oakenbitPrivacy policy
Last updated: 9 October 2026. This is a translation; the German Datenschutzerklärung is authoritative.
This privacy policy covers the website oakenbit.com and the whole oakenbit business: the web tools, the browser extensions, the WordPress plugins, the books, the digital templates and the YouTube channel "Why It Holds".
In short
- The tools on this site run entirely in your browser. Files and text you open in them are not uploaded; we never see or store them.
- We set no cookies and store nothing on your device (no local storage either).
- Visitor statistics come from Cloudflare Web Analytics, which works without cookies and does not recognise individual visitors.
- The browser extensions and WordPress plugins send no data to us.
- There are no ads, no user accounts, no newsletters and no contact form.
- When you buy through Etsy, Payhip, Notion or Amazon, or use our YouTube channel, those platforms' privacy policies apply as well; sections 8 and 9 say what we receive.
1. Controller
Bernhard Siegl – oakenbitAnton Benya-Straße 11/2/4, 2334 Vösendorf, Austria
Email: hello@oakenbit.com
Phone: +43 660 5199915
No data protection officer has been appointed; none is required by law. Please send data protection requests to the email address above.
2. Visiting the site (hosting)
The site is served through Cloudflare's network. When you visit, Cloudflare processes the connection data needed to deliver pages and protect the site from attacks: IP address, date and time, requested address, browser identification (user agent) and the referring page. We do not receive access logs with IP addresses.
Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Cloudflare acts as our processor (Art. 28 GDPR).
3. Cloudflare Web Analytics
To learn which pages and tools are used, we use Cloudflare Web Analytics. A small script reports the page viewed, the referrer, browser, operating system and device type, the country derived from the IP address, and load times. It sets no cookies, stores nothing on your device and, according to Cloudflare, creates no profiles and no device "fingerprint". Your IP address necessarily reaches Cloudflare but is not used to recognise you. We only see aggregated numbers.
Legal basis: our legitimate interest in improving the site and the tools according to use (Art. 6(1)(f) GDPR). You may object at any time (Art. 21 GDPR), for example by blocking scripts from static.cloudflareinsights.com with a content blocker; the site keeps working.
4. Using the tools
Photos, spreadsheets and text you open in a tool are processed only in your browser's memory. They are not sent to us or anyone else and are gone when you close the tab. The site's Content Security Policy only allows connections to the site itself and to the analytics service.
5. Browser extensions "Hidden Text Scanner" and "Leftover Text Finder"
The extensions collect no data. Each reads the text and styling of a web page only when you click its icon, and only in that tab. The analysis happens locally: no data is transmitted, stored or analysed, and there are no usage statistics. The extensions load no code from elsewhere.
The extensions are distributed through Google's Chrome Web Store. Google's privacy policy applies to installing them and to the store; Google is an independent controller for it. Google gives us only aggregated user counts and public reviews.
6. WordPress plugins
Our WordPress plugins (such as "Outline Page Creator" and "Outline Term Creator") send no data to us or anyone else. They store, only in your own site's database, a log of the last 20 runs (date, user ID, content type or taxonomy, IDs of the created items) so that runs can be undone, and each user's last used options. The operator of the site is responsible for that data; when uninstalled, a plugin removes its own data.
The plugins are distributed through the WordPress.org plugin directory. Downloads, reviews and the support forum there are covered by the WordPress.org privacy policy. We receive only aggregated download and install numbers and read public forum posts about our plugins to answer them.
7. Contacting us by email
If you write to us, we process your email address, your name if you give it, and your message to answer you (Art. 6(1)(b) GDPR where it concerns a purchase or a product, otherwise Art. 6(1)(f) GDPR). Writing to us is voluntary, but without an email address we cannot reply. There is no contact form.
Incoming email is forwarded by Cloudflare Email Routing to a mailbox hosted by Google. To prepare a reply, the text of your message may be processed by an AI system (Anthropic); names, email addresses and order numbers are removed automatically first. Please therefore include no more personal details in the text than your request needs.
8. Purchases through platforms
We do not sell our paid products on this site but through the platforms below. Each platform operator is responsible, under its own privacy policy, for its accounts, payments and delivery. This section says what data we receive and what we use it for. The legal basis is the performance of the purchase contract (Art. 6(1)(b) GDPR) and the statutory retention duty (Art. 6(1)(c) GDPR with § 132 of the Austrian Federal Fiscal Code, BAO). We do not use buyer data for marketing. An AI system receives at most the text of a message, after names, email addresses and order numbers have been removed automatically.
Etsy
On Etsy, Etsy Ireland UC (Dublin, Ireland) runs the marketplace and is an independent controller (Etsy privacy policy). Etsy gives us your order details (name, the items bought and, where Etsy passes them on, your email and postal address) and your messages to our shop. We use them only to provide your files and answer your questions. Replies to messages may be drafted with the help of an AI system after names, email addresses and order numbers have been removed automatically; a human sends every reply.
Payhip and Stripe
In our Payhip store we are the seller and the controller. Payhip (Payhip Ltd, London, United Kingdom) runs the store software for us, delivers the files and processes your email address, your order and your consent to immediate delivery as our processor. Payments are handled by Stripe (Stripe Payments Europe, Limited, Dublin, Ireland), which processes your payment data as an independent controller (Stripe privacy policy), including for fraud prevention. We never see full card details.
Withdrawal form
If you withdraw from a contract with the withdrawal form, we process your name, the details of the contract, your email address and the date and time of receipt, to confirm your withdrawal at once and to handle it (Art. 6(1)(c) GDPR with § 13a of the Austrian Distance and Off-Premises Contracts Act, FAGG, and Art. 6(1)(b) GDPR). The form is handled by Cloudflare as part of hosting this site and is not stored there; the confirmation to you and a copy for us are sent through our Google mailbox, where they are kept. We keep them for seven years from the end of the calendar year (§ 132 BAO), because they concern a purchase.
Notion Marketplace
Templates on the Notion Marketplace are sold by Notion (Notion Labs, Inc., San Francisco, USA) as merchant in its own name and independent controller. We receive only the information Notion passes on to template creators about a purchase and use it only to handle the sale and your questions.
Books on Amazon (Kindle Direct Publishing)
Our books are published through Amazon Kindle Direct Publishing. Amazon sells the books itself as the seller; our contract partner is Amazon Media EU S.à r.l. (Luxembourg). Amazon alone is responsible, under its own privacy policy, for your purchase and for reading on Kindle devices. We receive no personal data about buyers, only aggregated sales and royalty reports.
9. YouTube channel "Why It Holds"
We run the YouTube channel "Why It Holds" (@WhyItHoldsExplained). YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open the channel or a video, rate or comment on a video, or subscribe, Google processes your data as an independent controller under its privacy policy, including cookies, ads that Google may show in videos, and transfers to the USA. We have no influence on this.
Google gives us aggregated statistics about the channel (for example views, watch time, traffic sources, search terms, countries and age groups). We cannot identify individual viewers in them. Following the case law of the Court of Justice of the EU (judgment of 5 June 2018, C-210/16), we are probably joint controllers with Google for these statistics (Art. 26 GDPR). We use them to run the channel and to choose the topics of future videos; the legal basis is our legitimate interest in doing so (Art. 6(1)(f) GDPR). You can exercise your rights against us and against Google; requests about the platform itself can only be fulfilled by Google, and we pass them on.
We see public comments and channel names like any other visitor. We read them and remove comments that break YouTube's rules. Comments and commenters' names are never passed to an AI system; if a comment reports an error in a video, we take over only the content of the report, without names. No videos are embedded on this site: a connection to YouTube is made only when you click a link to it.
10. Service providers and recipients
We work with the following providers. For visitors of this site only Cloudflare and, if you email us, Google and Anthropic are directly relevant; the others process data only when you use our offers on their platforms.
| Provider | Purpose | Role |
|---|---|---|
| Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA | Hosting, delivery and protection of the site, analytics, domain, email forwarding, handling of the withdrawal form | Processor |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Email mailbox, including sending the confirmations of the withdrawal form; Chrome Web Store (distribution of the extensions); Search Console (aggregated search statistics); YouTube (platform of our channel, channel statistics) | Recipient as mailbox provider (email); independent controller (Chrome Web Store, YouTube); joint controller (channel statistics, Art. 26 GDPR) |
| Anthropic (Anthropic Ireland, Limited, Dublin, Ireland) | AI system that produces content and drafts replies | Recipient only of message texts from which names, email addresses and order numbers have been removed; no buyer or visitor data |
| GitHub, Inc., San Francisco, USA | Source code and automation | Service provider; receives no visitor or buyer data |
| Etsy Ireland UC, Dublin, Ireland | Sales through our Etsy shop | Independent controller |
| Payhip Ltd, London, United Kingdom | Store platform for digital products | Processor |
| Stripe Payments Europe, Limited, Dublin, Ireland | Payment processing for purchases in our Payhip store | Independent controller |
| Notion Labs, Inc., San Francisco, USA | Sale of templates on the Notion Marketplace | Independent controller |
| Amazon Media EU S.à r.l., Luxembourg, and other Amazon companies | Publication and sale of the books (Kindle Direct Publishing) | Independent controller; we receive no buyer data |
| WordPress.org | Plugin directory and support forum for the WordPress plugins | Independent controller |
Beyond this we disclose data only where the law requires it, for example to tax authorities. We do not sell data.
11. Transfers outside the EU
Where data is transferred to the USA (Cloudflare, Google, GitHub, Notion, and Stripe and Etsy within their groups), the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the Commission's standard contractual clauses. The United Kingdom (Payhip) has an adequacy decision of the European Commission.
12. How long we keep data
- Connection data from visiting the site: only as long as Cloudflare needs it for delivery and security; we keep none ourselves.
- Analytics: we only see aggregated numbers that do not relate to any person.
- Email: until your request is settled and no follow-up is expected; where it must be kept for tax purposes (for example about a purchase), seven years (§ 132 BAO).
- Order and accounting data: seven years from the end of the calendar year (§ 132 BAO).
13. Cookies and storage on your device
This site sets no cookies and stores no data on your device. The analytics script reads technical details (browser, load times) when a page loads and sends them to Cloudflare; you can block it with a content blocker. There is no automated decision-making or profiling. The platforms where we sell set their own cookies under their own terms.
14. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Write to hello@oakenbit.com. If you believe that the processing of your data breaks data protection law, you can complain to the supervisory authority: Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at.
15. AI-generated content
This privacy policy was produced by an AI system operated by Bernhard Siegl; not human-reviewed unless stated.