Pro licensing

Effective 2026-05-01 Plain-language summary Authoritative document: PRO_LICENSING.md

This page is a plain-language summary of the GemmaKit Pro licensing model. It is not the contract. Where this page and the master licensing document disagree, the master document wins.

Scope of this licence

The Pro licence covers the GemmaKit runtime, the Swift client, and the local server. It does not licence the Gemma model itself; you remain responsible for complying with the model's own terms.

The licence does not grant unlimited offline entitlement, hosted inference rights, or any rights to features explicitly outside the runtime boundary (Responses API parity, tool calling, images, audio, embeddings, hosted retrieval, stored completions).

Pro organisation keys

Each Pro organisation receives one or more org keys. Org keys mint signed local licence certificates for individual builds of your app. Keep org keys server-side; do not embed them in shipped binaries.

Optional app-id binding

An org key may optionally be bound to one or more app ids. When bound, the runtime will refuse to serve completions to a host process whose app id does not match.

App-id binding is optional and configurable per certificate.
macOS and iOS app ids should normally use the bundle identifier.
Separate keys and environment metadata keep staging and production auditable.

Signed local licence certificates

A licence certificate is a small signed document stored on the customer device. It carries the org id, key id, subscription id, app id, device id, period dates, expiry, offline grace, plan, and an Ed25519 signature.

Locality. The certificate is verified on-device. Activation, refresh, and gated generation events update the licence ledger, but prompt and completion content is never sent with those calls.

Active-device billing

A device is active in a billing period if it successfully activates, refreshes its licence, or calls a licence-gated generation endpoint during that period. Inactive installs are not billed, even if the runtime is present.

Counts are unique per org_id, device_id, and subscription period, so repeated requests do not become per-request or per-token billing.

What the licence service receives

The licence service receives only what is necessary to bill active devices and verify entitlement.

Organisation key public id and proof of secret during activation.
Organisation id, app id, app version, platform, and GemmaKit version.
Generated device id and optional customer-supplied device display name.
Licence certificate id, key id, subscription id, billing state, and relevant timestamps.
Network metadata normally received by a web service, such as IP address and request headers.

What it never receives. Prompts, completions, system or developer messages, local documents, model paths, model artefacts, embeddings, screen captures, audio recordings, and local API bearer tokens are not sent to the licence service.

Offline grace window

The runtime tolerates short network interruptions. If the device cannot reach the licence service for the configured grace window, licensed endpoints continue to serve. After the grace window, licence-gated endpoints return HTTP 402 with code licence_inactive until the device can refresh entitlement.

Trademarks & attribution

Gemma is a trademark of Google. OpenAI is a trademark of OpenAI, OPC. GemmaKit is independent of, not affiliated with, endorsed by, or sponsored by Google or OpenAI. Marks are used only to describe technical compatibility with public interfaces.

— Questions: legal@gemmakit.app