# Third-party source notices

- **MajsoulMax**, Avenshy and contributors. GPL-3.0. Source and license: `upstream/MajsoulMax/`. Exact source revision is in `UPSTREAM.lock.json`. Android reuses the original mod, helper, resource replacement and protobuf code.
- **hev-socks5-tunnel**, hev and contributors. MIT. Source and license: `native/hev-socks5-tunnel/`. Included subprojects keep their own notices: hev-socks5-core, hev-task-system, lwIP and libyaml. Android makefiles also contain Apache-2.0 notices.
- **Chaquopy**, Chaquo Ltd. Distributed through its official Gradle repository under its bundled licensing terms; see https://github.com/chaquo/chaquopy.
- **Python**, Python Software Foundation License. Embedded by Chaquopy.
- **apksig**, Android Open Source Project, Apache-2.0. Used for local APK signing and verification; https://android.googlesource.com/platform/tools/apksig/.
- **AndroidX Core**, Android Open Source Project, Apache-2.0. Provides FileProvider for user-requested installation of locally generated APKs; https://android.googlesource.com/platform/frameworks/support/.
- **protobuf**, BSD-3-Clause; **ruamel.yaml**, MIT; **loguru**, MIT; **requests**, Apache-2.0; **wsproto/h11**, MIT; **cryptography**, Apache-2.0 OR BSD-3-Clause. Their transitive packages and native wheels retain the notices distributed in those packages.
- **Waitress**, Zope Foundation and contributors, ZPL-2.1; used by the separate authorization server, not included in the APK.

ULTRA modification notice, 2026-10-22: Android product branding and activation UI changed; time-card authorization service added; the injected loading announcement in upstream plugin/mod.py now displays ULTRA success and account-ban risk text. Other upstream plugin behavior is retained. This modified version remains distributed under GPL-3.0 with corresponding source and without warranty. Activation is not a replacement for recipients' GPL rights.

The APK is a local development preview, not an official Mahjong Soul application. No proprietary game artwork or official APK is redistributed in this project. Local CA private keys are generated separately on each installation and are excluded from exported certificates and Android backup. Resource APK signing keys are generated in AndroidKeyStore on the user's device, are not exported, and cannot reproduce the official publisher's signature. Apache-2.0 license text is included in assets/licenses/Apache-2.0.txt.
