--- title: "Third-Party Libraries" url: "https://developer.incode.com/sdk-reference/android-third-party-libraries/" section: "sdk-reference" group: "Android SDK" version: "v1.1" status: "live" --- # Third-Party Libraries The Incode Android SDK builds on a set of third-party libraries and services. This page lists them by purpose so you can complete your own privacy review, Google Play Data safety form, and internal SDK inventory. It describes the SDK's own dependencies; your app may add others. > 📘 Scope and accuracy > > - Exact pinned versions move with each release. The authoritative, per-version list lives in the API Changes and dependency sections of the [release notes](/release-notes/releases-android-sdk/). > - This page groups dependencies by purpose rather than reproducing the full transitive tree. > - Tools used only to build the SDK (the Kotlin compiler, Gradle, annotation processors) are not shipped in your app and are omitted. > - Libraries used only by the Incode sample/demo app are out of scope; they are not part of the published SDK and do not ship in your app. ## How data is handled Capture and biometric processing happen on the device. The SDK sends capture artifacts and verification requests to the Incode Platform over an encrypted channel. It does not log PII or captured content. For more detail, see **Data Handling and Privacy** in the [Incode Android SDK Reference](/sdk-reference/android-sdk/) and [End-to-End Encryption (E2EE)](/sdk-reference/android-e2ee/). ## Capture, media, and on-device processing | Library | Purpose | Used by | | -------------------------------------- | ------------------------------------------------------------------- | --------------------------------------- | | AndroidX CameraX (`androidx.camera:*`) | Camera capture and preview | ID, selfie, and document capture | | JPEG2000 decoder (`dev.keiji.jp2`) | Decodes the portrait image stored on an ID chip | [NFC Scan](/sdk-reference/android-nfc-scan-2/) | | JMRTD + SCUBA | Standard eMRTD (ePassport) chip-reading protocol stack (BAC / PACE) | [NFC Scan](/sdk-reference/android-nfc-scan-2/) | | Screen/video recording (`HBRecorder`) | Records the video session | [Video Selfie](/sdk-reference/android-video-selfie/) | The SDK's on-device machine-learning models (liveness / presentation-attack detection, face recognition, ID face detection, face occlusion, age estimation) are Incode components, shipped as the `model-*` modules - see [Incode Android SDK Reference](/sdk-reference/android-sdk/). They run locally on the device. ## Networking and storage | Library | Purpose | | ------------------------------------------------ | ------------------------------------------------------------ | | Retrofit + OkHttp | HTTP client for requests to the Incode platform | | kotlinx.serialization, `org.json` | Request/response serialization | | Room | Local database (used for delayed / offline onboarding state) | | SQLCipher, AndroidX Security Crypto, Google Tink | Standard encryption libraries for on-device data at rest | | AndroidX DataStore | Encrypted local preferences / session state | ## Platform services | Library / service | Purpose | Notes | | -------------------------------------------------------------------------- | -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | | Google Play Services - base, location, vision (`com.google.android.gms:*`) | Platform services and device location | Used on devices with Google Play Services | | Huawei Mobile Services - location | Device location on Huawei devices without Google Play Services | Selected at runtime when Google Play Services is unavailable - see [Advanced Integration: Dynamic Delivery](/sdk-reference/android-advanced-integration-dynamic-delivery/) | | AndroidX Credentials (`androidx.credentials:*`) | Provisioning a credential to Google Wallet | [Google Wallet ID](/sdk-reference/android-google-wallet-id/) and the wallets dependency | ## Contact, localization, and UI | Library | Purpose | | --------------------------------------------------------- | -------------------------------------------------------------------------------- | | libphonenumber (`io.michaelrocks:libphonenumber-android`) | Phone-number parsing and validation - [Phone](/sdk-reference/android-phone/) | | Lottie, Paris, Material Components, Accompanist | UI, theming, and animations - see [Customization](/sdk-reference/android-customization/) | | restring, reword, viewpump | Runtime string localization | ## Real-time video | Library / service | Purpose | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | OpenTok (Vonage Video) | Real-time video conferencing with a remote agent - [Conference (Assisted Video)](/sdk-reference/android-conference-assisted-video/). Pulled in by the `video-streaming` dependency. | ## Telemetry and diagnostics | Service | Purpose | Notes | | ------- | --------------------------------- | ------------------------------------------------------------------------------------------------ | | Statsig | Feature flags and experimentation | Disabled automatically in Capture-Only and Delayed (offline) modes | | Sentry | Crash and error reporting | Can be turned off with `setCrashReportingEnabled(false)` - see [Installation](/sdk-reference/android-installation/) | ## Risk and antifraud | Capability | Purpose | Notes | | -------------------- | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | | Device-risk provider | Optional third-party device-risk and antifraud signals | Active only when enabled by your Incode configuration; the SDK runs without it when it is not provisioned. See [Antifraud](/sdk-reference/android-antifraud/). | ## Framework and utility libraries These support the SDK internally and do not collect end-user data: - Dependency injection: Dagger, Koin - Asynchronous / reactive: RxJava 2, Kotlin Coroutines - Logging: Timber (the SDK does not log PII or capture content) ## Release hardening The SDK's published release artifacts are obfuscated. This is a build-time step; it does not change the runtime behavior your integration relies on. ## Related pages - [Release notes](/release-notes/releases-android-sdk/) - exact dependency versions per release, in the dependency sections - [Incode Android SDK Reference](/sdk-reference/android-sdk/) - SDK overview, modules, and data-handling summary - [Installation](/sdk-reference/android-installation/) - dependencies you declare, and how to disable crash reporting - [Individual Modules](/sdk-reference/android-individual-modules/) - the module catalog