MIT | |
| idna | 3.20 | BSD-3-Clause | |
| charset-normalizer | 3.5.1 | MIT | |
| certifi | 2026.7.22 | MPL-2.0 | File-level copyleft; shipped in source form |
| CacheControl | 0.14.4 | Apache-2.0 | |
| msgpack | 1.2.2 | Apache-2.0 | |
| httpx | 0.28.1 | BSD-3-Clause | |
| httpcore | 1.0.9 | BSD-3-Clause | |
| h11 | 0.16.0 | MIT | |
| h2 / hpack / hyperframe | 4.4.1 / 4.2.0 / 6.1.0 | MIT | |
| anyio | 4.15.1 | MIT | |
| PyJWT | 2.14.0 | MIT | |
| pyasn1 / pyasn1_modules | 0.6.4 / 0.4.2 | BSD-2-Clause | |
| typing_extensions | 4.16.0 | PSF-2.0 | |
| gpiozero | 2.0.1 | BSD-3-Clause | |
| colorzero | 2.0 | BSD-3-Clause | |
| pip | 26.2.1 | MIT | Present in the venv; bundles vendored libraries under permissive licences |
| setuptools | 84.0.0 | MIT | Present in the venv |
Result: no GPL, LGPL or AGPL code in the Box's Python dependencies. Obligations are attribution: keep copyright notices and licence texts, and the Apache-2.0 NOTICE files where a package has one.
B3. Content: sounds and voice
| Item | Source | Licence | Obligations |
|---|---|---|---|
Funny-mode library: animal and effect clips (sounds/library/, 11 named clips) |
Wikimedia Commons, per sounds/library/CREDITS.txt |
CC0 / public domain | None (provenance kept) |
k-*.wav clips (sounds/library/) |
Kenney (kenney.nl) Interface, Impact, Digital Audio, Sci-fi packs | CC0 | None (provenance kept) |
Generated tones, chime, clicks (make_chime.py, make_click.py, make_game_tones.py, make_sfx_pack.py, make_funny_sounds.py) |
Company code | Company-owned | — |
Spoken prompts (sounds/*.wav, sounds/game/*) |
Recorded by Blaise Sack (record_prompts.py) |
Company-owned under the Founder IP Assignment (cl. 2 and 6) | Voice licence (cl. 6) |
B4. App (browser)
| Component | Version | Licence | How delivered | Obligations |
|---|---|---|---|---|
Firebase JavaScript SDK (firebase-app, -auth, -firestore, -functions) |
11.0.2 | Apache-2.0 | Loaded from https://www.gstatic.com/firebasejs/11.0.2/ |
Not redistributed by the Company; credit in the App's notice (good practice) |
wav-recorder.js, app.js, learning.js |
— | Company code | Firebase Hosting | — |
| Fonts, icons | No third-party fonts loaded; icons are Company files (icon-192.png, icon-512.png) |
Company-owned | Firebase Hosting | — |
B5. Cloud Functions (server only; not distributed)
firebase-functions, firebase-admin, requests, google-cloud-storage, google-api-core 2.31.0 (pinned): all Apache-2.0. Runs on Google's servers; no distribution. Listed for completeness and for due diligence.
B6. Services (not software licences, but third-party terms)
Google Firebase (Firestore, Storage, Functions, Hosting, Authentication); Twilio (SMS). Governed by their terms and data-processing addenda (see the vendor terms memo and the vendor and processor register).
Part C — Compliance procedure (internal)
C1. For every card image released (tools/kidbox-build-image), the release owner:
- Generates the package manifest of the image: package, version, source package, licence (from
/usr/share/doc/*/copyright), and saves it aslicences/image-<sha256>.txtwith the image's SHA-256. - Collects the licence texts (
/usr/share/doc/*/copyrightand/usr/share/common-licenses/*) into the image at a known path, e.g./usr/share/doc/(already present on the stock image) and/opt/kidbox-golden/LICENCES/for the venv packages' licence files. - Archives the corresponding source for every GPL/LGPL package in that image: the Debian and Raspberry Pi source packages for the exact versions (
apt-get sourceagainst the image's sources, or the matching snapshots from the Debian and Raspberry Pi archives), plus the kernel source for the exact+rptversion. Stores the archive, keyed by image SHA-256, for at least three years after the last Box with that image is sold, and for as long as the Company provides support or spare parts for it (GPLv3 s. 6(b)). - Updates this register (Part B) and the customer notice (Part D) and publishes them at app.kidbox.ca/legal/open-source.
The source archives are kept in the Company's own storage, never in the KidBox Firebase project, which holds Children's data. Source is supplied on request under the written offer (Part D), not mirrored in full for every image.
C2. For every OTA release bundle (tools/kidbox-release): confirm it contains only Company code and CC0 sounds. If any third-party file is added, add it to Part B before release.
C3. Source requests. A request for source code is answered within 30 days, by download link or, if asked, on a physical medium at no more than the cost of physically performing the distribution. Log each request (date, image, how answered) in the complaints and support log.
C4. New dependencies. No package may be added to requirements.txt, apt-packages.txt, the build tool or the App without recording its licence here first. AGPL, SSPL, "non-commercial" or "no-derivatives" licences are not allowed without a director's written approval. GPL/LGPL packages are allowed for programs the Box runs as separate programs, not for code linked into the KidBox application. The Company modifies no GPL program today; if it ever does, its changes are published with the corresponding source.
C5. Contractors follow clause 4.4 of the Independent Contractor and IP Assignment Agreement and check this register.
C6. The Company's own code is proprietary: © Moves Media Ltd., all rights reserved. It is on the card in source form (Python) because that is how it runs; the customer licence is in the Subscription Terms (cl. 17).
Part D — Customer-facing notice
Published by Moves Media Ltd. at app.kidbox.ca/legal/open-source, and linked from the Terms of Sale (cl. 8.3) and the Quick-Start insert (one line: "Open-source licences and source code: app.kidbox.ca/legal/open-source").
Open-source software in KidBox
Version 1.0 · Effective December 1, 2026
Moves Media Ltd.
Your KidBox runs on a small computer (a Raspberry Pi). Its memory card holds the Raspberry Pi OS operating system, which is made of free and open-source software written by thousands of people, together with KidBox's own program, written by Moves Media Ltd.
Open-source software comes with licences that give you rights, such as the right to get the source code and, for some programs, to change them. Those rights are yours, and nothing in our Terms of Sale or Subscription Terms limits them.
What is on the card
- The Linux kernel and GNU tools, under the GNU General Public License (version 2 or 3) and Lesser General Public License;
- Raspberry Pi OS packages from Debian and Raspberry Pi Ltd., under the licences listed in each package;
- Python, under the Python Software Foundation License;
- Google's Firebase and Cloud libraries, gRPC, and other Python libraries, under the Apache License 2.0, MIT, BSD and Mozilla Public License 2.0, listed in full below;
- firmware from Broadcom and Raspberry Pi Ltd. for the processor and the Wi-Fi chip, which is not open source but is licensed for use on a Raspberry Pi; and
- some sound effects from Wikimedia Commons and Kenney (kenney.nl), which their creators have dedicated to the public domain (CC0). Thank you to them.
The KidBox program itself, its spoken prompts and its other sounds are © Moves Media Ltd.
Full list and licence texts: [link: the package manifest and licence texts for your Box's card image, by version]
Written offer for source code.
For at least three years from the date we last sell a KidBox with a given card image, and for as long as we offer spare parts or customer support for that model, Moves Media Ltd. will give anyone who asks a complete, machine-readable copy of the corresponding source code for every program on that card image that is licensed under the GNU General Public License, the GNU Lesser General Public License, or another licence that requires us to offer source code. We provide it free by download, or on a physical storage medium for no more than our cost of making and sending it.
To ask, email info@kidbox.ca with the subject "Source code request", and tell us your KidBox's software version (shown in the App, in the list of everything KidBox holds about your child) or the month you bought it. Or write to: Moves Media Ltd., 2405 George Street, North Vancouver, BC V7P 2N4.
This offer is valid for anyone who has received the software, not only buyers.
Changing the software. You may reflash your KidBox's memory card with software of your choice. If you do, the Box may stop working with the KidBox Service, and our Limited Warranty may not cover problems caused by the change (your statutory rights are not affected). The KidBox Service checks that updates to the KidBox program are signed by us; it does not stop you from installing other software on your own card.
Notices required by particular licences
Raspberry Pi / Broadcom firmware: [Reproduce the copyright notice and disclaimer from /usr/share/doc/raspi-firmware/copyright, "Proprietary_1", in full.]
Apache License 2.0 components (Firebase Admin SDK, Google Cloud client libraries, gRPC, requests, OpenSSL and others): [Reproduce the Apache-2.0 licence text once, and the NOTICE file of each component that has one.]
MIT, BSD and PSF components: [Reproduce each copyright notice and licence text, as each requires.]
Mozilla Public License 2.0 (certifi): the source code of this component is included on the card in /opt/kidbox-venv/.../certifi/ and is available at https://github.com/certifi/python-certifi.
Wi-Fi firmware (Broadcom / Cypress): [Reproduce any notice those licences require.]
Last updated: [DATE] · Card image [VERSION / SHA-256]
Short version for the Quick-Start insert (EN / FR)
Open-source software: KidBox includes open-source software. Licences, notices and our offer of source code: app.kidbox.ca/legal/open-source.
Logiciels libres : KidBox contient des logiciels libres. Licences, avis et notre offre de code source : app.kidbox.ca/legal/open-source. (Traduction automatique à faire vérifier par un traducteur ou une personne de langue maternelle française.)
Line for the App (for an "Open-source licences" link in the App's settings)
Open-source licences — KidBox is built with open-source software. See the licences and get the source code at app.kidbox.ca/legal/open-source.