Licenties

Lumen bundles the following third-party components. Full license texts for every Dart/Flutter package ship inside the app: Settings → About → Open-source licenses.

libmpv (playback engine)

Lumen dynamically links libmpv. Windows and Linux use our own builds; Android, macOS and iOS use media-kit's prebuilt builds:

• Windows: libmpv-2.dll — built by Lumen from shinchiro/mpv-winbuild-cmake with the LGPL configuration in tools/libmpv/lgpl_full.py; the recipe commit and the mpv/FFmpeg tags are recorded in third_party/libmpv-win32/BUILD_INFO.
• Linux: lib/libmpv.so.2 — built by Lumen with tools/libmpv/build-libmpv-linux.sh (mpv v0.41.0, FFmpeg n9.0.1, the same LGPL configuration as Windows), with dav1d (BSD-2-Clause), libass (ISC) and libplacebo (LGPL-2.1-or-later) linked in; the versions are in lib/libmpv.BUILD_INFO next to it. GnuTLS, libxml2, freetype, fribidi, harfbuzz, fontconfig and the graphics and sound libraries are the system's own.
• Android: libmpv.so — built by media-kit/libmpv-android-video-build (release v1.1.11, "full" flavor)
• macOS and iOS: built by media-kit/libmpv-darwin-build (release v0.6.0)

Both are configured LGPL-only (Windows: by our recipe; Android: media-kit's "full" flavor, verified from strings in the shipped binary):

• mpv — LGPL-2.1-or-later (-Dgpl=false). Source: https://github.com/mpv-player/mpv
• FFmpeg — LGPL-3.0-or-later (--disable-gpl --disable-nonfree --enable-version3; no GPL-only components — x264, x265, davs2, rubberband, libdvdnav/libdvdread are not built). Source: https://github.com/FFmpeg/FFmpeg
• Additional statically linked libraries (libass, libplacebo, shaderc, SPIRV-Cross, dav1d, opus, vorbis, FLAC, libjxl, zimg, soxr, speex, libmysofa, libbs2b, harfbuzz, fontconfig, freetype, fribidi, lcms2, libarchive, uchardet, mujs, luajit, libbluray, libaribcaption, libzvbi, libssh, libsrt, OpenSSL, libxml2, libmodplug, libopenmpt, game-music-emu, OpenAL Soft, SDL2, libsixel, mbedtls, and others) under their respective permissive/LGPL/MPL/Apache licenses; the exact set and versions are in the recipe's packages/ directory at the recorded commit. The Windows recipe drops the encoder-only libraries (aom, SVT-AV1, libvpx, lame, libwebp); media-kit's Android build may include them.

Per the LGPL, the libmpv library is shipped as a separate shared library: you may replace libmpv-2.dll / libmpv.so / libmpv.so.2 with your own (modified) build. The upstream sources are at the links above. For the exact corresponding source of the libmpv Lumen ships, including our Windows and Linux build recipes, write to hello@lumen.movie; it is provided free of charge for at least three years after the version you received.

Bundled fonts

• Inter (SIL Open Font License 1.1), Regular and SemiBold — the interface text face, and the libass subtitle face on Android. Copyright (c) 2016 The Inter Project Authors. https://github.com/rsms/inter
• Sora (SIL Open Font License 1.1), SemiBold and Bold — the display face. Copyright 2019 The Sora Project Authors. https://github.com/sora-xor/sora-font

Both ship inside the app, so it never fetches a font at runtime. The full license text is in assets/fonts/OFL.txt and in Settings → About → Open-source licenses.

Remote pairing cryptography

• opaque-ke 4.0.1 (Apache-2.0 OR MIT), copyright Meta Platforms, Inc. and affiliates — source and licenses. Implements OPAQUE (RFC 9807); Lumen uses Ristretto255/SHA-512/TripleDH.
• argon2 0.5.3 (MIT OR Apache-2.0), RustCrypto contributors — source and licenses.
• curve25519-dalek 4.1.3 (BSD-3-Clause), Dalek contributors — source and license.

OPAQUE's published 2021 audit covered an older implementation; it does not constitute an audit of this version or Lumen's remote protocol integration.

Application frameworks

• Flutter (BSD-3-Clause) — https://github.com/flutter/flutter
• Dart (BSD-3-Clause) — https://dart.dev
• Rust crates and Dart packages: permissively licensed (MIT/Apache-2.0/BSD); the in-app license screen lists each Dart package with its license text.

Skip intro data

Intro, recap and credits timestamps come from the community databases IntroDB (https://introdb.app) and AniSkip (https://aniskip.com), looked up per episode. Intro data provided by IntroDB (introdb.app).

Subtitles made on this device (Windows)

• whisper.cpp and ggml (MIT), copyright the ggml authors — speech recognition, built into the app from the copy vendored with whisper-rs-sys (core/vendor/whisper-rs-sys). The full licence text is in core/vendor/whisper-rs-sys/whisper.cpp/LICENSE. https://github.com/ggml-org/whisper.cpp
• whisper-rs and whisper-rs-sys (Unlicense) — Rust bindings. https://codeberg.org/tazz4843/whisper-rs
• Whisper speech models (MIT, OpenAI; ggml conversions by the whisper.cpp project) are not shipped with Lumen. They are downloaded on request from the whisper.cpp project and checked against pinned hashes.
• Parakeet TDT 0.6B v3 speech model (CC-BY-4.0, NVIDIA; ggml conversion by the ggml-org project, MIT) is not shipped with Lumen. It is downloaded on request from ggml-org/parakeet-GGUF and checked against a pinned hash. Model by NVIDIA, https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3, licensed under CC BY 4.0, https://creativecommons.org/licenses/by/4.0/; converted to ggml, otherwise unchanged.
• whatlang (MIT) — tells the language a transcript is in. https://github.com/greyblake/whatlang-rs

Subtitles translated on this device (Windows)

lumen-mt.exe is built from these, unmodified apart from build settings (tools/bergamot/build-windows.ps1; the exact commits are in third_party/bergamot-win32/BUILD_INFO):

• Bergamot translator (MPL-2.0), the Bergamot project and Mozilla. Source: https://github.com/browsermt/bergamot-translator. The MPL-2.0 text is at https://mozilla.org/MPL/2.0/.
• Marian NMT (MIT), Marian developers. https://github.com/browsermt/marian-dev
• intgemm (MIT), ruy (Apache-2.0), cpuinfo (BSD-2-Clause), SentencePiece (Apache-2.0), yaml-cpp (MIT), ssplit-cpp (Apache-2.0), PCRE2 (BSD-3-Clause), CLI11 (BSD-3-Clause) and spdlog (MIT), as vendored by Marian and Bergamot.
• Firefox Translations models (MPL-2.0, Mozilla) are not shipped with Lumen. They are downloaded on request from Mozilla's own servers, the ones Firefox uses, and checked against the hashes Mozilla publishes (pinned in core/crates/lumen-core/src/translate_models.json).