# Third-Party Libraries The Incode Android SDK builds on a set of third-party libraries and services. This page groups them by purpose, not as a full dependency tree. Use it to complete your own privacy review, Google Play Data safety form, or internal SDK inventory. This page covers only the SDK's own dependencies. Your app may add others. It omits build-only tools, like the Kotlin compiler, Gradle, and annotation processors, since these don't ship in your app. It also omits dependencies used only by the Incode sample app, since the sample app isn't part of the published SDK. Exact pinned versions change with each release. For the current, per-version list, see the API Changes and dependency sections of the [release notes](https://developer.incode.com/docs/releases-android-sdk). *** ## How Data Is Handled Capture and biometric processing happen on the device. The SDK sends capture artifacts and verification requests to the Incode Platform over an encrypted channel. It does not log PII or capture content. For more detail, see **Data Handling and Privacy** in the [Incode Android SDK Reference](https://developer.incode.com/docs/android-sdk#data-handling-and-privacy) and [End-to-End Encryption (E2EE)](https://developer.incode.com/docs/android-e2ee). *** ## Capture, Media, and On-Device Processing | Library | Purpose | Used by | | ---------------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | AndroidX CameraX: `androidx.camera:*` | Camera capture and preview. | [Document Scan](https://developer.incode.com/docs/android-document-scan), [ID Scan](https://developer.incode.com/docs/android-id-scan), and [Selfie Scan](https://developer.incode.com/docs/android-selfie-scan) | | JPEG2000 decoder: `dev.keiji.jp2` | Decoding the portrait image stored on an NFC chip in an ID. | [NFC Scan](https://developer.incode.com/docs/android-nfc-scan-2) | | JMRTD and SCUBA | Standard eMRTD, or electronic passport, chip-reading protocol stack. Supports BAC and PACE protocols. | [NFC Scan](https://developer.incode.com/docs/android-nfc-scan-2) | | Screen and video recording: `HBRecorder` | Recording the video session. | [Video Selfie](https://developer.incode.com/docs/android-video-selfie) | The SDK also includes on-device machine-learning models for liveness and presentation-attack detection, face recognition, ID face detection, face occlusion, and age estimation. These are Incode components, shipped as the `model-*` modules. They run locally on the device. *** ## Networking and Storage | Library | Purpose | | ------------------------------------------------ | -------------------------------------------------------------- | | Retrofit and OkHttp | HTTP client for requests to the Incode Platform. | | kotlinx.serialization, `org.json` | Request and response serialization. | | Room | Local database. Used for delayed and offline onboarding state. | | SQLCipher, AndroidX Security Crypto, Google Tink | Standard encryption libraries for on-device data at rest. | | AndroidX DataStore | Encrypted local preferences and session state. | *** ## Platform Services | Library or Service | Purpose | Notes | | ------------------------------------------------------------------------------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Google Play Services: base, location, and vision. Package: `com.google.android.gms:*` | Platform services and device location | Used on devices with Google Play Services. | | Huawei Mobile Services: location | Device location on Huawei devices without Google Play Services | Selected at runtime when Google Play Services is unavailable. See [Dynamic Delivery](https://developer.incode.com/docs/android-advanced-integration-dynamic-delivery). | | AndroidX Credentials: `androidx.credentials:*` | Adding a credential to Google Wallet | [Google Wallet ID](https://developer.incode.com/docs/android-google-wallet-id) and the wallets dependency. | *** ## Contact, Localization, and UI | Library | Purpose | | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | libphonenumber: `io.michaelrocks:libphonenumber-android` | Phone number parsing and validation. See [Phone](https://developer.incode.com/docs/android-phone). | | Lottie, Paris, Material Components, Accompanist | UI, theming, and animations. See [Customization](https://developer.incode.com/docs/android-customization). | | restring, reword, viewpump | Runtime string localization. | *** ## Real-Time Video | Library or Service | Purpose | | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | OpenTok: Vonage Video | Real-time video conferencing with a remote agent. See [Conference (Assisted Video)](https://developer.incode.com/docs/android-conference-assisted-video). Pulled in by the `video-streaming` dependency. | *** ## Telemetry and Diagnostics | Service | Purpose | Notes | | ------- | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Statsig | Feature flags and experimentation | Disabled automatically in Capture-Only mode and Delayed mode, also known as offline mode See [SDK Modes](https://developer.incode.com/docs/android-sdk-modes). | | Sentry | Crash and error reporting | Can be [turned off](https://developer.incode.com/docs/android-troubleshooting#disable-sdk-crash-reporting) with `setCrashReportingEnabled(false)`. | *** ## Risk and Antifraud | Capability | Purpose | Notes | | -------------------- | ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Device-risk provider | Optional third-party device-risk and antifraud signals | Active only when enabled in your Incode configuration. The SDK works without it if it isn't provisioned. See [Antifraud](https://developer.incode.com/docs/android-antifraud). | *** ## Framework and Utility Libraries These support the SDK internally. They don't collect end-user data. - **Dependency injection**: Dagger, Koin - **Asynchronous and reactive**: RxJava 2, Kotlin Coroutines - **Logging**: Timber. Timber does not log PII or capture content. *** ## Release Hardening The SDK's published release artifacts are obfuscated. This happens at build time and doesn't affect the runtime behavior your integration relies on.