Reports and requests

The company warrenBrowse is being incorporated. Until it is registered, the responsible entity is referred to in this document as "the Warren team".

This page is addressed to rights holders, hosting providers, security teams and authorities. It describes what the Warren team can do when you report abuse to it, what it cannot do, and why.

The Warren team answers every admissible report within 24 business hours.

Abuse reports: abuse@warrenbrowse.com

Authorities: legal@warrenbrowse.com (section 6)

1. What Warren is, technically and legally

Warren is a virtual private network. The traffic of the Warren team's users crosses its exit servers encrypted, and leaves for the Internet under the server's IP address.

Warren provides a mere conduit service within the meaning of Article 4 of Regulation (EU) 2022/2065 on digital services, a category that recitals 28 and 29 of that regulation name explicitly for virtual private networks. In the United States this corresponds to transitory digital network communications under 17 U.S.C. § 512(a).

Concretely:

the Warren team does not initiate the transmissions;
it does not select their recipients;
it neither selects nor modifies the information transmitted;
it hosts no content carried through the tunnel.

The support forum (forum.warrenbrowse.com) is a separate service: it hosts the posts its users publish there. Illegal content posted on the forum is reported to contact@warrenbrowse.com, and the Warren team can remove it.

2. What the Warren team cannot do

The Warren team cannot take down any content carried through the tunnel. A tunnel stores nothing. No copy of what crosses its servers exists on them, so no takedown is materially possible. A notice-and-takedown procedure has no object here.

Outside port forwarding, the Warren team cannot link an IP address and a time to an account. Its servers process the IP address, the DNS queries and the state of the connections in memory, for the duration of the connection, and keep no record of them linked to an account. Its exit servers run with no disk. A request about an exit IP address and a timestamp therefore cannot be matched to an account, except in the forwarded-port case described in section 3.

This limit comes from the architecture, and no commercial decision can relax it case by case.

3. What the Warren team can do, and does

When a report targets a port opened through the port forwarding feature and that port is still open when the Warren team acts, the team has a real action available, and it takes it.

The Warren team closes the reported port, without inspecting traffic. The port then stays in quarantine for 48 hours on that exit server: nobody can take it back before then, its last holder included.
At that moment, and only then, it can identify the account that holds the port. When the app opens a port, it presents the exit server with an encrypted tag that only Warren's central server can decrypt. The exit server keeps that tag in memory while the port is open and hands it over only when the port is closed for abuse.
It records a warning against that account if the account already held the port at the incident time given in the report.
Three warnings within a rolling 90-day window lead to account revocation for 12 months. The account loses network access. A warning older than 90 days stops counting.
When the revocation ends, after 12 months or earlier if it is lifted after a contest, the Warren team deletes the revocation together with the account's expiry date. The account is left in the state of an account that never had any access time: its unused prepaid time was refunded pro rata at the revocation, under section 12 of the Refund Policy.
While the revocation is in force, no voucher and no purchase can credit the account. A voucher presented stays unused: its holder can redeem it when the revocation ends or have its payment refunded. An App Store or Google Play subscription renewed during the revocation is refunded, by Apple or by the Warren team depending on the store.
Every report is handled by a human, who decides to close the port. The revocation then follows automatically from the third warning.
The account holder sees every warning in the app, with its date, its category, the port concerned and the case reference, and can contest it (section 5).

Nothing links a port to an account before a report, and the Warren team keeps no list of the ports an account has held. Three cases produce no warning:

the port is no longer allocated when the Warren team acts: nothing is closed, and the port stays unavailable for 48 hours on that exit server;
the account holding the port obtained it after the incident time: the port is closed, and that account's tag is not decrypted;
no usable tag comes with the port: the port is closed, and the report is attributed to no account.

The following records are a bounded exception to the Warren team's no-logging commitment. They exist only after a report:

the report case: exit server, port, protocol, category, source of the report, ticket reference and dates. It holds no account identifier. It is kept for 12 months, then anonymised: the server, the port and the time are erased from it. While the revocation it led to is in force, it carries a seal linking it to that revocation, computed with a key that exists only inside the running server; the seal is deleted when the revocation ends;
the warning: a pseudonymous identifier derived from the account with a key that exists only inside the running server, the case reference, the category, the day, and a digest of the tag computed with that key, so that one tag produces only one warning. It is kept for 90 days;
the revocation: the account identifier, needed to enforce it, its dates to the day, its reason and the state of the refund. It is kept until it ends, after 12 months, or until it is lifted, then deleted together with the account's expiry date.

None of these records holds a destination, content, a source IP address or a connection history. They rest on the legitimate interest in network security and are declared in the Warren team's Privacy Policy. The unused prepaid time of a revoked account is refunded pro rata, computed on the day of the revocation; the beta is free and has none.

4. How to write to the Warren team

Send to abuse@warrenbrowse.com a message containing:

the IP address concerned and the port;
the date and time of the incident with the time zone: they determine which account held the port at that moment;
the nature of the abuse observed;
anything allowing the observation to be verified (log excerpt, headers).

The Warren team acknowledges receipt with a case reference and answers within 24 business hours. A report about a forwarded port that is still open, precise enough to be verified, leads to the port being closed.

5. Contesting a warning

Every warning appears in the app with its date, its category, the port concerned and the case reference. If you believe a warning or a revocation is a mistake, write to abuse@warrenbrowse.com quoting that reference. The Warren team re-examines the report behind the warning. A warning recorded in error is voided and immediately stops counting, and the revocation it caused is lifted.

6. Requests from authorities

Authorities send their requests to legal@warrenbrowse.com, the single point of contact under Article 11 of Regulation (EU) 2022/2065. Accepted languages: Romanian, English, French. European production and preservation orders (Regulation (EU) 2023/1543) are addressed to warrenBrowse SRL, whose registered address will be published here once it is incorporated; until then, to legal@warrenbrowse.com.

The Warren team checks the form and the authority of each request, answers it within the legal deadlines with the data it holds, and preserves the data covered by a preservation measure. It holds no traffic log, no connection log and no source IP log. It cannot link an exit IP address and a timestamp to an account, except for a forwarded port: the holder of a port that is still open can be identified, and a sanctioned account stays linked to its file (server, port, time) for the period stated in section 3 of the Privacy Policy. With its hosting providers, it assists targeted interception measures authorised by law. It informs the user concerned where the law allows.

The Warren team carries out no general monitoring and is not required to (Article 8 of Regulation (EU) 2022/2065).

An admissible request receives a reasoned answer. A request outside the legal forms, or seeking data the Warren team does not hold, receives an answer explaining why it cannot be satisfied.

7. Hosting providers

If you host the Warren team and receive a complaint about one of its addresses, forward it to abuse@warrenbrowse.com. It handles it directly and answers you.

The Warren team blocks outbound port 25 by construction on every exit server, and its port forwarding feature only assigns high ports (49152 to 65535), with a per account cap. No service can therefore be exposed on the usual infrastructure ports from its addresses.