Trademark policy

The name “CKey”

“CKey”, “Open CKey” and the CKey mark identify the official specification, core, SDKs and apps published by ClearKey Solutions, LLC at github.com/clearkeysolutions/ckey and on openckey.org. The MIT licence lets you use, change and redistribute the code. It does not grant any right to the name or the mark.

You may use “CKey” in a product’s name, listing or description only to say that it reads or renders CKey codes, for example “Acme Scanner, reads CKey codes” or “Label Studio, prints QR and CKey codes”. Don’t use it in a way that suggests your product is made, sponsored, endorsed or certified by CKey or ClearKey Solutions, and don’t use the CKey mark as your product’s logo or icon.

“Certified”, “Safe Actions” and “brokered by CKey”

These words describe products that have shown they behave as the specification requires. You may use them only when your product passes conformance:

• “CKey Certified” reader or renderer: it passes the conformance suite for the profiles it claims.
• “Supports CKey Safe Actions” and “brokered by CKey”: it reaches every verdict in tests/vectors/safe-actions-v1.json and follows every rule in what a reader must do. That includes the confirmation for cross-device actions, which the reader, not the app, controls. Readers built on an official CKey SDK do this as shipped.

Change how the official SDK runs Safe Actions, skip its confirmation, or run actions some other way, and the product no longer qualifies, even if each change looks harmless.

The unsafe auto-execution module

ckey-unsafe-autoexec is a separate package, under a BSD 3-Clause licence with a no-endorsement clause. It parses and verifies Safe Actions exactly as the official SDK does, then hands the decision of when to run them, and any prompt, to the developer. Choosing it is a legitimate developer choice. Most developers who use it want their own confirmation screen and still follow every best practice in the specification, and what they build can be perfectly safe.

The module does nothing unsafe by itself. What changes is who is responsible: with the official SDK, CKey’s rules decide when a code runs; with the unsafe module, the developer does. CKey can’t tell from the outside which developers kept the rules, so it can’t vouch for any of them. That’s why:

• a product that uses ckey-unsafe-autoexec may say it reads CKey codes;
• it may never claim to be CKey Certified, to support CKey Safe Actions, or that an action was brokered by CKey;
• codes it runs are not Safe Actions, and it must not describe them as Safe Actions.

The CKey Certified mark on codes

The renderer photographs a styled code in a model and reads it back with the real decoder. When the result is certified, you may show the CKey Certified mark beside that code, as long as:

• the code was generated on openckey.org/render and certified there, in that exact style, size and colour;
• you print or display the downloaded file unchanged (no recolouring, cropping, retouching or effects added afterwards);
• you don’t place the mark on, or next to, a code that wasn’t generated and certified there.

The mark certifies the code’s design: that it looks like a CKey and, in the model, scans about as reliably as stated. It never certifies the content. A certified code can hold a link to anything. openckey.org doesn’t check, endorse or take responsibility for what any code says or where it leads, and the mark must not be presented as if it did.

Safe Action codes made on this site

The renderer will draw a code that holds a Safe Action (ckey-action:), but it marks it UNSAFE and never certifies it. A real Safe Action is signed on the issuer’s own server, for one app, with a request ID that works once and a lifetime of minutes. A Safe Action pasted into a web page wasn’t made that way, may have expired or been used before it’s scanned, and its effect is something only the issuer and the receiving app can vouch for. Use ckey action sign or your server’s own signer instead.

Questions and reports

Ask about a use that isn’t covered here on the CKey project on GitHub. Report a product that misuses the name or the mark through the report form. This policy may change; the date above shows the latest version.