LEGAL

Privacy Policy

Last updated: 30 October 2026

WARREN is built self-contained. Your site's security data — the requests it logs, the IPs it bans, the devices it fingerprints — lives inside your own WordPress database. We never receive it. This page explains exactly what that means, and the short list of things that do leave your site.

THE SHORT VERSION

Your security logs never reach us. The only data WARREN sends out is a one-time license check, plus a few optional lookups you turn on yourself. We don't sell your data, run ad trackers, or build a profile of you. That's the whole story — the detail below just proves it.

1. Who we are

"WARREN," "we," and "us" refer to WARREN.HELP, the maker of the WARREN WordPress security plugin. This policy covers both the warren.help website and the WARREN plugin you install on your site. If you have a question, email support@warren.help.

2. What the plugin keeps on your site (and we never see)

Everything WARREN detects is stored in a table in your own WordPress database (wp_devintel_events) and shown only in your own admin dashboard:

Request logs and the IP addresses of visitors and attackers
Recon/scanner events, ban lists, and security alerts
Device fingerprints (Premium), used to link one attacker across many IPs

This data stays on your server. We have no console, no central database, and no way to read it. When you delete the plugin, its uninstaller removes this data from your site.

3. The only data that leaves your site

This is the complete list — nothing else is sent anywhere:

License activation (one time). When you enter your license key, WARREN sends that key and your site's domain to license.warren.help so we can issue a license locked to your one site. After that, the plugin verifies your license offline and does not phone home again.
Shared threat feed (Premium, optional). If you turn it on, your site periodically downloads our hosted list of known-bad networks. It's an ordinary file download; we log only standard web-server request metadata (your server's IP, time).
IP geolocation (only when you click "Scan"). The specific IP you choose to scan is sent to a third-party geolocation service to look up its country and network. Nothing is sent unless you click Scan.
AI threat verdicts (only if you enable them with your own key). If you add your own OpenRouter API key, the data you choose to analyze is sent to OpenRouter under your account, governed by their terms. WARREN ships no AI key and sends nothing to any AI service by default.

4. The warren.help website

When you visit warren.help, our web server keeps standard access logs (IP address, browser user-agent, pages requested, timestamps) to run the site and protect it from abuse. We keep cookies to what's needed for the site to work. We do not run third-party advertising trackers.

5. Payments

Purchases are processed by Stripe. We never see or store your full card number — Stripe handles that directly, under Stripe's privacy policy. From a purchase we receive only what we need to deliver and support your license: your name, email address, and order details.

6. Email and your license key

We use your email address to send your license key, to notify you of important security updates to the plugin, and to answer your support requests. We will not sell or rent your email address, and we won't send you marketing you didn't ask for.

7. Data retention and your rights

We keep your license and order records for as long as your license is active and as required for tax and accounting, then delete them. You can ask us at any time to show you the data we hold about you, correct it, or delete it (where we're not legally required to keep it) — just email support@warren.help.

8. Changes to this policy

If we change this policy in a way that matters, we'll update the date above and, for material changes, tell active customers by email. Continuing to use WARREN after a change means you accept the updated policy.

9. Contact

Questions about privacy or your data: support@warren.help.