Section 01
Summary by licence
Everything this website depends on is permissively licensed. The counts below are computed from the records on this page, not written by hand, so they cannot drift away from the tables that follow.
| Licence | Components listed here | Obligation this project meets |
|---|---|---|
| MIT | 9 | Copyright notice and licence text retained (this page and the installed package headers). |
| Apache-2.0 | 3 | Attribution retained; no NOTICE file is supplied by these packages that would need reproducing. |
| BSD-3-Clause | 2 | Copyright notice retained; neither the author's nor the project's name is used to endorse this site. |
| SIL Open Font License 1.1 | 2 | Licence text ships beside each font, including inside the Android build. |
The installed tree also contains notice-bearing licences beyond the four above. They are recorded rather than glossed over, because “permissive everywhere” would not be true:
| Package | Licence | Why it is present |
|---|---|---|
| lightningcss (+ platform builds) | MPL-2.0 | CSS transform used by Tailwind CSS at build time. Unmodified; its source is published by its project. |
| axe-core, @axe-core/playwright | MPL-2.0 | Accessibility assertions in the browser test suite. Development only; never shipped. |
| @img/sharp-libvips | LGPL-3.0-or-later | The native image library behind the framework's image pipeline. Used as an unmodified, dynamically loaded dependency; its source is published by its project. |
| caniuse-lite | CC-BY-4.0 | Browser-support data used by the CSS toolchain at build time. |
| minimatch | BlueOak-1.0.0 | Glob matching inside the lint toolchain. Development only. |
There is no AGPL, SSPL or Commons-Clause package in the tree. This project modifies none of the packages above, and none of them is offered to a visitor in a form that would require this project's own source to be published. If that ever changed, it would be recorded here before the dependency shipped.
Section 02
Software, with versions and licences
Versions are the ones pinned in this deployment's lockfile. Licence identifiers are the SPDX values recorded in each package's own metadata.
| Component | Version | Licence | Attribution / project |
|---|---|---|---|
| Next.js Application framework: routing, server rendering, image and font pipeline, build. | 16.4.3 | MIT | nextjs.org |
| React User interface runtime for every screen. | 19.2.6 | MIT | react.dev |
| React DOM Browser renderer for React. | 19.2.6 | MIT | react.dev |
| hls.js HTTP Live Streaming playback where the browser has no native HLS support. Loaded only when a title with an HLS source is played. | 1.7.3 | Apache-2.0 | github.com/video-dev/hls.js |
| dash.js MPEG-DASH playback. Loaded only when a title with a DASH manifest is played. | 5.2.1 | BSD-3-Clause | github.com/Dash-Industry-Forum/dash.js |
| jose Server-side verification of the studio's signed session tokens. | 6.2.12 | MIT | github.com/panva/jose |
| drizzle-orm Typed SQL access for the catalogue database (server only). | 0.45.2 | Apache-2.0 | orm.drizzle.team |
| drizzle-kit Database schema migration tooling (development only; not shipped). | 0.31.11 | MIT | orm.drizzle.team |
| node-postgres (pg) PostgreSQL client used by the server (not shipped to the browser). | 8.20.0 | MIT | node-postgres.com |
| bcryptjs Password hashing for studio administrator credentials (server only). | 3.0.3 | BSD-3-Clause | github.com/dcodeIO/bcrypt.js |
| uuid Identifier generation for the anonymous watchlist session. | 14.0.3 | MIT | github.com/uuidjs/uuid |
| Tailwind CSS Utility layer compiled into the site stylesheet at build time. | 4.1.17 | MIT | tailwindcss.com |
| TypeScript Type checking at build time (development only; not shipped). | 5.9.3 | Apache-2.0 | www.typescriptlang.org |
| ESLint Static analysis at build time (development only; not shipped). | 9.39.5 | MIT | eslint.org |
| PostgreSQL The database server this deployment connects to. Provided as a service; no PostgreSQL code is redistributed by this website. | — | PostgreSQL License (permissive, BSD-style) | www.postgresql.org/about/licence/ |
The full transitive dependency tree, including development-only packages, is reproducible from the repository with npm run licenses. That report is the authoritative list; this table names what the website itself relies on directly.
Section 03
Typefaces
| Family | Authors | Licence | Licence text shipped at |
|---|---|---|---|
| Outfit | The Outfit Project Authors | SIL Open Font License 1.1 | src/app/fonts/OUTFIT-LICENSE.txt |
| Manrope | The Manrope Project Authors | SIL Open Font License 1.1 | src/app/fonts/MANROPE-LICENSE.txt |
Both families are self-hosted as woff2 files and served from this deployment. No font is requested from a third-party font service, so no visitor request is made to one.
Section 04
Brand artwork sources
Each platform mark was obtained from a public brand-artwork library, checked against that source by comparing path geometry (for vectors) or a file hash (for raster art), and stored locally — no logo is hot-linked at runtime. The marks themselves remain the property of their owners; the library is only how the file was obtained.
| Mark | Owner | Source and preparation |
|---|---|---|
| Netflix | Netflix, Inc. | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| Prime Video | Amazon.com, Inc. (Amazon Prime Video / Amazon MGM Studios) | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| JioHotstar | JioStar, a joint venture of Reliance Industries Limited and The Walt Disney Company | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| Disney+ | The Walt Disney Company (Disney Entertainment) | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| Max | Warner Bros. Discovery, Inc. (Home Box Office, Inc.) | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| Apple TV+ | Apple Inc. | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| SonyLIV | Sony Pictures Networks India (Culver Max Entertainment Private Limited), a Sony Pictures Entertainment group company | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| JioCinema | Viacom18 Media Private Limited (JioStar) | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| Crunchyroll | Crunchyroll, LLC (Sony Pictures Entertainment) | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| Tubi | Tubi, Inc. (Fox Corporation) | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| ZEE5 | Zee Entertainment Enterprises Limited | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| Hulu | Hulu, LLC (The Walt Disney Company) | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| Paramount+ | Paramount Global, part of Paramount Skydance Corporation | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| Peacock | Peacock TV LLC (NBCUniversal Media, LLC, a Comcast Corporation company) | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| MUBI | MUBI, Inc. | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| Discovery+ | Warner Bros. Discovery, Inc. | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| YouTube | Google LLC / YouTube, LLC (Alphabet Inc.) | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| aha | Arha Media & Broadcasting Private Limited | See public/platforms and docs/platform-assets.md for the exact upstream path, variant and preparation of this file. |
| CINEMAX | Home Box Office, Inc. (Warner Bros. Discovery, Inc.) | tv-logo/tv-logos (countries/united-states/cinemax-us.png), resized and encoded as WebP with its alpha channel intact. |
- Every file in public/platforms/ is recorded with its upstream repository, path and preparation in docs/platform-assets.md.
- A build check (npm run verify:logos) pins each file's geometry and colour tokens, so a substituted or recoloured export fails the build rather than shipping quietly.
- No mark was redrawn, traced or recreated, and none was generated synthetically.
Section 05
Catalogue artwork
- Poster and backdrop artwork for catalogue titles is supplied by the studio that adds the title, or referenced from an image host that the studio is licensed to use. cinemaxxx does not claim ownership of that artwork.
- Where a title uses artwork hosted by The Movie Database (image.tmdb.org), it is displayed at a reduced size through TMDB's public image service and remains the property of the film's rights holders, as listed by TMDB. TMDB's own terms apply to that service; this website is not endorsed or certified by TMDB.
- Artwork is requested lazily, at a size appropriate for the container, and is never modified, recoloured, cropped into a different aspect ratio, or overlayed with a filter. The one exception is the small number of brand logos documented above, which are scaled only.
- The platform marks in public/platforms are the platforms' own artwork, sourced from the third-party brand libraries recorded on /attributions. They are not redrawn, recoloured or substituted with text.
- The cinemaxxx logo and app icon are the project's own artwork, supplied by the project owner, and are used under this project's own copyright.
- The Android application icon and splash artwork are generated from that same logo.
Section 06
Media libraries loaded on demand
Two substantial libraries are never part of the first page load. They are split into their own chunks and fetched only when a title that needs them is actually played, so a visitor who never plays an HLS or DASH title never downloads either:
- hls.js 1.7.3 — Apache-2.0 — for HTTP Live Streaming on browsers without native support.
- dash.js 5.2.1 — BSD-3-Clause — for MPEG-DASH manifests.
Both libraries are unmodified and are used through their documented public APIs. Their copyright notices remain in the distributed chunks.
Section 07
Services and infrastructure
This deployment is hosted on a third-party platform and stores its catalogue in a PostgreSQL database provided as a service. Those providers process requests on this project's behalf under their own terms; no software is redistributed from them. Which third-party hosts a visitor's browser may contact is listed on Privacy & Content Usage.
The Android application is a shell around the same deployment. It adds no other third-party library: sharing is performed by the operating system's own share sheet, not by an SDK.
Section 08
How these lists are checked
npm run verify:logos— proves every platform id resolves to a pinned, valid, locally stored asset, and that the artwork matches the recorded original.npm run verify:platforms— proves the registry that drives the rail, the studio picker and the platform filters behaves correctly.npm run licenses— recomputes the dependency licence report from the installed tree, so this page can be re-checked rather than trusted.- The legal routes are website-only: no Android source, asset or bridge call references them, and a test asserts that.