01The premise
Monitoring software has burned people before: silent telemetry, required accounts, bundled extras, numbers that turned out to be guesses. We can't ask you to trust us because we say so. What we can do is sign everything, document what the app sends, and publish it so you can check.
02What touches the network
Aikonic makes two kinds of network connection, and only two. First, licence registration: on first launch the app requests a licence (all tiers, including free Clarity) and, if the machine has no connection at that moment, retries quietly for about twenty minutes and again at the next start until one is issued. Clarity makes no further call after that; a paid Control licence re-verifies roughly daily so that its seats can be enforced. The exception is a fault in Clarity 1.1.10 and 1.1.12: after the app has run for about a day, those versions also send the heartbeat, about once a day, with the install fingerprint, the licence's identifier and the app's version (see /privacy). Version 1.1.34 fixes it. Those requests carry the licence key or its validation status, a privacy-preserving, non-reversible hashed device fingerprint, and the app's version and product identifier. Nothing else.
Second, update checks: the app requests a small
version file from aikonic.app. This happens automatically
when the app starts, periodically while it stays open (about every six
hours), and immediately when you press Check for updates in
Settings. The request carries only the app's own version number, in
its User-Agent. Nothing from your snapshots, no identifiers, no
account. Aikonic never downloads or installs an update on its own: it
shows a banner, and only if you choose to update does it fetch the
signed installer, verify it against a key built into the app, and run
the install. Installing is always your decision.
Versions up to 1.1.12 also let Microsoft Edge WebView2, the part of
Windows that draws Aikonic's window, make its own calls to Microsoft:
its settings service (config.edge.skype.com) when the
window opens, then its component updater
(edge.microsoft.com). Aikonic's code does not make them
or add anything to them; what they carry is
on /privacy. From 1.1.34, Aikonic
switches them off.
No hardware readings, no usage data, no behavioural data, no crash reports. Your history (in Control) is a local file on your disk. The full policy is in plain language at /privacy, and it changes in the same release as any code that touches the network, never after.
03Don't take our word for it
Run Wireshark, or any packet capture, with Aikonic open. You should see the two connections above, WebView2's calls to Microsoft on versions up to 1.1.12, and nothing else. If you ever observe traffic this page doesn't describe, treat it as a security issue and email [email protected].
04Signed and checksummed
Every installer, and every binary we build inside it, is Authenticode-signed by Hancock Technologies. The one exception is Microsoft's own .NET runtime files, which we bundle and which keep their Microsoft signatures rather than being re-signed by us. From launch, each release is published with its SHA-256 checksum on the download page, so you can verify what you fetched matches what we built, before you run it. The signing certificate's thumbprint and SHA-256 fingerprint are published there too, with the PowerShell command to compare them, so you can tell our certificate from a look-alike that merely carries the same company name.
05About kernel drivers
Aikonic ships exactly one kernel driver of our own: small, Microsoft-attested and EV-signed like every binary we build. It exists because the open-source WinRing0 driver most hardware monitors historically relied on has a known vulnerability, sits on Microsoft's Vulnerable Driver Blocklist, and is refused on modern Windows (the full story). The earlier 1.0 release carried no driver of our own and showed the affected sensors as unavailable instead.
The driver reads the sensors. The one thing it can change is fan speed, for Control's fan control, which is not on sale yet. On Clarity, Aikonic writes nothing to your hardware. Security reviewers and press can request the driver's full threat model at [email protected].
06What we won't claim
You'll never read "military-grade", "unhackable", or "100% private" here. We can't prove a negative. Aikonic is built on the open-source LibreHardwareMonitor sensor library (MPL-2.0), credited and licensed accordingly.
07Report a concern
Security or privacy concerns: [email protected]. Everything else: [email protected].