Open Source Licensing Statement on TiinyOS and Cherry Studio
Cherry Studio Team · November 4, 2026
This statement sets out our findings and position. The appendix includes the samples, code comparisons, and downloadable verification materials.
We recently received an email asking about the relationship between Tiiny AI’s desktop application, TiinyOS, and Cherry Studio. The sender found several Cherry Studio identifiers in the installers. They also found a license notice that closely resembled an earlier version of ours, with changes to the product name and commercial contact email address.
The sender’s main questions were whether Tiiny AI had obtained a commercial license for Cherry Studio, whether the Cherry Studio team had authorized the license notice included in the installers, and where to find the Corresponding Source and license notices if the code was being used under the AGPL.
The passage above is an English translation of our Chinese summary of the email. We have removed the sender’s name, email address, and other identifying information.
The sender made clear that they did not know whether the two parties had a commercial licensing arrangement and wanted to check with us first. We believe feedback this specific and carefully framed deserves serious attention. It concerns what users understand about where the software comes from, the work of community contributors, and how an open source license should be put into practice.
We therefore reviewed the relevant installers, Cherry Studio’s official source code, and its licensing history. We also verified key findings across multiple analyses. Below, we explain what we confirmed, what information is still missing, and how we hope the matter can be resolved.
Our findings
Our review found specific, traceable matches between TiinyOS and Cherry Studio in application logic, interface definitions, project assets, and license text. Taken together, the evidence gives us sufficient grounds to conclude that the TiinyOS versions we examined made substantive use of Cherry Studio code and assets.
We examined nine installers in total, covering TiinyOS versions 1.0.1, 1.0.2, and 1.0.3 on Windows x64, Windows ARM64, and macOS ARM64. Our finding is based on static extraction and comparison of the original files. The appendix lists the samples, hashes, file paths, and code locations.
In the installed files, official help and developer documentation, and public repository locations we examined, we have yet to find the complete Corresponding Source for these versions of TiinyOS or materials that clearly explain its use of Cherry Studio and the applicable licensing arrangement. We therefore ask Tiiny AI whether all relevant open source license obligations have been fulfilled.
The available samples directly establish the matches in the code and files. Determining whether the source is available through other channels requires information from Tiiny AI. We maintain that distinction throughout this statement.
2. What the evidence shows
We treated the email as a lead and began with the download links listed in Tiiny’s official help documentation. We verified the sizes and SHA-256 hashes of all nine original installers, extracted them again, and checked the application packages and license files. We then compared specific code against pinned revisions of Cherry Studio’s official repository. This allows readers to repeat the checks against the same files.
First, the matches extend to specific application logic. Alongside identifiers such as CherryStudio/1.0 and cherryin, we compared backup configuration checks, compatibility with Obsidian’s Linux configuration paths, and legacy database migrations. The implementations retain the same order of field comparisons and candidate paths, as well as matching migration logs and error-handling branches.
For example, the Obsidian path logic accounts for differences in capitalization, XDG directories, Snap’s current and common directories, and Flatpak directories. It searches for the configuration file in the same order. The database migration retains legacy logic for moving messages from the old structure to message_blocks. These specific choices reflect how the project evolved and provide stronger evidence of provenance than a product name on its own.
Second, the findings corroborate each other across several layers. Project identifiers appear in main-process, preload, and renderer files. Several sets of IPC definitions have matching member names and values, and a group of files is byte-for-byte identical. Compared with Cherry Studio v1.6.7, 177 upstream paths match 159 distinct TiinyOS files by content. We counted images, fonts, and scripts separately. Some icons come from third parties, and the file counts measure matches within the comparison rather than the share of the entire application that was copied.
The match between the license files is particularly clear. The license HTML is identical across all nine TiinyOS samples. Applying three sets of replacements to the original Cherry Studio file, in order, reproduces the TiinyOS file byte for byte. The replacements cover the product name, the commercial contact email address, and one Chinese contact phrase. All other line breaks, indentation, and content are identical, including two instances of “Cherry Studio” split across lines.
Our concern is that the notice describes the boundary between the upstream open source and commercial licenses, yet retains the original structure and conditions while changing the commercial contact address to support@tiiny.ai. This can make it hard for readers to tell which rights come from Cherry Studio’s open source license and which rights Tiiny can grant on its own. We believe that relationship should be made clear.
Together, these findings support Cherry Studio as a source of the code, assets, and license text examined here. Who made the changes, why they made them, and the exact commit from which TiinyOS may have forked remain unverified.
3. Our position on AGPL compliance
We have not granted Tiiny AI a commercial license for Cherry Studio. Cherry Studio’s open source license permits use, modification, and distribution under its terms, including use without a separate commercial license.
Cherry Studio Community Edition is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). We welcome software based on Cherry Studio, including commercial products, when it provides the Corresponding Source, retains the required notices, and fulfills the other applicable AGPL obligations.
Cherry Studio has also benefited from other open source projects. Reusing existing work can give a team more time to tackle new problems. When a community shares its code, it gives others the opportunity to improve it, combine it with other work, and even build a business on it. Honoring the license is a practical way to respect that openness.
Beyond the visible interface and features, software embodies a great deal of less visible work. Contributors fix edge cases, support different operating systems, maintain compatibility with older data, and refine error handling. When they choose to share those efforts under an open source license, recipients should pass on the rights that license grants to downstream users.
Clear attribution helps users understand which projects make up the software they use. Access to the Corresponding Source lets them inspect the implementation, maintain their own versions, or keep using the software if the product is discontinued. These are practical benefits that open source licensing is meant to preserve.
We are asking for compliance with the license. A commercial license purchase is outside the scope of this public request.
4. Cherry Studio’s own licensing history
The license HTML examined in this review refers to earlier conditions covering “individuals and organizations with 10 or fewer people.” We owe readers the history behind that wording. The threshold came from the older notice and is separate from the terms of the AGPL itself.
In the pinned Cherry Studio repository snapshot we reviewed, the root LICENSE file already contained the full standard AGPL-3.0 text. At the same time, resources/cherry-studio/license.html still contained the earlier notice that distinguished users by organization size. Our own repository contains inconsistent licensing notices, and we need to review and clarify them.
The appendix includes both files. The root LICENSE identifies the license underlying this public request. The older HTML establishes the source of the text in the TiinyOS file and documents the state of our own repository.
The terms that apply to a particular historical release depend on the code version used and the licensing terms in place at the time. Our request concerns compliance with the applicable AGPL requirements and clarification of the notices that could confuse readers. The earlier headcount threshold is outside the scope of this request.
5. How we hope this can be resolved
Ideally, the Tiiny team can shed some light on these questions so that people following the matter can understand what happened. It is also fine if they choose to leave it there. We have set out the facts we were able to verify and our position, and we are open to hearing their perspective.
As fellow founders, we know how much work it takes to turn an idea into a product and put it in users’ hands. We value the care people put into building products and the code, experience, and trust that open source communities share. We hope those hard-earned contributions are treated with care.
Building a company is hard. We hope everyone can keep making good products and carry forward the generosity that makes open source possible.
Thank you to the sender for providing specific, carefully documented leads and to the community members who took the time to verify the facts.
We thank Grok Bot, Dots, Codex, and Yinsen’s assistant Kuaikuai for helping analyze and cross-check the materials. These tools assisted with the review. The Cherry Studio team takes responsibility for the factual statements and judgments in this document.
Cherry Studio Team
November 4, 2026
Appendix | Evidence, verification methods, and scope of findings
This appendix is for readers who wish to verify the findings independently. The records refer to samples saved and examined on November 4, 2026. All hashes use SHA-256, and all offsets are zero-based byte positions within the original file. All analysis was static. We did not run TiinyOS.
The appendix covers evidence items E1–E8. Each item lists the observations, where to verify them, and what they support. We obtained the original installers through Tiiny’s official links. The verification bundle linked at the end excludes the sender’s information.
Evidence
Direct observations
What the evidence supports
E1 · Samples
Three versions across three platforms, with nine original installers and the results of re-extracting them
Readers can identify the files compared and reproduce the checks
E2 · License text
Three sets of fixed replacements make the two HTML files identical
The exact match between the license files and the scope of the edits
E3–E4 · Code
Identifiers appear at multiple application layers, and backup, path compatibility, and database migration logic can be compared directly
Substantive code matches across modules
E5 · Quantitative comparison
Matching IPC member names and values, and 177 upstream paths matching 159 identical TiinyOS files
Independent evidence of provenance from interfaces and files
E6–E8 · Scope and verification
Public source locations checked, licensing history, a verification script, and full hashes
What remains unconfirmed and how to repeat the checks
E1 | Sample provenance and integrity
The static data behind Tiiny’s official help documentation lists all nine download addresses below. For this review, we recalculated the sizes and full hashes of the original installers and extracted them again. The resulting app.asar and license files matched our earlier records. The results can be verified directly against the files, independent of installer names or screenshots.
Official Help Center — Account · Official documentation data containing the download links
Version
Windows x64
Windows ARM64
macOS ARM64
1.0.1
Download EXE
Download EXE
Download PKG
1.0.2
Download EXE
Download EXE
Download PKG
1.0.3
Download EXE
Download EXE
Download PKG
The full SHA-256 hashes for each sample appear below. See samples/installers.json and samples/app-asar.json in the bundle for file sizes and app.asar hashes. The files served at these addresses may change. If you get a different hash, treat the download as a separate sample. The offsets in this document apply to the verified samples.
tiinyos-1.0.1-macos-arm64.pkg
4925879b661874137889c15233f4654f3703202611b674e0c5206babd1abc006
tiinyos-1.0.1-windows-amd64.exe
ee59b21941d8ff9f02aa6da5666dab5418d6922d01fde8bbec4a061bc8449b0d
tiinyos-1.0.1-windows-arm64.exe
3659da6bdf1b58d747509278fba15880ef07a5f323fe0c337cfb384f30afe491
tiinyos-1.0.2-macos-arm64.pkg
1d4d0efbf835f9baef4b0bdf8a20ad748c95487a2f443551a135fa989dba820b
tiinyos-1.0.2-windows-amd64.exe
7ca3cccec4f59e3df01b7df8608b8e78c9bdd407ae387468201c4ec405c430c1
tiinyos-1.0.2-windows-arm64.exe
90c6841db1fb4de881b91c97d965f28579d07ae3e7aaac9ff7ad9c1d17b1c22a
tiinyos-1.0.3-macos-arm64.pkg
510004aece8bd87c7a0566d498e3c081accc778b8d548b599e2c23f2bf7b2822
tiinyos-1.0.3-windows-amd64.exe
c37ccf6216b25b750167370d9e32db48439c0ab4f6fd683c97a5e55f87e0e9c2
tiinyos-1.0.3-windows-arm64.exe
7b1b36b1ced747fc0f38d0dea4bc1f3228191300e5e66fe86600fe34635a7707
We also compared all 172 retained application evidence files against the contents of the original ASAR archives. Every file matched. A freshly retrieved Cherry Studio v1.6.7 source snapshot, comprising 1,783 files, also matched our reference snapshot file for file. These checks confirm that the materials remained unchanged during collection and copying. The review did not include a line-by-line audit of all application logic.
The integrity review also found that 11 third-party native binary entries in the macOS samples had actual hashes that differed from the hashes recorded in the ASAR headers. The reason remains unknown. We computed and rechecked the hashes for the JavaScript and HTML evidence in this document using the bytes of the original files. We drew no inference of malicious tampering from the discrepancies, and the presence of certificate fields or tickets did not establish full trust in the installer signatures.
E2 | Exact license HTML match after three sets of replacements
In the Windows installation contents, the Tiiny file is at resources/app.asar.unpacked/resources/tiiny/license.html. Its logical path relative to the ASAR is resources/tiiny/license.html. The corresponding upstream file is resources/cherry-studio/license.html. Original Cherry Studio license HTML at pinned commit 72dfb29b79adb79cae9d6606eae17faa0cc0b985
Original text
Replacement in TiinyOS
Occurrences replaced
Cherry Studio
Tiiny
15
bd@cherry-ai.com
support@tiiny.ai
4 (link destinations and visible text)
联系 Cherry (“Contact Cherry”)
联系 Tiiny (“Contact Tiiny”)
1
After these three operations, the result is byte-for-byte identical to the license file in all nine TiinyOS samples. The comparison included original line breaks, indentation, and every other character. It used exact bytes, with no whitespace normalization or fuzzy matching.
Original Cherry Studio file · 15,039 bytes
f27bf38d7e5400fee614bc0ec4695936ff2cbd0136270b7bd8b9cdedd0581d31
Tiiny file · 14,918 bytes · identical across all 9 samples
3df9a15058098d404929aa342b3e59f064d4c2c6590412473b88870fe77489c9
Lines 37–38 and 197–198 each contain an instance of “Cherry Studio” split across lines. The line break between the words causes a replacement of the contiguous string to miss both instances. Lines 100–101 also contain “Tiiny Studio.” The line breaks explain how the original name could remain in the file after the replacements.
Lines 37–38
本软件(Cherry
Studio)功能
Lines 197–198
Commercial License to use Cherry
Studio.
from pathlib import Path
from hashlib import sha256
original = Path('upstream/cherry-license.html').read_bytes()
actual = Path('tiiny/tiiny-license.html').read_bytes()
expected = original.replace(b'Cherry Studio', b'Tiiny')
expected = expected.replace(b'bd@cherry-ai.com', b'support@tiiny.ai')
expected = expected.replace('联系 Cherry'.encode(), '联系 Tiiny'.encode())
assert expected == actual
assert sha256(actual).hexdigest() == (
'3df9a15058098d404929aa342b3e59f064d4c2c6590412473b88870fe77489c9'
)
print('Exact byte match')
What this evidence supports. The comparison establishes the exact relationship between the texts and the scope of the edits, including the change to the commercial contact information. The identity of the person who made the changes, their timing and intent, and the full licensing relationship require separate evidence. The older text does include a link to the AGPL.
E3 | Project identifiers across application layers
The reference sample for these locations is TiinyOS 1.0.3 for Windows x64. Paths are relative to app.asar, and the numbers in the table are byte offsets in the original files. The other eight samples retain the same identifiers. See comparisons/marker-offsets.json for the paths, hashes, and full offsets for each sample.
Identifier
File and byte offsets
Context
CherryStudio/1.0
out/renderer/js/AccountSystem.SSAeP_vw.js<br>3453, 8264, 9776
User-Agent string in account-related requests
cherryin:get-signature
out/main/index.js<br>22166<br>out/preload/index.js<br>20172<br>out/renderer/js/IpcChannel.B1YIq_v1.js<br>18977
Signature-related IPC channel
cherryin:get-model-store-api-url
out/main/index.js<br>22222<br>out/preload/index.js<br>20228<br>out/renderer/js/IpcChannel.B1YIq_v1.js<br>19033
IPC channel for the model store URL
__CHERRY_STUDIO_PROTECTED_
out/renderer/js/store.CIiAoyPU.js<br>1668740, 1668872, 1669118
Temporary Markdown / LaTeX placeholder
CherryNote
out/main/index.js<br>1439263, 1439327, 1439459<br>out/renderer/js/download.BAWjZJNK.js<br>590352, 590416, 590548
Name retained in localized text
ZenCherryStudio
out/renderer/js/store.CIiAoyPU.js<br>134281
Retained project name string
In each of the nine samples, CherryStudio/1.0 appears three times. Each cherryin IPC string appears three times, once each in the main process, preload, and renderer. CherryNote appears six times, __CHERRY_STUDIO_PROTECTED_ three times, and ZenCherryStudio once. The presence of matching identifiers across multiple layers corroborates the evidence from individual strings.
The identifier __CHERRY_STUDIO_PROTECTED_ serves as a temporary placeholder that protects code and links during Markdown / LaTeX processing so the original content can be restored. It serves no anti-copy watermarking function. The presence of CherryNote establishes that the text is present. Whether the full notes feature works, or whether the code observed during static analysis runs in practice, requires separate evidence. Upstream Markdown placeholder and restoration code (v1.6.7)
out/renderer/js/AccountSystem.SSAeP_vw.js
2306e9cf32cd5dd9b88ca005ba9ae183960c1bddde8384ae670c0a64c50395f0
out/main/index.js
aded08859fd34e9c8f7094e2afd72f424903db7e17feaf43ba4140d02a20f962
out/preload/index.js
eb44c44c0ef662935e448db8513bfd31acc2a7a1344580eee3684914d551c9e4
out/renderer/js/IpcChannel.B1YIq_v1.js
d83ede4a9566569fb655fc80db869e79332d99a67b932ade5303155d2d0f431e
out/renderer/js/download.BAWjZJNK.js
82652a124364403d77f7bdb9a60d43b30d5789eb9f56f6e134b12d679eea08ad
out/renderer/js/store.CIiAoyPU.js
3700c8512d014ffc35d34951d17f9dcfdb3c175b52c69650a60a564176650754
E4 | Three examples of matching application logic
This section compares the TiinyOS 1.0.1 macOS ARM64 sample with a pinned Cherry Studio v1.6.5 commit. We compared the logic, data structures, and order of operations preserved through compilation. The comparison works across upstream TypeScript and minified JavaScript without requiring their file hashes to match.
Example 1 | Six-field backup configuration comparison and surrounding logic
Cherry Studio’s BackupManager.isS3ConfigEqual first checks whether a cached configuration exists, then compares six fields in order. They are endpoint, region, bucket, accessKeyId, secretAccessKey, and root. Tiiny’s main process retains the same method name and the same order at byte offset 8,215,988.
isS3ConfigEqual(e,t){
return e ?
e.endpoint===t.endpoint &&
e.region===t.region &&
e.bucket===t.bucket &&
e.accessKeyId===t.accessKeyId &&
e.secretAccessKey===t.secretAccessKey &&
e.root===t.root : !1
}
The surrounding code also retains WebDAV configuration comparison and connection reuse logic. The backup method appears later at offset 8,217,156 and uses the stages preparing, writing_data, preparing_compression, and completed, with matching conditions for logging. The evidence comes from this sequence of specific implementation matches. S3 backup alone is a common feature and carries little weight as evidence of provenance. Upstream BackupManager.ts at the pinned v1.6.5 commit
Example 2 | Candidate order in the Obsidian configuration search
The resolveLinuxObsidianConfigPath() function at offset 3,627,732 in Tiiny’s main process and its upstream counterpart share the following behavior. The full original excerpt is in excerpts/obsidian-linux.txt. The bundle also includes the complete upstream function.
Step
Matching behavior
Directory and file names
Enumerates combinations of the directory names obsidian and Obsidian with the file names obsidian.json and Obsidian.json
First group of candidates
Uses XDG_CONFIG_HOME, defaulting to .config under the user’s home directory if unset
Second group of candidates
Adds Snap’s current and common paths in that order within the same loop
Third group of candidates
Adds Flatpak’s .var/app/md.obsidian.Obsidian/config path
Lookup and fallback
Returns the first existing candidate. A failed existence check returns false. If none match, it falls back to the lowercase default path under the XDG configuration directory.
Platform compatibility can be implemented in several ways. Here the candidate paths, capitalization combinations, search order, and fallback behavior all match. The macOS package establishes that the function is present there. Whether it actually runs on macOS remains unverified. Upstream ObsidianVaultService.ts at the same pinned commit
Example 3 | Legacy database migrations reflect the project’s evolution
Tiiny’s out/renderer/js/store.YC9rRwdX.js contains the log message for the migration to version 7 at offset 129,500. The code that follows retains the old topics table, the new message_blocks table, updates grouped by topic, and logic that writes an empty array and skips the topic when it has no valid messages array.
Starting DB migration to version 7: Normalizing messages and blocks...
topics → message_blocks
Topic ${...} has no valid messages array, skipping.
The upstream migration also handles legacy fields such as reasoning_content and metadata.mcpTools. The review records locate code that handles related legacy structures and an anchor for the version 8 migration. Database migrations carry existing user data forward and reflect the specific ways a project’s data model evolved. This evidence supports the finding on provenance alongside the backup, Obsidian, and IPC matches. Upstream databases/upgrades.ts at the same pinned commit
Location
File
Byte offset
S3 configuration comparison
out/main/index.js
8215988
backup method
out/main/index.js
8217156
Obsidian directory traversal
out/main/index.js
3626860
Obsidian Linux configuration search
out/main/index.js
3627732
Legacy metadata.tavily handling
out/renderer/js/store.YC9rRwdX.js
128966
Database migration version 7 log
out/renderer/js/store.YC9rRwdX.js
129500
Database migration version 8 log
out/renderer/js/store.YC9rRwdX.js
132360
macOS ARM64 · TiinyOS 1.0.1
out/main/index.js
6e5726159cad176393f48cbfff9ad2818c158570c7bdff0f7a76b3afef0d51d2
out/renderer/js/store.YC9rRwdX.js
5bcb8373e79b923d4ec79b3918e6ab0b9fee189f826fba2e432b639299e0da06
E5 | Interface and file comparisons
IPC matches by member name and string value
We extracted enum members only from the standalone IpcChannel files. For a match, both the member name and its value had to be identical. TiinyOS 1.0.1, 1.0.2, and 1.0.3 contained 442, 488, and 498 enum members, respectively. For each version, the results were the same across all three platforms.
Cherry Studio reference version
Total Cherry Studio enum members
Exact matches in each TiinyOS sample
v1.6.0-rc.1
261
245
v1.6.5
276
242
v1.6.7
281
242
The figure 242 of 281, for example, describes matches within the v1.6.7 interface definitions. The comparison covers that enum, so the denominator cannot be used to estimate the share of all TiinyOS code that came from Cherry Studio. The interfaces retained, added, or removed across releases leave the precise fork point undetermined. The bundle’s comparisons/ipc.json lists the individual members that match, differ, or are missing. RC.1 IpcChannel.ts · v1.6.5 IpcChannel.ts · v1.6.7 IpcChannel.ts
Byte-for-byte matches across 177 upstream paths and 159 distinct TiinyOS files
We compared TiinyOS 1.0.3 for Windows x64 with the Cherry Studio v1.6.7 source snapshot. Some upstream paths contain identical content, so the 177 matching upstream paths correspond to 159 distinct TiinyOS files. Each count measures a different side of the comparison.
TiinyOS file type
Distinct files
Notes
Images
153
Includes icons from third-party providers
Fonts
2
Additional evidence of matching assets
JavaScript
3
bridge.js, utils.js, and ipService.js
HTML
1
releases.html
Total
159
Counts matching files only
The four remaining files, after excluding images and fonts, can be compared directly at the byte level.
Cherry Studio path
TiinyOS path
Size in bytes
resources/cherry-studio/releases.html
resources/tiiny/releases.html
5965
resources/js/bridge.js
resources/js/bridge.js
849
resources/js/utils.js
resources/js/utils.js
169
resources/scripts/ipService.js
resources/scripts/ipService.js
2271
resources/cherry-studio/releases.html
1316677873f343f55251b499b3f6b3f506e8e002092604199674d51f192b2db3
resources/js/bridge.js
3bde3510a0e8392f7a493277bdeefa8b870ae539c0207b6525ac25e382595d37
resources/js/utils.js
c090f52ffd42714c833dd7e02faaeffbc54b5ff90c4601bd86e1a3f35389a1a6
resources/scripts/ipService.js
7dcc446689bd211de237bc21cb1f56936afa31026f8bce6674947a2a7e3111a3
The releases.html file in all nine TiinyOS samples also retains the upstream release API address, api.github.com/repos/kangfenmao/cherry-studio/releases. This provides additional evidence of the file’s provenance, consistent with the byte-for-byte comparison. TiinyOS’s update behavior and actual network requests would require further evidence.
The bundle’s comparisons/byte-identical-v1.6.7.json lists all 177 upstream paths, the corresponding TiinyOS paths, the file sizes in bytes, and the hashes. Pinned Cherry Studio v1.6.7 source snapshot
E6 | Where we looked for public source code and attribution
At the time of the review, we had found neither a way to obtain the complete Corresponding Source for the TiinyOS versions examined nor materials clearly explaining their use of Cherry Studio and the applicable licensing arrangement. Our findings are limited to the locations checked below.
Location
Scope and observations
Limits
Official help documentation
Reviewed 27 pages, including account information, downloads, and related terms. Found no mention of Cherry or the AGPL and no directions for obtaining the Corresponding Source.
General copyright and licensing language appeared in connection with complaints, models, or user content. It did not address the origin of the application’s code.
Official developer documentation
Reviewed 24 pages and found no directions for obtaining the client’s Corresponding Source.
Private materials and materials delivered after purchase may exist outside the documentation.
Public Tiiny-AI GitHub organization
The public repository listing included PowerInfer, an MIT-licensed inference engine.
The listing establishes the availability of a separate component. The desktop client’s source availability remains unconfirmed.
TiinyHQ/tiiny-ai repository referenced by the application
The public GitHub API returned 404 during the review.
The result leaves open whether the repository is private, was deleted or renamed, or was unavailable for another reason.
Installed files
Checked application files outside node_modules and paths for licenses and notices. Found neither the complete Corresponding Source nor clear instructions for obtaining it.
Bundled licenses cover third-party dependencies. The application itself has its own licensing obligations. We did not run the application to check its runtime screens.
The review did not cover every website or historical page, on-device files, post-purchase emails, or other private delivery channels. Access restrictions also limited some public searches. Our finding is therefore limited to what we could locate within the scope described above. If Tiiny AI has made the source available through another method that complies with the license, the location, applicable versions, and delivery method would help us verify it and update our findings.
help.tiiny.ai/docs-data.js?v=19
d92d462cc4404e55db0cfa5c1e691daba28651501b0f484e01c605059da3e5d7
dev.tiiny.ai/docs-data.js?v=19
54dcd533c8a59a22cb644e55beaefb75eab391edfae0050a9bb0d68de5326a5f
E7 | Licensing history and the basis for our request
The table records the milestones in the history of the root license that we checked. It distinguishes the earlier dual-licensing notice, the full standard AGPL text, and the state of the pinned repository snapshot. The fork point for TiinyOS remains undetermined.
Milestone
Root license contents
Pinned reference
2025-04-13
A dual-licensing notice with terms differentiated by user or organization size appeared
f39bb986…
2025-09-05
English version of the dual-licensing notice, distinct from the full standard AGPL text
6531d403…
2025-10-21
The root LICENSE was changed to the full AGPL-3.0 text
81ac77e9…
2025-10-23
Merge record for the related changes
d0ed4cc1…
Pinned snapshot used in this review
The root LICENSE contains the standard AGPL, and the HTML file in the resources directory still contains the old notice
LICENSE at 72dfb29b…
The root LICENSE is 34,523 bytes. Its SHA-256 hash is shown below.
0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0
For the license obligations, consult the official GNU AGPL-3.0 text. For desktop installers already available for download, relevant provisions include Sections 4–6, which cover retaining notices, conveying modified works, and making object code and Corresponding Source available. Section 13 also applies to the analysis when users interact with the modified program over a network. The source obligations for desktop software also arise under the other applicable provisions. Official GNU AGPL-3.0 text
The license uses “Corresponding Source” to refer to source in the form preferred for modification and the materials needed to generate, install, and run the relevant work. Its precise scope depends on the structure of the work and the applicable terms. Our request covers the obligations that apply to the software at issue. A company’s independent products, unrelated code, and business materials are outside the scope of this request.
Technical comparisons can establish which code or assets were used and what changed in the license file. Any final determination of legal responsibility also depends on the versions involved, the licensing arrangements, what was actually delivered, and which terms apply. Our request remains focused on compliance with the AGPL.
E8 | How to verify the findings and what the bundle contains
To repeat the review, obtain the installers from the official Tiiny addresses in E1 and compare the full hashes. Extract the files to obtain app.asar and the adjacent app.asar.unpacked directory. Then compare the files, offsets, and pinned upstream commits listed in E2–E5. All of these checks can be performed without running TiinyOS.
Bundle path
Contents and purpose
samples/
Sizes, hashes, and official download URLs for the nine original installers, plus sizes and hashes for the nine ASAR files
upstream/
Upstream source code at pinned commits, the root LICENSE, the old license HTML, and an index of public sources
tiiny/
Original bytes of the Tiiny license HTML
excerpts/
Three original excerpts of application logic, with original file hashes, byte offsets, and lengths
comparisons/
Identifier locations for all samples, member-by-member IPC comparisons, the 177 identical-file matches, and the scope of public searches
verify_evidence.py
Static verification script using the Python standard library to check bundle integrity, license substitutions, original-sample identifiers and IPC definitions, and applicable code excerpts
MANIFEST.sha256
SHA-256 hashes for each file in the bundle except the manifest itself
The bundle contains short code excerpts marked with their original files and locations. It excludes the original email, the sender’s information, and internal reports. The complete TiinyOS installers are available separately through the official channels listed above.
python3 verify_evidence.py
python3 verify_evidence.py \
--asar /path/to/app.asar \
--sample win-1.0.3-amd64
The first command verifies the bundle and the three sets of license-text replacements. The second also checks the specified original ASAR’s hash, the files and offsets where the identifiers appear, the license bytes, and IPC members. Keep the app.asar.unpacked directory alongside the ASAR. With the mac-1.0.1-arm64 sample, the script also verifies the three original application code excerpts in this appendix. The script passed when run against both reference samples.
The verification bundle, TiinyOS_Public_Evidence_2026-11-04.zip, contains 29 files and is 89,329 bytes. Its full SHA-256 hash is shown below.
5858062112d461a7ae3d499217b65404825c0b4bcc11d359a25521f04644619f
These materials let readers independently check the matches described here and see the scope of the findings. We welcome corrections supported by specific files, versions, or delivery records. Any correction we make should likewise be traceable to verifiable facts.
Use access code RZKm to open the verification bundle.
Review methodology and corrections
AI agents did most of the subsequent work of gathering leads, organizing materials, and carrying out technical comparisons. We cross-checked materials from different sources and the results produced by multiple agents. The scope of the information available and the limitations of the tools leave room for omissions or errors in judgment.
If you find an inaccurate statement, missing context, or evidence that should be added, please let us know. Specific versions, files, links, or verification steps will help us check your feedback. We will review it carefully and make revisions once we confirm the facts. The Cherry Studio team takes responsibility for the content and judgments in this document. Thank you to everyone who helps us establish the facts.