1. Choro
Source and documentation authored for Choro are available under the Apache License 2.0, unless a file or directory states different terms. Source distributions include the root LICENSE, NOTICE, and THIRD_PARTY_NOTICES.md. Packaged desktop releases include a version-specific third-party licence inventory.
Third-party packages, fonts, icons, provider SDKs, and brand assets are not relicensed merely because Choro uses or distributes them. Their own notices and terms continue to apply.
2. Choro Design and Penpot
Choro Design is based on Penpot 2.16.2, an open-source project of Kaleidos. Penpot source is licensed under the Mozilla Public License 2.0. The unmodified upstream source for that release is available from the Penpot 2.16.2 repository tag.
Choro’s changes to files covered by the MPL, and new Penpot integration files marked MPL-2.0, remain available under MPL-2.0. The MPL is file-level copyleft: it applies to those covered files and does not relicense separate Choro files under the MPL.
3. Obtain the corresponding source
To obtain, at no charge, the source corresponding to the Penpot frontend delivered by the current Choro Design release—including Choro’s modifications to MPL-covered files—email legal@choro.dev with the subject “Choro Design MPL source request” and identify the Choro release you use, if known.
The source is provided in the preferred form for making modifications, with the applicable MPL notices and the upstream baseline identified. This source-availability notice remains effective for as long as Choro makes the corresponding executable form available.
4. Names and trademarks
Penpot and related names or marks belong to their respective owner. Choro’s use identifies the open-source software on which Choro Design is based and does not imply that Kaleidos operates, sponsors, certifies, or endorses Choro or the Choro Design service.
5. Contact
For source-availability or licence questions, contact legal@choro.dev. Security reports belong at security@choro.dev, not in a public issue.