No logs, by construction. The kind of no-log I like.

What I never see

• The sites you visit and the content of your traffic.
• Your DNS queries.
• The times you connect.
• Your source IP address.
• Your per-user data consumption.

None of this is recorded. Not "anonymized", not "aggregated", not "kept for 30 days": not recorded at all, anywhere.

What I know about you

A public key and an expiry date. That is your entire customer file.

Your key is generated by the app, on your device, with no name, no email, no sign-up. When you open Warren, the server checks one thing only: does this key have time left? A copy of the subscriber database would give access to no identity, because it contains none.

What is stored, and why

Here is everything that exists on my side, or with our processors:

• A minimal billing register (amounts, dates, payment references): an accounting and tax obligation. It contains no key, no name, no email.
• With the payment processor (Stripe for cards): the usual banking data of a purchase. It never crosses paths with your key: the payment credits a code, which your app later exchanges for time. That missing link is the plan.
• If you exercise your right of withdrawal: the payment reference you give me, and the status of the request. Nothing else.

What about auto-renewal?

Auto-renewal is an option, off by default. It is driven by your app, not by my servers. The charge authorization lives encrypted on your device: between two payments, my database contains nothing saying you auto-renew. You leave exactly the same traces as someone buying again by hand every month.

This is a problem our friends the other VPNs had not solved. Mullvad removed subscriptions in 2022 because running them forced its server to keep the link between your payment and your account for the whole life of the subscription. IVPN and Proton offer them, but keep the billing mandate on their servers. Here in the warren, that link never exists server-side: it lives in your app, and it disappears when you turn it off.

The three levels of discretion remain:

• Cryptocurrency or voucher: maximum anonymity. No exploitable link, and therefore no auto-renewal possible: at this level of discretion, I cannot even recognize you to bill you.
• Bank card, with or without auto-renewal: Stripe sees a payment toward a random purchase reference, never your key. The link between a payment and the code it credits only exists for the refund window (20 days), then it is severed. Enabling auto-renewal adds nothing to what I store.
• Purchases through Apple or Google: the store is the merchant and sees your purchase; it never sees your Warren key, and the technical link is severed after the store refund window.

Servers without disks

The exit servers run on an immutable system image, entirely in RAM: the root filesystem is read-only, state lives in memory, a reboot erases everything. Even port-forwarding allocations live only in memory.

The tool that builds these machines is called alpineAnywhere. I developed it and published it as open source: you can verify exactly what is running.

The one exception, and I lay it out

There is one place where I count something. When a third party reports abuse coming from a port you opened, I close that port and record a strike against the account that held it. Three strikes within 90 days and the account loses access.

That counter holds your account identifier, a number, and the category of the last report. No destination, no port, no timestamp, no history. It lives in memory and disappears on every restart. It answers no question about what you did, and it lets me answer a hosting provider threatening to cut me off.

This is the price of port forwarding. Mullvad and IVPN preferred to drop the feature in 2023 rather than count anything. Respect. I chose to keep it and to tell you exactly what it 'costs'.

What if an authority comes asking?

An authority can demand what I hold. The answer will always fit in two columns: a public key, an expiry date. I cannot hand over what I never collected.