Privacy Policy

Last updated: November 2026

1. Who We Are

Warren ("we", "our", "us") operates warrentunnel.online. We provide a QUIC-based reverse tunnel service. Contact us at hello@warrentunnel.online.

2. What Data We Collect

• Account data: Email address and Argon2id password hash when you register.
• Usage data: Tunnel token creation timestamps, last-used times, and tunnel counts for plan enforcement.
• Billing data: Plan tier and subscription status received from our payment processor (Polar). We do not store credit card numbers.
• Technical logs: IP addresses, request timestamps, and HTTP status codes in Caddy access logs (retained 30 days).

3. How We Use Your Data

• To provide and enforce plan limits on the tunnel service.
• To send transactional emails: account verification, password resets.
• To detect and prevent abuse (rate limiting, banned email domain blocking).
• We do not sell your data. We do not use it for advertising.

4. Data Retention

Your account data is retained until you delete your account. Access logs are automatically purged after 30 days. Financial records (plan changes, subscription events) are retained for 7 years as required by tax law.

5. Your Rights (GDPR)

If you are in the European Economic Area, you have the right to:

• Access: Request a copy of your personal data.
• Erasure: Delete your account from Dashboard → Settings → Danger Zone. This permanently removes all personal data, except financial records legally required for tax compliance.
• Portability: Contact us to export your data in JSON format.
• Correction: Contact us to correct inaccurate data.
• Objection: Object to processing for legitimate interest purposes.

To exercise these rights, email hello@warrentunnel.online.

6. Third-Party Processors

• Supabase — Managed PostgreSQL database (data stored in EU/US region). Privacy policy.
• Resend — Transactional email delivery. Privacy policy.
• Polar — Payment processor and subscription management. Privacy policy.

7. Cookies

Warren does not use tracking or advertising cookies. We use browser localStorage only to store your session tokens (access token, refresh token) for the duration of your logged-in session. These are cleared on logout.

8. Security

Passwords are hashed with Argon2id (64 MiB, t=3, p=4). All data in transit is encrypted via TLS 1.2+. Access to production infrastructure is restricted to authorized personnel.

9. Changes

We will notify registered users by email of material changes to this policy at least 14 days in advance.

10. Contact

Questions? Email hello@warrentunnel.online.