/legal / open-source

Open Source Notices

Version v1

OPEN SOURCE NOTICES

Clock Out Capital LLC

Effective Date: August 6, 2026

Last Updated: August 6, 2026

About This Document

Clock Out Capital LLC builds the Clock Out Capital website, the Clock Bots automated trading software, the stock screener, and related services using both proprietary code and open source software components developed by third parties. This document lists the open source components incorporated into our Services, the licenses under which they are made available, and where applicable, copies of those license texts.

All open source components remain the property of their respective copyright holders and are licensed to us, and to you, under the terms set forth below. Inclusion of a component in this document does not imply endorsement of, or by, that component's authors.

HOW TO FILL THIS IN: This is a TEMPLATE. Before publishing, you (or someone you ask to do this) must populate Section 2 with the actual list of open source dependencies used in production code. The recommended workflow is in Section 5 below — most of it can be automated. Do NOT publish this document with placeholders intact.

1. Why This Document Exists

Most open source licenses (including MIT, Apache 2.0, BSD, and ISC) include an attribution requirement. To comply, the copyright notice and the full text of the license must be reproduced and made available to anyone who receives the software. Publishing a public Open Source Notices document is the standard way to satisfy this obligation for a SaaS product. Failing to provide attribution is a license violation, even for permissive licenses.

2. Open Source Components

Per the §5 workflow, this section is generated from pip-licenses (Python backend) and license-checker (frontend) scans of production dependencies. Direct dependencies are listed in detail. Transitive dependencies (pulled in by direct deps) are summarized by license family — full transitive metadata is regenerated on each release per §5 Step 5.

Generated 2026-08-07. Re-run before each major release with scripts/regen_oss_notices.py.

2.1 Backend (Python)

Direct production dependencies declared in requirements.txt:

supabase 2.16.0

  • License: MIT
  • Source: https://github.com/supabase/supabase-py

python-dotenv 1.2.2

  • License: BSD-3-Clause
  • Source: https://github.com/theskumar/python-dotenv

cryptography 50.0.0

  • License: BSD-3-Clause
  • Source: https://github.com/pyca/cryptography

jsonschema 4.26.0

  • License: MIT
  • Source: https://github.com/python-jsonschema/jsonschema

PyJWT 2.13.0

  • License: MIT
  • Source: https://github.com/jpadilla/pyjwt

bcrypt 5.0.0

  • License: Apache-2.0
  • Source: https://github.com/pyca/bcrypt/

pandas 2.3.3

  • License: BSD
  • Source: https://pandas.pydata.org

pandas-ta 0.4.71b0

  • License: UNKNOWN
  • Source: https://www.pandas-ta.dev

alpaca-py 0.43.4

  • License: Apache-2.0
  • Source: https://github.com/alpacahq/alpaca-py

fastapi 0.136.1

  • License: MIT
  • Source: https://github.com/fastapi/fastapi

uvicorn 0.46.0

  • License: BSD-3-Clause
  • Source: https://uvicorn.dev/

email-validator 2.3.0

  • License: The Unlicense (Unlicense)
  • Source: https://github.com/JoshData/python-email-validator

Jinja2 3.1.6

  • License: BSD
  • Source: https://github.com/pallets/jinja/

hyperliquid-python-sdk 0.23.0

  • License: MIT
  • Source: https://github.com/hyperliquid-dex/hyperliquid-python-sdk

snaptrade-python-sdk 11.0.212

  • License: MIT
  • Source: UNKNOWN

ccxt 4.5.51

  • License: MIT
  • Source: https://ccxt.com

anthropic 0.97.0

  • License: MIT
  • Source: https://github.com/anthropics/anthropic-sdk-python

openai 2.35.1

  • License: Apache-2.0
  • Source: https://github.com/openai/openai-python

google-genai 1.75.0

  • License: Apache-2.0
  • Source: https://github.com/googleapis/python-genai

requests 2.33.1

  • License: Apache-2.0
  • Source: https://github.com/psf/requests

vectorbt 1.0.0

  • License: UNKNOWN
  • Source: https://github.com/polakowo/vectorbt

TA-Lib 0.6.8

  • License: UNKNOWN
  • Source: http://github.com/ta-lib/ta-lib-python

duckdb 1.5.2

  • License: MIT
  • Source: https://github.com/duckdb/duckdb-python

yfinance 1.3.0

  • License: Apache-2.0
  • Source: https://github.com/ranaroussi/yfinance

lxml 6.1.0

  • License: BSD-3-Clause
  • Source: https://lxml.de/

openpyxl 3.1.5

  • License: MIT
  • Source: https://openpyxl.readthedocs.io

xlrd 2.0.2

  • License: BSD
  • Source: http://www.python-excel.org/

pandas_market_calendars 5.3.2

  • License: MIT
  • Source: https://github.com/rsheftel/pandas_market_calendars

stripe 15.1.0

  • License: MIT
  • Source: https://stripe.com/

resend 2.30.0

  • License: MIT
  • Source: https://github.com/resendlabs/resend-python

pywebpush 2.3.0

  • License: MPL-2.0
  • Source: https://github.com/web-push-libs/pywebpush

python-multipart 0.0.32

  • License: Apache-2.0
  • Source: https://github.com/Kludex/python-multipart

sentry-sdk 2.60.0

  • License: MIT
  • Source: https://github.com/getsentry/sentry-python

logfire 4.33.0

  • License: MIT
  • Source: https://pydantic.dev/logfire

Plus 164 transitive dependencies. License rollup across all 198 Python packages installed in production:

  • MIT: 98
  • Apache-2.0: 34
  • BSD: 26
  • BSD-3-Clause: 18
  • BSD-2-Clause: 6
  • UNKNOWN: 4
  • ISC: 3
  • PSF: 2
  • PSF-2.0: 2
  • MPL-2.0: 2
  • Mozilla Public 2.0 (MPL 2.0): 1
  • The Unlicense (Unlicense): 1
  • LGPL: 1

2.2 Frontend (JavaScript / TypeScript)

Direct production dependencies declared in frontend/package.json:

@elevenlabs/client 1.8.1

  • License: MIT
  • Source: https://github.com/elevenlabs/packages

@reown/appkit 1.8.19

  • License: Custom: https://demo.reown.com
  • Source: https://github.com/reown-com/appkit

@reown/appkit-adapter-ethers 1.8.19

  • License: Custom: https://demo.reown.com
  • Source: https://github.com/reown-com/appkit

@sentry/react 10.53.1

  • License: MIT
  • Source: https://github.com/getsentry/sentry-javascript

@supabase/supabase-js 2.105.1

  • License: MIT
  • Source: https://github.com/supabase/supabase-js

dompurify 3.4.12

  • License: Apache-2.0
  • Source: https://github.com/cure53/DOMPurify

ethers 6.17.0

  • License: MIT
  • Source: https://github.com/ethers-io/ethers.js

lightweight-charts 5.2.0

  • License: Apache-2.0
  • Source: https://github.com/tradingview/lightweight-charts

lucide-react 0.468.0

  • License: ISC
  • Source: https://github.com/lucide-icons/lucide

react 18.3.1

  • License: MIT
  • Source: https://github.com/facebook/react

react-dom 18.3.1

  • License: MIT
  • Source: https://github.com/facebook/react

sonner 2.0.7

  • License: MIT
  • Source: https://github.com/emilkowalski/sonner

Plus 284 transitive dependencies. License rollup across all 296 npm packages installed in production:

  • MIT: 236
  • ISC: 14
  • Apache-2.0: 13
  • BSD-3-Clause: 12
  • Custom: https://demo.reown.com: 9
  • UNKNOWN: 4
  • BSD: 3
  • Custom: https://share.hsforms.com/1: 1
  • Custom: https://docs.walletconnect.com/: 1
  • Custom: https://walletconnect.com/: 1
  • BlueOak-1.0.0: 1
  • BSD-2-Clause: 1

2.2A Components With Non-Standard Licence Terms — READ THIS SECTION

The automated licence scan reports a bare string from package metadata. For four components that string is wrong or meaningless, and the real terms carry obligations. Resolved by reading the actual licence files, 2026-08-07.

Reown AppKit (@reown/appkit, @reown/appkit-adapter-ethers, and related packages)

The scan reports Custom: https://demo.reown.com — a demo URL, not a licence. The actual licence is the REOWN COMMUNITY LICENSE AGREEMENT (release date 25 August 2025), shipped as LICENSE.md in each package. It is a bespoke commercial licence, not an open-source one, and it imposes real conditions:

Required attribution (§2(a)) — reproduced here to satisfy it:

Portions © 2025 Reown, Inc. All Rights Reserved

§2(a) further requires that a copy of the Reown licence be provided with any product that uses the AppKit Items; the full text ships in node_modules/@reown/appkit/LICENSE.md and is reproduced in Section 6 of this document.

Conditions that constrain the Business, not just this document:

  • §3 Limited Commercial Use — a hard ceiling. Above 500 monthly active users (defined

as unique externally-owned accounts or embedded wallets that authenticate and connect in a 30-day period) or 2,500,000 monthly RPC calls, a paid commercial licence is required. Only wallet-connecting users count, not total subscribers — but this is an operational threshold that will arrive with growth, and it should be monitored rather than discovered.

  • §2(b) Network condition. All use must connect to Reown's own gateway infrastructure and

the WalletConnect protocol; circumventing it, or telling users to, breaches the licence.

  • §1(c) Modifications assign to Reown. Any modification or derivative work *of the AppKit

Items* belongs to Reown, licensed back to us for use with the AppKit Items only. §1(c)(ii) is the saving grace: our own application is expressly not a derivative work, so ordinary integration is unaffected. Do not patch AppKit in place — wrap it.

  • §2(d) Marks. No use of Reown marks implying endorsement.

vectorbt — Apache 2.0 with Commons Clause

The scan reports UNKNOWN. The actual licence is Apache 2.0 plus the Commons Clause License Condition v1.0, which withholds the right to "Sell" the software — defined as providing a product or service to third parties for a fee "whose value derives, entirely or substantially, from the functionality of the Software."

Required notice, reproduced to satisfy the Commons Clause's own attribution requirement:

"Commons Clause" License Condition v1.0 — the grant of rights under the License will not include, and the License does not grant, the right to Sell the Software. Software: vectorbt. License: Apache 2.0 with Commons Clause. Licensor: Oleg Polakow.

Why this is currently acceptable, and the line not to cross. vectorbt is research-side only. backend/backtest/dca_engine.py is the production reference engine that mirrors live bot mechanics; vectorbt_harness.py and compare_engines.py exist to cross-validate it and to run fast parameter sweeps. Nothing in the API or the scheduler imports either module — verified 2026-08-07. So no product or service we sell derives its value from vectorbt.

⚠️ That is a fact about today's import graph, not a property of the licence. If vectorbt ever moves into a path that serves customers — powering the user-facing backtester, for instance — the Commons Clause analysis changes and needs counsel before it ships.

pandas-ta and TA-Lib — resolved

Both scan as UNKNOWN; both are in fact permissive. pandas-ta 0.4.71b0 is MIT (Copyright © 2019+ Kevin Johnson). TA-Lib 0.6.8 (the Python wrapper) is BSD 2-Clause. Attribution obligations only, satisfied by this document.

2.3 Flagged Licenses

The following components carry licenses that require review under §4 (GPL / LGPL / AGPL / MPL family). Flagged for attorney review before public launch:

  • (Python) frozendict 2.4.7 — LGPL — https://github.com/Marco-Sulla/python-frozendict
  • (Python) py-vapid 1.9.4 — MPL-2.0 — https://github.com/mozilla-services/vapid
  • (Python) pywebpush 2.3.0 — MPL-2.0 — https://github.com/web-push-libs/pywebpush

3. Common License Quick Reference

The table below summarizes the obligations imposed by the most common open source licenses. This is a quick reference only — the actual license text controls.

LicenseCommon ExamplesWhat You Must DoRisk Level
MITReact, lodash, axiosInclude copyright + license textLow
Apache 2.0Kubernetes, TensorFlowInclude license + NOTICE file + state changesLow
BSD (2 or 3-clause)Many Python libs, FreeBSDInclude copyright + license textLow
ISCMany npm packagesInclude copyright + license textLow
LGPL 2.1 / 3.0Some C librariesAllow user to relink. Dynamic linking only.Medium
MPL 2.0Firefox, some Rust cratesModified MPL files must remain MPLMedium
GPL 2.0 / 3.0Linux kernel, MySQL, many CLI toolsDerivative works must be GPL. Source release required.HIGH — review before use
AGPL 3.0MongoDB (older), some SaaSSaaS use triggers source release obligationHIGHEST — likely incompatible with proprietary SaaS

4. Licenses to Watch Out For

Two license families create meaningful risk for a proprietary SaaS product like Clock Out Capital:

4.1 GPL (GNU General Public License)

If GPL-licensed code is incorporated into Clock Bots and Clock Bots is distributed (e.g., as a downloadable Tauri desktop app or a Python script users install), the GPL may require that the entire Clock Bots codebase be released under GPL — including any proprietary code combined with the GPL component. This is called the "copyleft" effect. The interpretation of when GPL is "triggered" by linking, dynamic linking, or other forms of combination is contested and fact-specific.

4.2 AGPL (GNU Affero General Public License)

AGPL goes further than GPL by treating SaaS use (where users interact with the software over a network without ever downloading it) as a triggering event. If AGPL-licensed code is incorporated into the Services, the entire Services codebase may be required to be released under AGPL. Most companies treat AGPL components as effectively incompatible with proprietary SaaS unless used in strict isolation.

5. Recommended Maintenance Workflow

The following workflow keeps this document accurate without requiring manual updates every time you add a dependency:

  • Step 1 — Audit. Run an automated license scan against your production codebases (web app, desktop app, backend, bots). Recommended tools:

npm: npx license-checker --production --json > licenses.json

python: pip install pip-licenses && pip-licenses --format=json > licenses.json

rust: cargo install cargo-license && cargo license --json > licenses.json

  • Step 2 — Flag risk. Identify any components with GPL, LGPL, AGPL, MPL, or unfamiliar licenses. Have your attorney review each before continuing.
  • Step 3 — Generate notices. Use a notice generator to produce a Markdown or HTML version of this document. Examples: license-checker --customPath template.json, npm package generate-license-file, or commercial tools like FOSSA.
  • Step 4 — Publish. Publish at clockoutcapital.com/legal/open-source. Link from your TOS, Privacy Policy, and website footer.
  • Step 5 — Refresh. Re-run the audit before any major release and at least quarterly. Update this document with any additions or removals.

6. License Texts

The following sections reproduce the full text of the most common open source licenses used by components listed in Section 2. Where a component is licensed under one of these licenses, the corresponding text below is incorporated by reference into that component's entry.

6.1 MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy

of this software and associated documentation files (the "Software"), to deal

in the Software without restriction, including without limitation the rights

to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

copies of the Software, and to permit persons to whom the Software is

furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

SOFTWARE.

6.2 Apache License, Version 2.0

Full text available at: https://www.apache.org/licenses/LICENSE-2.0.txt

HOW TO FILL THIS IN: Reproduce full Apache 2.0 license text here before publishing. The full text is too long to include in this template (about 11 KB). Link is provided in the meantime, but the published version of this document should contain the full text in line with Apache 2.0 Section 4(d).

6.3 BSD 3-Clause License

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice,

this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,

this list of conditions and the following disclaimer in the documentation

and/or other materials provided with the distribution.

3. Neither the name of the copyright holder nor the names of its contributors

may be used to endorse or promote products derived from this software

without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"

AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

ARE DISCLAIMED. [...continues, reproduce full text before publishing]

6.4 ISC License

Permission to use, copy, modify, and/or distribute this software for any

purpose with or without fee is hereby granted, provided that the above

copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

MERCHANTABILITY AND FITNESS. [...continues, reproduce full text before publishing]

7. Contact

Questions about this document or the open source components used in the Services may be sent to:

Clock Out Capital LLC

Duluth, MN 55807

Email: [email protected]