diff --git a/README.md b/README.md
index 26d60c75..fbcd4ac3 100644
--- a/README.md
+++ b/README.md
@@ -36,5 +36,6 @@ License
 -------
 
 GPL version 3 or later, please see [LICENSE](LICENSE.md) for the full text.
+Some bundled third-party components have [other licenses](vendor/README.md).
 
 Thanks to [Icons8](http://icons8.com/) for letting us use their icons.
diff --git a/vendor/README.md b/vendor/README.md
new file mode 100644
index 00000000..053a7c44
--- /dev/null
+++ b/vendor/README.md
@@ -0,0 +1,20 @@
+Bundled third-party files
+=========================
+
+This directory contains files that did not have a standard
+[rubygems](https://rubygems.org/) dependency, and therefore
+need to be distributed with Foodsoft.
+
+License
+-------
+
+* `assets/javascripts/touchclick.js.coffee` -
+    [touchclick](https://github.com/tuxracer/touchclick),
+    [MIT license](https://github.com/tuxracer/touchclick/blob/master/LICENSE)
+* `assets/fonts/OpenSans-*.ttf` -
+    [OpenSans](http://www.fontsquirrel.com/fonts/open-sans),
+    [Apache 2.0 license](http://www.apache.org/licenses/LICENSE-2.0)
+
+As this list needs to be updated manually, please look in the
+files themselves to see if they contain a license statement.
+