Privacy Policy

Effective Date: 31 July 2026 Last Updated: 22 August 2026

This policy explains what Sullivan Technology ("we", "us") does with information in two distinct places: the TuneBit desktop software, and this website. They behave very differently, so they are described separately.

1. The TuneBit desktop software

TuneBit runs locally on your computer. It does not send us telemetry, analytics, crash reports, usage statistics, or any inventory of your system.

Everything the software surfaces — hardware details, event logs, registry scan results, crash dump analysis, discovered product keys, disk contents and the results of every scan — stays on your device. None of it is transmitted to us or to anyone else.

1.1 The only network calls the software makes

  • License validation. Every three days, TuneBit sends your signed license code to /api/validate-license.php on this site to confirm it has not been revoked. That code contains only your device's hardware fingerprint and the license expiry date — both values the software already holds locally. In between, it uses the cached answer and makes no call, so starting TuneBit ten times in a day still results in a single check. If our server is unreachable, TuneBit keeps working on the cached result until it is three days old, after which it asks you to re-activate, buy a license, or close the program.
  • Trial issuance. On the first launch of a new install with no license, TuneBit may request a trial license, sending only the hardware fingerprint.
  • Update check. A version string is fetched on launch, at most once a day. The request contains nothing about you or your machine — not even the version you are running, which is compared locally. The binary is downloaded only after you explicitly accept the update prompt, and it is your browser that downloads it.
  • VirusTotal lookups. Only when you use the VirusTotal tool, and only for the file you chose. This sends a file hash to VirusTotal, a third party with its own privacy policy.

1.2 The hardware fingerprint

The fingerprint is a SHA-256 hash computed on your device from stable hardware identifiers. It is not a serial number, MAC address, or anything that identifies you outside our own license database. We use it for one purpose: binding a license to the device or USB stick it was bought for.

2. This website

Buying a license necessarily involves handling some personal data. Here is all of it.

2.1 What we collect

  • Account details. Your email address, a bcrypt hash of your password, and optionally your name. We never store your password itself.
  • Order records. What you bought, when, how much you paid, which coupon you used if any, and a Stripe reference for the payment.
  • License records. The hardware fingerprints you register, any labels you give them, and the codes issued to you.
  • Security logs. Sign-in attempts (email, IP address, success or failure) for rate limiting, and an audit log of significant account actions. These are what stop somebody brute-forcing your account.
  • Newsletter opt-in. Only if you tick the box when creating your account: your email address, your name if you gave one, and the date and IP address the request came from. That record is what lets us show you asked. Leaving the box unticked — it is unticked by default — means none of this happens, and creating an account on its own never puts you on a mailing list.
  • Analytics, only if you accept it. Nothing in this section is collected unless you choose "Accept analytics" on the cookie bar; decline, or leave it alone, and none of it happens. If you do accept: which pages you viewed and in what order, the page or search that sent you here, which outbound links and downloads you clicked, and your browser, device type and screen size. Your IP address is anonymized — the last portion is masked before anything is stored, so we never retain it in full — which leaves us with a country or region rather than a location. If you buy something, the order also records which plan, how many seats, the amount and the discount, tied to the order number. Your name, email address and payment details are never sent to analytics, and query strings that commonly carry personal data are stripped before the page address is recorded.

2.2 What we never see

Card details never reach our servers. Payment happens entirely on Stripe's hosted checkout page. We receive confirmation that a payment succeeded plus a reference to it — never a card number, CVC or expiry date.

2.3 Who we share it with

  • Stripe, our payment processor, receives your email address and order amount so it can take the payment and email your receipt. Stripe's own privacy policy governs what it does with that.
  • Google, on the four pages with a form that bots abuse: contact, create account, sign in, and password reset. Each runs reCAPTCHA v3 to tell people apart from the bots that would otherwise flood it. It sends your IP address and how you moved through the page to Google, which returns a score we use to decide whether to accept the submission. Google's own privacy policy and terms govern that, and both are linked under each form. No other page on this site loads it. The three account forms are not shown to you at all once you are signed in, so on those it only ever runs for signed-out visitors.
  • Our own mailing list, at lists.sullivantechnology.us, if you opted in. It runs on infrastructure Sullivan Technology operates rather than a third-party marketing platform, so your address is not handed to another company in order to email you. It sends you a confirmation link before you receive anything, and every email carries a one-click unsubscribe.
  • Nobody else. We do not sell, rent or trade your information, and we run no advertising on this site.

We do run analytics, but not the kind that shares anything: it is Matomo, self-hosted by us at analytics.sullivantechnology.us, on infrastructure Sullivan Technology operates. No Google Analytics, no advertising network, no data broker, no third-party tag. The measurements described above go to our own server and stay there, and they are not combined with data from any other site.

It is also off until you turn it on. The tracker is not loaded, and no cookie of its is set, unless you accept it on the bar that appears on your first visit. Declining is not a promise to ignore what we collect — the script is never fetched, so there is nothing to ignore. Matomo additionally honours your browser's Do Not Track setting: switch it on and we take that as a decline and do not even ask.

We will disclose information if legally compelled to, and we will tell you if we are permitted to.

2.4 Cookies

One cookie of ours, named tunebit_session, which keeps you signed in. It is HttpOnly, SameSite=Lax, and marked Secure over HTTPS. It expires when you close your browser.

Our self-hosted Matomo sets two more, named _pk_id and _pk_ses, but only if you accept analytics. They hold a random identifier and nothing else — no name, no email address, nothing that identifies you — and exist so that several pages viewed in one sitting count as one visit rather than several. They are first-party cookies, set on this site's own domain and readable by nobody but us; they cannot be used to follow you to any other website. Decline, or turn on Do Not Track, and they are never set.

Your answer is remembered in your browser's local storage, under tb-cookie-consent, rather than in a cookie of its own. It never leaves your device and is not sent to us with any request. Changing your mind is a link away: "Cookie settings" at the bottom of every page brings the bar back.

Those four pages additionally let Google set its own reCAPTCHA cookies, on google.com rather than on this site, for the anti-bot check described above. Those are not covered by the analytics choice and load either way, because they are what stands between those forms and the flood of automated signups and password guesses they otherwise attract — the same category as the sign-in cookie, not the same category as analytics. They are set only on those four pages, and only while you are signed out.

There are no advertising cookies anywhere on this site, and nothing here is used for cross-site tracking or profiling.

2.5 How long we keep it

Account, order and license records are kept for as long as your account exists, and afterwards only as long as tax and accounting law requires us to retain transaction records. Sign-in attempt logs are pruned routinely.

If you subscribed to the newsletter, we keep the record of that opt-in for as long as you stay subscribed, and for a period afterwards so we can show the mail we sent you was asked for. Unsubscribing stops the email immediately; it is a separate thing from your account, and doing one does not do the other.

Analytics is kept only as visit records with an anonymized IP address, which are pruned on a schedule; the summarised totals we actually look at — visits per page, per week — are what we retain longer, and those describe traffic rather than people.

3. Your rights

You can ask us to show you what we hold, correct it, or delete your account and its data. Deleting your account revokes any licenses attached to it. Email us and we will action it — there is no form to fill in.

If you are in the UK or EU, the lawful bases we rely on are performance of a contract (issuing and validating the license you bought), legal obligation (keeping financial records), legitimate interests (protecting accounts from abuse, and measuring how the site is used in the limited, self-hosted, IP-anonymized way described above), and — for the newsletter and nothing else — consent, which you may withdraw at any time using the unsubscribe link in any email we send.

If you would rather not be counted at all, switch on Do Not Track in your browser: the site checks it and records nothing about your visit.

4. Children

TuneBit is not directed at children and we do not knowingly collect information from anyone under 13.

5. Changes

If this policy changes materially, we will update the date at the top and note the change on this page. Continuing to use TuneBit or this site after a change means you accept the revised policy.

6. Contact

Questions about this policy, or a request about your data: use the contact form and mark it as a billing or account inquiry.