Alithon Privacy Policy
Effective date: October 15, 2026
This policy explains what personal information Alithon Studio ("Alithon", "we", "us") processes when you use alithon.com, Serial Port Utility (in every edition: direct download, Mac App Store and other app stores, and its command-line tool), an Alithon account, our purchases and our cloud services — and what choices you have. It is part of our Terms of Service.
In short
- The software works fully offline and needs no account. Until you allow its online features in the first-start dialog, it sends nothing that identifies your computer.
- Once you allow them, it sends only what licensing and the Free allowances need: a device identifier, the app version, the operating system, usage counters (including how often the Free allowances were used and which of our prompts you answered) and, if you entered one, your license key. It never sends your user name, your computer's name, your network adapter's hardware (MAC) address, file paths or your settings (installations set up before version 6.6.8 keep an older identifier derived from that address; see Section 2.1).
- Cloud services (Live Console, Live Relay, Live Share, settings sync) need an account and only run when you turn them on.
- We do not sell personal information, do not show personalized ads and do not track you across apps or websites.
- Our servers are in Tokyo, Japan. If you are in mainland China, allowing the online features means your information is transferred there (Section 6).
- You can delete your account yourself at any time: account center → Delete account, or in the software: Cloud → Delete Account….
1. Who we are
The personal information handler (data controller) is Alithon Studio. For any privacy question or request, including to reach the person responsible for personal information protection, write to bill@alithon.com.
2. What we collect and when
2.1 Using the software, with or without an account
Your serial data, logs, recordings, projects, scripts, command libraries and settings stay on your computer unless you use a cloud service (Section 2.3).
Online features need your permission. The first time the software starts, it explains what it sends and asks whether to allow online features. You can change your answer at any time under Help → Privacy and Online Features…. Until you allow them, the software works offline as Free: it does not report to our server, check or activate license keys online, sign in, or use cloud services. A license already activated on the computer keeps working. The only request it makes is the update check, which sends nothing but the platform name (for example "windows").
Once you allow online features, the software talks to our server in these cases:
| When | What is sent | Why |
|---|---|---|
| About 30 seconds after start-up, when it exits, and right after you click a buy or enter-license button in one of its prompts | Device identifier (CID); app version; operating system name and version; processor architecture; number of launches and total running time; interface language; your license key if you entered one (start-up only); and, when there is something to report, the Free allowance statistics described below | Licensing and activation limits; enforcing the Terms against a device used to abuse a license; counting active installations by version; answering in your language; improving Free and Pro |
| When you activate or check a license key | License key, device identifier | Activation and renewal |
| When checking for updates (also before you allow online features) | The platform name, for example "windows" | Showing the latest version |
| When loading in-app announcements (direct download and Microsoft Store editions; never the Mac App Store edition) | Your interface language (Chinese or English) and the edition's distribution channel; no device identifier or license key | Showing the announcements meant for your language and edition |
Free allowance statistics. Free includes some tools with allowances per session (for example 5 Modbus requests or 120 seconds of plotting). When something has happened since the last report, the report also carries: for each allowance, by its name, how many times it was used, refused or given back; the edition state (Free, Pro, expired license or Mac App Store edition without a subscription) and how Pro was obtained (license, subscription or neither); the distribution channel (direct download, Mac App Store or Microsoft Store); a batch number, so that a report sent twice is counted once; and a list of at most 50 events — which allowance prompt, daily reminder, notice or announcement was shown, which button you chose, the time (UTC) and, for an announcement, its number. It contains no data from your ports, no commands, rule or file contents, file names, and no user, computer or account names. On our server the counts and events are added to daily totals by app version, edition state and distribution channel, which carry no device identifier. With your device record we keep only the latest counts (without the event list), the number of the last batch counted, and which prompt your most recent click on a buy button came from and when, so we can tell whether a prompt led to a purchase.
In-app announcements. An announcement is chosen only by your interface language and your edition's distribution channel, never by who you are or how you use the software. A picture in an announcement is downloaded from the address the announcement gives, whose server sees your IP address as with any web request. Clicking an announcement opens its page in your browser, where that site's own privacy policy applies. That an announcement was shown or clicked is counted only in the statistics above.
The device identifier (CID) is generated on your computer at first launch from the time, a random number and a one-way hash of the operating system's installation ID; it cannot be turned back into that ID, and since version 6.6.8 no part of it comes from your network adapter. Installations first set up with a version before 6.6.8 keep the identifier they were given then, which was derived from the network adapter's hardware (MAC) address: before version 6.6.1 the identifier was that address written as a number, and from 6.6.1 it contains the address's last four hexadecimal digits. We do not replace these identifiers, so that existing license activations stay valid. Version 6.6.8 no longer reads the MAC address; apart from what such an older identifier contains, the address is not sent to us or stored by us, and we do not decode, display or use it.
Our server also sees the IP address each request comes from; we keep only the address of a device's most recent report and, for a restricted device, of its most recent refused request (Section 7).
The software does not send: your user name or account name on the computer, the computer's name, your network adapter's hardware (MAC) address, processor identifiers, file or folder paths, the contents of your settings, what you type or receive on a port (unless you use a cloud service), or crash reports (the software has no crash reporting).
Diagnostic pack. Help → Export Diagnostic Pack creates a zip file on your computer. It is never uploaded; it only reaches us if you send it to us, and by design it contains no license keys, account data, device identifier, MAC address, user name or computer name. If you send one, we use it only to resolve your issue.
2.2 Your Alithon account
- Registration and sign-in: email address, user name, password (stored only as a salted hash), and the verification code we email you (kept for 30 minutes).
- Profile (optional, on the website): name, location, "about me" and time zone, if you fill them in.
- Sign-in sessions: for each computer where you sign in to the software, a token (stored as a hash), the computer's device identifier, the device name, the app version and when it was last used.
- Devices: the device identifier, the device name and when the device was bound to your account. The device name is one you choose in the software (Cloud → Device Name…); by default it is the operating system plus the last four characters of the device identifier, for example "Windows · 3F9C". It is never your computer's own name.
- License keys bound to the account: which keys are bound, when, and a history of binding and activation actions (key, device identifier, time).
- Account activity: when the account was created and last used.
2.3 Cloud services
Cloud services need an account and run only when you turn them on. We process what passes through them only to provide them.
- Live Console. While it is on, the software sends your device's port list and port settings. Port data (what is sent and received) is uploaded only while someone has the device open in Live Console or a Live Share browser guest is watching it. It is held in a rolling buffer — about 128 KB for up to 24 hours on Free, about 1 MB for up to 7 days with Pro or a purchased traffic balance — together with the commands sent from the browser and their results.
- Live Relay. Port data flows through our servers between the two computers and is not stored. While a session is open we keep its technical details (session ID, device, port, byte counts), which expire within 5 minutes after the session ends.
- Live Share. When you issue an invite code we store the share (port name, the label you wrote, the access level you allowed, a hash of the optional passcode, expiry of up to 24 hours) until it expires or you revoke it, plus one hour. A guest needs no account; we keep only the display name the guest types, so we can show you who is connected, and a browser guest's session (random ID, display name, last activity), which ends after 30 minutes idle. Commands a guest sends appear, with the guest's display name, in your device's command history. To limit guessing we count join attempts per keyed hash of the guest's IP address, never the address itself, and wrong passcodes per invite.
- Settings sync. When you sync, we store your connection and display settings (for example port names, baud rates, target hosts and ports, fonts and colors, language) and, only if you tick it, your send history, together with the device identifier that uploaded them.
- Traffic metering. For each account we count the bytes of cloud traffic per month and direction (never the content), and keep a ledger of usage, purchased packs and grants.
2.4 Purchases, refunds and invoices
- Orders: the name and email address you enter at checkout, the product, term, quantity, price and currency, the payment channel, order and transaction numbers, payment status and time, the license keys issued, and the account the order belongs to if you were signed in.
- Payment: you pay through WeChat Pay (via YunGouOS) or PayPal. They process your payment details; we never receive your card or bank account numbers. We receive the payment result and transaction identifiers, which may include a payer identifier specific to that provider.
- App Store purchases: Apple processes them. If you are signed in, we receive and store the subscription's transaction identifiers, product, status, renewal and expiry dates, storefront and price, and link them to your account through an anonymous account token.
- VAT e-invoices (电子发票): if you request one, the invoice title and type, taxpayer identification number, and — only if you enter them — address, telephone, bank and account number, plus the email address or phone number for delivery; and the issued invoice file.
- Refunds: the order, the reason you give, your email address and the outcome.
2.5 Visiting alithon.com
- Server logs: IP address, time, requested page, browser type and referring page, used for security and troubleshooting.
- Cookies and local storage: only those the site needs, plus analytics if you allow it:
| Name | Purpose | Lifetime |
|---|---|---|
session |
Keeps you signed in and protects forms | Until you close the browser |
remember_token |
"Keep me logged in" sign-in | Up to 365 days, or until you sign out |
locale |
Your language choice | 1 year |
browser_tz |
Shows dates in your time zone | 1 year |
release_platform |
Remembers the download platform you picked | 30 days |
spu_guest |
A Live Share browser guest's session | 30 minutes idle |
| Local storage: analytics choice, documentation and account-center layout, "was this helpful" votes | Remember your choices on this browser | Until you clear site data |
| Session storage: number of public pages viewed | Decides when to show the analytics notice | Until you close the tab |
- Analytics: only if you click Allow in the analytics notice, public pages (not account, dashboard or payment pages) load Baidu Analytics (百度统计), which receives the page address, referrer, browser and device information and your IP address and sets its own cookies. If you decline, or your browser sends Do Not Track, it is never loaded. You can change your choice by clearing this site's data in your browser.
- Contact form: your name, email address and message, which are emailed to us; the verification code sent to your address is kept for 30 minutes.
- Documentation feedback: only an anonymous count of "yes" and "no" votes per page.
- Abuse limits: to limit repeated requests we count them per keyed hash of the IP address, for at most 24 hours.
If you download the software from our GitHub repository, GitHub processes that visit under its own privacy statement.
2.6 Emails
We send service emails: verification codes, password-reset and email-change messages, order receipts and license keys, invoices, refund updates and the confirmation that your account was deleted. We do not send marketing email.
3. Why we use it, and on what basis
| Purpose | Information | Legal basis |
|---|---|---|
| Providing the software, licenses and activation | App reports (2.1), license keys, orders | Your consent to the online features, and performance of our contract with you (the Terms) |
| Providing your account and the cloud services you turn on | 2.2, 2.3 | Performance of our contract with you |
| Taking payment, delivering orders, invoices and refunds; keeping accounting and tax records | 2.4 | Contract; legal obligations |
| Security, preventing fraud and license abuse, enforcing the Terms (including disabling a license key or restricting a device, identified by its device identifier, used in breach) | Device identifier, license key, IP address, order records | Performance of the contract; legal obligations |
| Counting active installations and versions to plan development | App reports, as aggregated statistics | Your consent to the online features; we use aggregates, not individual profiles |
| Improving Free and Pro: which allowances are reached, which prompts, reminders and announcements are shown and chosen, and whether a prompt led to a purchase | Free allowance statistics (2.1), as daily totals; a device's latest buy click | Your consent to the online features; we use totals, not individual profiles |
| Website analytics | Baidu Analytics data | Your consent, which you can withdraw |
| Storing and processing your information in Japan | Everything above that reaches our servers | Your separate consent (Section 6) |
| Answering you | Messages and emails you send us | Your request |
We do not make decisions about you by automated means that have legal or similarly significant effects.
4. What we do not do
- We do not sell or rent personal information.
- We do not use personal information for personalized advertising. In-app announcements are chosen only by interface language and edition, the same for everyone who shares them.
- We do not track you across other companies' apps or websites.
- We do not collect your network adapter's hardware (MAC) address or other hardware serial numbers (except what the older device identifier of an installation set up before version 6.6.8 contains; see Section 2.1).
- We do not read or analyze the data on your serial ports, except to carry it through a cloud service you turned on.
- We do not look up where you are from your IP address.
5. Who we share it with
We share personal information only with the providers below, only what each needs, under agreements that require them to protect it, or where the law requires it.
| Recipient | What for | What they receive |
|---|---|---|
| A cloud hosting provider (servers in Tokyo, Japan) | Hosting our servers, databases and backups in Tokyo, Japan | All information stored on our servers |
| YunGouOS, the WeChat Pay payment service provider we use, and Tenpay (WeChat Pay) | WeChat Pay payments | Order number, amount, product description; your payment is made in WeChat |
| PayPal | PayPal payments | Order number, amount, product description; your payment is made at PayPal |
| Apple | Mac App Store purchases and subscriptions | Apple is the seller; we receive transaction information from Apple |
| Our email delivery provider | Sending service emails | Your email address and the content of the email |
| Baidu (百度统计) | Website analytics, only with your consent | See Section 2.5 |
Apple, PayPal, Tenpay and Baidu process information under their own privacy policies as independent handlers.
We may disclose information where required by law, by a court or by a competent authority, or where necessary to protect life, safety or our legal rights. If our business is transferred, the new operator will be bound by this policy, and we will tell you.
6. Storage in Japan (cross-border transfer)
Our servers and databases are located in Tokyo, Japan. If you are in mainland China, the information described in Section 2 that reaches our servers is therefore transferred out of mainland China. Details required by law:
- Overseas recipient: Alithon Studio itself, using servers it rents in Tokyo, Japan from the cloud hosting provider listed in Section 5. Contact: bill@alithon.com.
- Purposes and processing: the purposes in Section 3; the information is stored and processed there to provide the services.
- Categories: the categories in Section 2 that are sent to our servers (app reports, account, cloud service, purchase, invoice and website information).
- Payment providers may also process payment data outside mainland China under their own policies.
- Your rights apply in full to information stored in Japan; exercise them as described in Section 8.
We ask for your separate consent to this transfer: in the software, in the first-start dialog (Help → Privacy and Online Features… later), before anything identifying your computer is sent; on the website, when you create an account. If you do not consent, the software stays fully usable offline as Free, and you can still browse alithon.com.
7. How long we keep it
| Information | How long |
|---|---|
| Device record from app reports (CID, version, OS, counters, license key) | While the device keeps reporting; deleted 3 years after the last report unless a license activation or a device restriction still refers to it |
| Free allowance statistics of a device: the latest counts (replaced by each report) and the number of the last batch counted | The counts: with the device record; the batch number: 30 days |
| A device's latest click on a buy button (which prompt, and when) | 180 days |
| Daily totals of the Free allowance statistics (by app version, edition state and distribution channel; no device identifier) | Kept for product planning; a working copy on the server expires after 45 days |
| IP address of a device's latest report; for a restricted device, also the IP address of its latest refused request | 90 days after that report; the refused request's address stays with the device restriction record (while the restriction is in force and 24 months after it ends) |
| Account profile and device list | Until you delete your account |
| Sign-in tokens | Until they expire (30 days) or you sign out; the record is removed 30 days later |
| Device binding history (which account a device was bound to) | 3 years |
| License key binding and activation history | As long as the license key exists; after your account is deleted, kept without any link to you |
| Settings sync data | Until you delete it or your account; deleted items are purged after 30 days |
| Live Console buffer | Rolling: up to 24 hours (Free) or 7 days (Pro or purchased traffic); deleted at once when you delete your account |
| Live Relay session details | Up to 5 minutes after the session ends |
| Live Share invite and guest session | Until the invite expires or is revoked, plus 1 hour; browser guest sessions end after 30 minutes idle |
| Cloud traffic usage | 24 months; purchase entries are kept with the order |
| Orders, invoices, refunds and App Store transaction records | As long as accounting and tax law requires (at least 10 years, and up to 30 years for accounting records); unlinked from your account when you delete it |
| Device restriction records | While the restriction is in force and 24 months after it ends |
| Verification codes | 30 minutes |
| Abuse-limit counters | At most 24 hours |
| Server logs | Up to 30 days |
| Messages, emails and diagnostic packs you send us | Until your request is resolved and at most 3 years |
| Record that an account was deleted (former account number, time and counts of what was removed; no email address) | 3 years |
Encrypted backups are kept only as long as needed to recover from a failure and are overwritten as they rotate, so information deleted under the periods above also leaves the backups once the backup that holds it has been overwritten.
8. Your rights and choices
You can:
- Access and copy your information: most of it is in your account center; for anything else, write to us.
- Correct it: edit your profile, email address and device names yourself, or ask us.
- Delete your account yourself at any time — account center → Delete account, or in the software: Cloud → Delete Account…. Deletion takes effect immediately and removes your profile, sign-in sessions, device list, synced settings, Live Console data, Live Share invites and traffic balance. License keys stay valid and are released from the account. Orders, invoices and refunds are kept for the legal periods above, no longer linked to an account. A Mac App Store subscription is not cancelled by deleting the account; cancel it in the App Store.
- Delete specific data: remove a device, revoke an invite code, turn off Live Console, delete synced settings, or ask us to delete other information.
- Withdraw consent: in the software, Help → Privacy and Online Features… → Turn Off Online Features stops all reports and cloud services on that computer and signs it out; for website analytics, clear this site's data; for storage in Japan, also delete your account. Withdrawing does not affect processing before it.
- Ask us to explain how we process your information, to restrict it, or to transfer a copy to you where the law provides.
- Turn features off: each cloud service can be switched off in the software, and signing out stops it on that computer.
We answer within 15 working days and may need to confirm your identity first. If you are not satisfied, you may complain to the authority responsible for personal information protection where you live. If a user has died, their close relatives may exercise these rights over the user's information for their own lawful interests, unless the user arranged otherwise.
9. Security
We use encrypted connections (HTTPS/TLS) for all traffic between the software, browsers and our servers, store passwords and tokens only as hashes, restrict access to personal information to the people who need it, and keep our servers updated. No system is perfectly secure; if a security incident affects your personal information, we will inform you and the authorities as the law requires.
10. Children
Our services are not intended for children under 14, and we do not knowingly collect their personal information. If you believe a child under 14 has given us personal information, contact us and we will delete it. Users under 18 should use an account or make purchases only with a parent's or guardian's consent.
11. Changes to this policy
We will publish any update here with a new effective date. For a significant change we will tell you in advance by email or in the software, and ask for your consent again where the law requires.
12. App Store privacy summary
This is how the Mac App Store edition's data use is declared in the App Store. Nothing below is collected until you allow online features in the app. The Mac App Store edition does not load in-app announcements.
| Data type | Collected | Linked to you | Purpose |
|---|---|---|---|
| Contact info — email address (account) | Yes, when you create an account | Yes | App functionality |
| Identifiers — user ID (account number, App Store account token) | Yes, when you sign in | Yes | App functionality |
| Identifiers — device ID (CID; an installation set up before version 6.6.8 keeps the older identifier described in Section 2.1) | Yes | Yes | App functionality, analytics |
| Purchases — purchase history (subscription and license status) | Yes | Yes | App functionality |
| Usage data — product interaction (number of launches, running time, use of the Free allowances and the choices made in its prompts, cloud traffic bytes) | Yes | Yes | App functionality, analytics |
| Diagnostics — other diagnostic data (app and OS version) | Yes | Yes | App functionality, analytics |
| User content — other user content (Live Console port data, synced settings and send history, invite labels) | Only if you use those features | Yes | App functionality |
| Crash data, location, contacts, browsing history, hardware addresses | No | — | — |
| Tracking | None | — | — |