licensing.mdx

Overlay uses a split license model:

Surface	License	Reason
Main web app, server code, Convex/backend functions, workers, and hosted product logic	AGPL-3.0-or-later	Keeps the cloneable hosted product reciprocal, including modified network-hosted versions.
First-party desktop, mobile, and Chrome apps	AGPL-3.0-or-later	These are part of the cloneable product surface.
API client packages	Apache-2.0	Customers and integrators should be able to call Overlay without pulling AGPL obligations into their own apps.
Contracts, protocol/types packages, and tool SDKs	Apache-2.0	These are ecosystem glue and extension surfaces.
Extension SDK	Apache-2.0	Enterprise and community extensions should be able to register against Overlay without pulling AGPL obligations into separate extension code.
Shared UI and React package surfaces	Apache-2.0	These should be easy to consume in integrations and extension work.
Overlay name, logo, domains, and brand assets	Trademark policy	Licenses cover copyright permissions; brand use is separate.

The root repository files LICENSE.md, TRADEMARKS.md, and NOTICE.md remain the authoritative bundled legal files for source distributions.

Core Product License

The core product is licensed as AGPL-3.0-or-later unless a more specific package manifest or written agreement says otherwise.

Core product surfaces include:

• src/
• convex/
• workers/
• overlay-desktop/
• overlay-mobile/
• overlay-chrome/, except explicitly Apache-licensed contract packages under overlay-chrome/packages/

For the official license terms, see the GNU AGPLv3 text and the SPDX identifier AGPL-3.0-or-later.

Apache Ecosystem Packages

Workspace packages under packages/* are licensed as Apache-2.0. The Chrome extension contracts package at overlay-chrome/packages/overlay-extension-contracts is also Apache-licensed.

For the official license terms, see the Apache License 2.0 text and the SPDX identifier Apache-2.0.

Commercial License

Enterprises that want to build proprietary products on top of the AGPL core, avoid AGPL reciprocity obligations, buy support, or use managed private deployment terms should use a separate commercial license from LayerNorm Inc.

Commercial licensing contact: divyansh@layernorm.co

Self-Hosting Notes

Self-hosting is allowed under the applicable license for the surface you use. Keep copyright, license, and notice files with the distribution. Modified deployments should be prepared to meet the source-availability obligations that apply to AGPL-covered code.

Modified distributions must not use Overlay branding as their own product branding. Use a distinct name and visual identity unless LayerNorm Inc. gives written trademark permission.

This document is implementation guidance for the repo, not legal advice. Confirm public release and enterprise distribution terms with counsel before launch.

Verification

Run:

npm run license:check

The check verifies first-party license metadata, required legal docs, and runtime dependency license declarations in package-lock.json. Risky dependency licenses must be documented in scripts/license-allowlist.json with a reason.