Licences and credits
Version 1.0, last updated 2026-10-05.
Nimbus itself is MIT licensed. Everything it uses that somebody else made is listed here with its licence, so that shipping a build, forking the repository or using a screenshot never depends on guessing whether an asset was cleared. Nothing in this project uses an asset without a licence that permits it.
Nimbus
Copyright held by the developer of Nimbus,
released under the MIT licence. The full text is in LICENSE at
the root of the repository. In short: do what you like with it, keep the
copyright notice, and expect no warranty.
Typefaces
| Typeface | By | Licence | Used for |
|---|---|---|---|
| Geist | Vercel | SIL Open Font License 1.1 | All interface and display text, in the app and on the site |
| Geist Mono | Vercel | SIL Open Font License 1.1 | Numbers, checksums, file paths, and anything that has to line up |
The OFL permits use, embedding, modification and redistribution, including in a commercial product, provided the fonts are not sold on their own and any modified version is not released under the reserved font name. Nimbus does neither, and currently links them from Google Fonts rather than redistributing the files.
If a platform font is used instead, because you declined third-party content or the request failed, that is your own operating system's font and no licence question arises.
Icons
| Set | By | Version | Licence |
|---|---|---|---|
| Phosphor Icons | Phosphor Icons | 2.1.x | MIT |
Every icon in the app and on the site is decorative and carries
aria-hidden, so a screen reader never announces one and the
page reads correctly if the font does not load.
Photographs
The two sky photographs in the hero are public domain. No attribution is legally required for either, and both are credited anyway, with their sources and the exact crops and encodings used, in website/assets/CREDITS.md.
| File | Photographer | Licence |
|---|---|---|
sky-day.* | Trixia Lao, via Wikimedia Commons | CC0, public domain |
sky-night.* | W.carter, via Wikimedia Commons | CC0, public domain |
There are no stock photographs of people anywhere in this project, no AI-generated imagery presented as a photograph, and no screenshot of another company's product.
Software
| Package | Version | Licence | Where |
|---|---|---|---|
| Electron | 33.2.x | MIT | Desktop app runtime |
| electron-builder | 25.1.x | MIT | Build tooling, not shipped |
| @phosphor-icons/web | 2.1.x | MIT | Icon font, bundled into the app |
| Express | 4.x | MIT | Sync server |
| cors | 2.8.x | MIT | Sync server |
| jsonwebtoken | 9.x | MIT | Sync server, session tokens |
| stripe | 23.x | MIT | Sync server, subscription billing |
| pdfjs-dist | 6.4.x | Apache 2.0 | Sync server, reading text out of an uploaded PDF |
| sql.js | 1.14.x | MIT | Desktop app, reading the SQLite database inside an Anki .apkg |
| fflate | 0.8.x | MIT | Desktop app, unzipping an Anki .apkg |
| fzstd | 0.1.x | MIT | Desktop app, decompressing Anki's newest collection format |
The three Anki libraries run in the desktop app's main
process, not in the interface, and they are only loaded when you
import a file. That placement is deliberate: the interface runs under a
content security policy of default-src 'none' with no
WebAssembly permitted, and reading a SQLite database needs WebAssembly.
Keeping it outside the interface means an imported deck still cannot
execute anything. None of the three makes a network request, and an Anki
import sends nothing anywhere: the file is read on your own machine.
There is no frontend framework, no bundler and no CSS framework in either product, so the dependency surface above is the whole of it. The scheduler, the cram planner, the importers, the charts and the design system are all first-party code in this repository.
The Stripe SDK runs on the server only. No Stripe code, and no third-party payment script of any kind, is loaded by the website or the desktop app: checkout is a redirect to a page Stripe hosts. See cookies and storage.
pdfjs-dist is Mozilla's PDF parser, the same one built into Firefox. It
runs on the server only, and only when you upload a file to generate cards
from. PowerPoint files need no library at all: a .pptx is a
zip of XML, and the server reads it with the zip and XML handling already
in Node. There is no AI or machine-learning package in either product; the
model is reached over an ordinary HTTPS request, with no SDK.
Research
The scheduling and cram behaviour cites published findings rather than
inventing them. Each rule names its paper in the header comment of
app/renderer/js/cram.js, and the website's forgetting curve is
computed from the same SM-2 implementation the app ships, not drawn to
look convincing. Citing a paper is not a claim of endorsement by its
authors.
Nimbus · hello@getnimbus.org · Back to the site