Privacy Policy
Warrenet is built so that we don’t need your data. This policy explains the little we handle, and what stays with you.
Last updated: October 28, 2026
In short
- We never see your internet traffic. Warrenet doesn’t operate VPN servers. Your traffic goes from your device to a server in your own cloud account.
- There is no Warrenet account. The app contains no analytics, advertising, or crash-reporting code, and sends nothing to us on its own.
- Your keys stay with you. Cloud sign-in tokens, server credentials, and settings are stored on your devices and, if you turn on iCloud sync, end-to-end encrypted in your own iCloud account.
- We don’t sell or share personal information, and we have none to sell.
This policy covers the Warrenet apps for iPhone, iPad, and Mac, the sign-in service at auth.warrenet.com, and this website. Warrenet is provided by RandomRabbits LLC (“we”, “us”), based in Washington, USA.
What stays on your device
Warrenet keeps the following on your device. We have no access to it.
| Information | What it is | How long it stays |
|---|---|---|
| Server connection settings, routing rules, DNS servers | What the app needs to connect to your servers | Until you delete the server or the app |
| Cloud sign-in tokens and server SSH keys | Stored in your device’s Keychain | Until you disconnect the provider, delete the server, or delete the app |
| Usage statistics | Daily totals of data sent and received, by route and server. No websites or destinations. | 30 days |
| Traffic captures | Only when you start one: connection and DNS details such as host names, IP addresses, ports, times, and byte counts. Never the contents of your traffic. | Up to 10 captures and 10 MB in total; you can delete them at any time |
| Diagnostics | A record of app and VPN events, with known credentials removed | Up to 7 days |
Like other app data, this information can be included in your device backups. It leaves your device only if you export it yourself, for example to send us a diagnostics report.
Your VPN server
Your server runs in your cloud account, and you control it. We have no access to it.
- Your traffic passes through your server. Websites and services you reach through the VPN see your server’s address instead of your device’s.
- Your server doesn’t log the sites you visit. Its VPN software keeps no connection log, only an error log for problems, and the server keeps the ordinary system logs any server does. These stay on your server and are deleted with it. Warrenet never collects them; they leave your server only in a diagnostics report that you export yourself.
- Health checks. While you’re connected, the app checks each of your servers about every five minutes by loading a small test page from Google (
www.gstatic.com) through that server. Google sees the request come from your server’s address. - Setup. While a new server sets itself up, it downloads software from GitHub and Ubuntu, and contacts RIPEstat and your cloud provider’s services to configure itself.
Your cloud provider
When you connect a cloud account, you sign in on the provider’s own website. The app then talks to the provider directly from your device to create and manage your servers. The provider hosts your server and handles its network traffic, as any hosting company does, under its own privacy policy: see DigitalOcean’s, Akamai’s, and Vultr’s.
Links in the app for creating a provider account can be referral links, for which we may receive credit from the provider.
The sign-in service
Some cloud providers require a server to complete sign-in. Our sign-in service at auth.warrenet.com does only that: it receives the provider’s one-time authorization, turns it into sign-in tokens, and passes them to your device.
- It never stores your tokens. Renewing a sign-in for some providers also passes through the service, again without anything being stored.
- For each sign-in, it keeps a short record for up to 10 minutes: a random reference, one-way hashes of the values that link your browser to your device, and the provider’s authorization code, encrypted and erased once used. Encrypted copies of expired records can remain in database backups until those backups expire.
- It doesn’t store or log your IP address. To limit abuse, it keeps a keyed one-way hash of your network address for rate limiting, and deletes these entries as they expire.
- Its logs record only the type of event, such as a completed sign-in. No addresses, tokens, or codes.
The service runs on DigitalOcean in the United States.
Apple services
- Purchases. Your subscription is sold and billed by Apple. We don’t receive your payment details. The app checks your subscription on your device, and we receive Apple’s standard sales reports, which don’t identify you.
- Crash reports. If you’ve chosen to share analytics with app developers in your device’s settings, Apple may send us crash reports for Warrenet. Apple doesn’t include information that identifies you.
- iCloud sync (optional). When you turn it on, Warrenet stores your servers (with their connection credentials and SSH keys), your custom rules, a backup of each device’s settings, and a list of your devices in your private iCloud database. The contents are end-to-end encrypted with keys from your iCloud Keychain, so neither Apple nor we can read them. Apple can see limited details, such as how many records there are, their names (which include your cloud provider and its ID for each server), and when they changed. Cloud sign-in tokens, usage statistics, captures, and diagnostics are never synced. You can remove everything from iCloud in the app with Remove iCloud Data.
DNS
To look up website addresses, Warrenet uses Cloudflare (1.1.1.1) and Google (8.8.8.8) by default. These resolvers receive the names being looked up, under their own privacy policies. You can choose different DNS servers in the app.
Traffic that skips the VPN
Traffic matched by a direct routing rule, such as your local network, a country preset, or a rule you add, leaves your device directly, as it would without a VPN.
If you email us
When you email support, we receive your email address and whatever you send, including any diagnostics report you attach. We use it only to answer you, keep it only as long as we need to for that, and delete it on request. Our email providers process these messages on our behalf.
This website
This website sets no cookies, runs no scripts, and loads nothing from other companies. It is hosted by Cloudflare, which processes visitors’ requests, including IP addresses, to deliver and protect the site, and gives us aggregate traffic statistics that don’t identify anyone.
Children
Warrenet is not directed to children under 13, and we don’t knowingly collect information from them.
Your choices
- Delete servers, captures, and other data in the app, or delete the app to remove its data from your device.
- Turn off iCloud sync and choose Remove iCloud Data to delete what’s stored in iCloud.
- Disconnect a cloud provider in the app, and revoke Warrenet’s access in your provider’s account settings.
- Contact us about any information we hold, which in practice means support emails.
Depending on where you live, you may have rights to access, correct, or delete personal information, or to object to its use. Because we hold almost nothing, most of this is in your own hands; for the rest, email us.
Changes
If we change how Warrenet handles information, we’ll update this policy and its date. We’ll tell you in the app or on this website before a significant change takes effect.
Contact
Questions about privacy: support@warrenet.com.