So according to some research I did, Gonso system creates an HTTPs connection to gonso's server. Acording to the information I found, that connection should be to link your vrchat name to a license so it's kinda like this:
License: p7812... - VRC Name: John ---------> Gonso server
Gonso server ---------> Confirms this information and provides you temporary access to the file
There's still a lot of scattered information though. I've seen one version saying your name is stored first, and another saying it's only added when you activate the licence in Unity.
An HTTPS connection also needs an IP, so in theory the server can see and store your public IP. If you want to hide that, you'd need a VPN or proxy.
The more interesting part is the HWID. I believe Gonso may use Unity's SystemInfo.deviceUniqueIdentifier.
Depending on the Unity version, that identifier can be generated from things like:
Motherboard serial
BIOS serial
CPU UniqueId
Disk serial
Windows OS serial
However, Unity normally turns these into a device identifier/hash rather than directly sending all the raw serials.
A lot more research is still needed though. I don't really understand why this system isn't better documented with actual technical proof.
