Privacy Policy

Last updated: 13 October 2026.

The short version: your family data never leaves your computer, this website sets no cookies of its own, and we store the minimum needed to make a license key work. Data controller: Adam Różański, contact@oakbough.com.

The app

Everything you enter — people, dates, places, photos, sources — is stored as plain files on your own disk. The app sends no telemetry about you or your data and works fully offline. It talks to the internet in these cases only:

  • Update check (on by default, one switch in Settings to turn it off): in versions newer than 0.14.0, once a day the app asks oakbough.com whether a newer version exists, sending only its own version number and operating system — no identifier, nothing about you or your tree. We keep a daily count of these checks (day, version, operating system, country), nothing else, and not your IP address. The first check after installation is marked as the first (event=first), so we can count how many downloads end in a program that runs — still with no identifier. When you turn the check off, the app sends one last request of the same kind saying it was turned off (and one when you turn it back on), so we know how many people prefer it off; after that it stays silent.
  • Online place lookup (opt-in) sends the place name you're searching to the OpenStreetMap Nominatim / Photon geocoding services. No personal data, no identifiers — just the place name.
  • License activation sends your license key, the app name, and a random per-machine identifier (a UUID the app makes up on first run — not a hardware fingerprint) to our license server. See below.
  • The world place pack (when you choose to download it) is fetched from data.oakbough.com — an ordinary file download; nothing about you or your tree is sent.

Crash logs, if the app ever writes them, stay in a local folder on your machine and are only shared if you email them to us yourself.

Buying

Checkout is operated by Paddle (Paddle.com Market Limited) as merchant of record. Paddle processes the personal data needed for the purchase — name, email, payment details, country — as an independent controller, described in Paddle's privacy policy. We do not see or store your payment details.

The license server

To activate and validate license keys we run a small server that stores, per license: the key, the product it's for, its status, the Paddle transaction reference, the e-mail address used for the purchase, activation timestamps, and the random device identifiers described above. That's all — it exists solely so your key works, so we can send it again if you lose it, and so a refunded key stops working. It's hosted on Cloudflare's EU-capable infrastructure and the data is kept for as long as the license exists, plus what bookkeeping law requires.

The e-mail carrying your key is sent through Resend (Plus Five Five, Inc.), which processes your address and the contents of that message only in order to deliver it.

This website

Static files, served by Cloudflare. The site itself sets no cookies and runs no analytics or tracking pixels. One exception, on the Oakbough Family page (/family/), where PRO is sold: it loads Paddle's checkout script (paddle.js) to show the price in your currency and to take payments. That script comes from Paddle and may store technical data needed for payment and fraud prevention in your browser, under Paddle's privacy policy. We count installer downloads: for each download we add one to a tally of (day, file, country, client class) — the country is Cloudflare's guess from the connection; the client class says whether the download came from a browser (and which operating system it runs on) or from an automated program, judged from your browser's standard user-agent header, which we do not store. Nothing else about you is recorded, not even your IP address. Cloudflare keeps standard, short-lived technical logs (IP, request) to run and protect the service. Email to contact@oakbough.com is routed via Cloudflare Email Routing to our mailbox.

Your rights

Under the GDPR you can ask us for access to, correction of, or deletion of the data above, or complain to a supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO). Deleting license data deactivates the license. One honest note: for your family research data we can't help or hinder — it's on your disk, we never had it.

See also: Terms of service · Refund policy