Read this document to understand how Brave Software (“us”, “we”, “Brave”, etc.) use personal data to operate its websites, forums, communications and the Brave Merch Store. To learn how we use data for the Brave Browser, see the Brave Browser Privacy Policy. To learn how we use data for publishers and creators, see the Publisher Privacy Policy.
Infrastructure
Brave websites are hosted on infrastructure we operate, and on infrastructure operated on our behalf by Amazon, Heroku (a Salesforce company), and Fastly. Fastly’s infrastructure is designed to be as close to you as possible — probably in the same country as you, though this is not guaranteed. The rest of this infrastructure is located in the United States, which is where information is processed and stored only for as long as necessary in order to provide services to you and support Brave in doing so. We take a range of technical and organisational measures to safeguard any personal data processed including the use of EU standard contractual clauses. Wherever possible we try not to process personal data. See data processing details.
Community forums
Brave provides two forums by which you can post feedback and comments on Brave’s services and publicly communicate with other Brave users - community.brave.com and forum.batcommunity.org. While Brave runs these forums, they are hosted on our behalf by the platform provider, Discourse.
Use of our forums is subject not only to Brave’s privacy policy but also that of Discourse. In a nutshell, your personal data will be used to operate and improve the forum and to provide customer service and support. Please do read the privacy policies.
We automatically capture and keep the IP address of all server requests but for no more than 30 days. You can access or delete your forum account (and related data) in the “preferences” panel at community.brave.com. See data processing details for more information about what data we use and why.
BAT Ambassadors
BAT Ambassadors is a volunteer-based program that champions Brave’s Basic Attention Token, and fosters communities of BAT fans worldwide.
Individuals who want to become BAT Ambassadors must apply by completing our interest form. You will need to provide a range of personal information, which we will use to assess your goals and better serve you as a program volunteer. Please see below for the type of information we collect, its purpose, and how long we keep your data. See data processing details for more information about what data we use and why.
Brave Merch Store
When you buy from the Brave Merch Store, Brave and third parties acting on our behalf will process personal data such as your name and address, contact details, and payment information, to process orders and payments and to provide support to you. Data is held in the USA.
We process payments via the Stripe payment system to make paying for items as simple and frictionless as possible. Those payments are subject to Stripe’s Terms and Privacy Policy. To fulfil orders, including printing, packing, and shipping items, and managing any returns, we use the third-party merch management platform Printful who act on our behalf.
See the Brave Merch Store data processing table for more information about the use of your personal data.
Advertising Brave to people using Facebook, Google, and X (formerly Twitter)
Brave uses Facebook, Google, and X (formerly Twitter) ads to attract new users. Brave does not track people on Facebook, Google, or X, or use any kind of in-app or Brave-server post-install tracking. See data processing detail. These ads link to pages on a separate website run by a company called Unbounce on Brave’s behalf, on servers based in the EU. See data processing details.
Children
Children under the age of 131 are not permitted to use the website, sign up for email updates, join the community forum, or send Brave any other information. If you have reason to believe that a child under the age of 13 has interacted with the website, please contact privacy@brave.com. In that case, we will do our best to remove all related records.
Support
You can submit a support enquiry to Brave by clicking here: https://support.brave.com/hc/en-us/requests/new. We use an online ticketing system from Zendesk to help us manage our support to you. The information you provide will only be used to resolve your enquiry.
What personal data we use and why
Users of Brave websites
| Purpose of processing | Categories of personal data processed | Legal basis of processing | Duration of storage |
| To provide efficient access to Brave websites on the Internet | IP address, user agent | Our interest in providing a fast-loading website. The data are used in a way that does not negatively affect your rights or interests. | Cloudflare DNS2 log is 1 week. Fastly3 only logs aggregated data unless an IP address is suspected of security threat. |
Users of the Brave or BAT Community forums
| Purpose of processing | Categories of personal data processed | Legal basis of processing | Duration of storage |
| To operate the forum, including improving it based on feedback and use. | IP address, user agent (version number of your operating system version and browser), community pages visited, incoming and outgoing links, reading times per post, user profiles viewed, likes given and flags being requested, registration IP addresses, posts that you write, pseudonym or real name, profile photo | Necessary for the performance of a contract between us (and necessary for us to provide the requested service). | The time necessary to deliver the requested service. |
| To send user-requested notifications or respond to user questions | E-mail address, pseudonym or real name | Necessary for the performance of a contract between us (and necessary for us to provide the requested service). | The time necessary to deliver the requested service. |
| To provide customer service and support | IP address, user agent (version number of operating system version and browser), community pages visited, incoming and outgoing links, reading times per post, user profiles viewed, likes given and flags being requested, registration IP addresses, posts that you write, pseudonym or real name, profile photo | Necessary for the performance of a contract between us (and necessary for us to provide the requested service). | The time necessary to deliver the requested service. |
| To display ongoing community conversations that include posts from members who have left the community. | Posts by former members (these may no longer be personal data because once user name is removed the former user may no longer be identifiable) | Our interest in maintaining an unbroken community conversation. The data are used in a way that does not negatively affect your rights or interests. | Until the forum closes. |
Applicants for BAT Ambassadors program
| Purpose of processing | Categories of personal data processed | Legal basis of processing | Duration of storage |
| To consider applications | Full name, email address, social media usernames | Legitimate interests—it is necessary for Brave to process the personal data to provide the service | Data will be held for 6 months for unsuccessful applications in order to consider future openings for the program |
To operate the BAT Ambassador Program:
|
Full name, email address, social media usernames, languages, skills or talents, country where based | Legitimate interests—it is necessary to fulfil participation in the program | We will delete data after 6 months of an Ambassador’s registration becoming inactive, or after an Ambassador chooses to leave the program |
Brave Merch Store
| Purpose of processing | Categories of personal data processed | Legal basis of processing | Duration of storage |
| To process and deliver orders. | First and last name; full postal address; email address; telephone number; order number. Recipients name if different from the person placing an order. |
To fulfil the contract between Brave and the Customer. | Email address and telephone number are deleted after 180 days. The remaining data is pseudonymised after 180 days & stored for 10 years. (to meet legal obligations). |
| To provide customer support. | Name, email address, Order number; telephone number if provided. | Legitimate interests of Brave and customers to resolve enquiries related to orders placed with the store. | 2 years from the closure of a ticket. |
| To process payments for orders placed and/or returned. | Depending on the payment method selected: full name; email address billing address; payment information (such as credit card or crypto payment address). | To fulfil the contract between Brave and the Customer. | The main payment provider used on the Brave Merch Store is Stripe. Please see the Stripe Terms and Privacy Policy. Stripe will retain data for 5 years. Brave will have access to payment data supplied to Stripe (except the credit card verification code - CVC) for a period of 15 months, to arrange refunds and provide customer support. |
| To meet legal obligation to retain information relating to payment of taxes and accounting practices. | Full name; postal address; order number. | To fulfil a legal obligation. | The data is pseudonymised after 180 days & stored for 10 years. |
Advertising Brave to people using Facebook, Google, and X (formerly Twitter)
| Purpose of processing | Categories of personal data processed | Legal basis of processing | Duration of storage |
| To market Brave to prospective users who use Facebook and Google websites and apps. | For Facebook: Facebook ID (not available to Brave, and used by Facebook for people logged in to Facebook), actions on Facebook, location, age, gender, previously visited website, device details. For Google: Google ID (not available to Brave), keywords used in searches, and interests determined by Google based on what the person has done and browsed (“affinity audiences” and “custom intent audiences”). | Legitimate interest. Brave’s interest is to attract users, and to defend those users’ privacy over the long term. Everybody has an interest in gaining protection from tracking. Therefore, Brave uses advertising on Facebook and Google to offer its service to people whose privacy and data rights are currently unprotected. | Brave does not receive or store data. Google or Facebook store the data until the user deletes their Google or Facebook account. |
| To market Brave to prospective users using variations of landing pages that cater to their interests. | Unique ID assigned by Unbounce, unique ID assigned by Facebook, referral URL. Country/region, timezone, operating system, device, browser, ID, IP address, timestamp, page variant visited. | Legitimate interest. This might seem unusual, but consider the following. Brave’s interest is to attract users, and to defend those users’ privacy over the long term. Everybody has an interest in gaining protection from tracking. Therefore, Brave uses advertising on Facebook and Google to offer its service to people whose privacy and data rights are currently unprotected. | Unbounce stores the data for 184 days. |
Research and product development, including related surveys
| Purpose of processing | Categories of personal data processed | Legal basis of processing | Duration of storage |
| To receive user testing responses (from survey and tests in person) | Name, contact details, responses to survey questions about use of Brave Browser | Consent | 1 year |
| To send Brave Beta Testers new software | E-mail address, Name | Consent | The duration of a person’s participation in Brave Beta Testing |
Support/General Correspondence/competitions
| Purpose of processing | Categories of personal data processed | Legal basis of processing | Duration of storage |
| To respond to requests for customer support | IP address, email address, data submitted in a support request | Legitimate interests of Brave and the customer | The time needed to resolve the customer support query |
| To run occasional contests | E-mail address, IP address | Consent | The duration of an individual contest. |
| General correspondence | Data sent by the person communicating. | Our interest in correctly responding to users, and maintaining good relations with them. The data are used in a way that does not negatively affect your rights or interests. | Indefinite. |
Contacting Brave about your personal data and privacy rights
To contact our data protection officer and privacy team with privacy related enquiries, or to exercise your data protection and privacy rights, email privacy@brave.com.
It’s Brave’s policy to not collect personal data4 unless it’s necessary to provide services to our users, or to meet certain legal obligations. We do not buy or sell personal data about consumers.
Where we process personal data about you (subject to laws such as the EU General Data Protection Regulation (GDPR), or California privacy laws such as the CCPA or CPRA), you have the following rights:
- Right to be informed: You have the right to know what personal data we process about you and why, together with information about your rights. We explain this via our product privacy policies and/or contextual privacy notices.
- Right of access: Where we process personal data about you, you have the right to request a copy of it.
- Right to delete: When certain grounds apply, you can ask us to delete personal data we are processing about you. Please note, we have a separate global policy for Brave Search results and the right to be forgotten.
- Right to rectification: You can ask us to correct inaccurate personal data and/or to update incomplete data.
- Right to restriction: In certain circumstances, you can request that we refrain from processing your personal data.
- Right to object: In certain circumstances, you can object to the processing of your personal data (for example to object to the use of your data for profiling and/or purely automated decision making). Please note that we do not buy or sell personal data about consumers.
- Right to data portability: In certain circumstances you have the right to request and receive personal data in a structured, commonly used, machine readable format that makes it possible to reuse the data. Please note, anonymous data is not subject to this right.
- Right to lodge a complaint with a regulatory authority: Brave is based in the USA. The authority to lodge a complaint about Brave will depend on where you live. If you’re in the EU you can contact our nominated representative under the General Data Protection Regulation (GDPR), or you can complain to the Irish Data Protection Commissioner. If you’re in the UK you can complain to the Information Commissioner’s Office. If you’re in California you can complain to the California Privacy Protection Agency.
For EU residents, we have appointed a nominated representative under the GDPR to act on our behalf regarding GDPR compliance. You may contact our nominated representative if you wish; however, the representative will refer enquiries to Brave’s data protection officer for consideration.
Our EU nominated representative is:
Brave EU Nominated Representative
Care of Castlebridge
New Work Junction
Clonard, Wexford
Ireland
We’ll update this policy whenever we make material changes to our practices, and we’ll announce it to let you know.
-
Some countries in the European Union have defined a child as any person under the age of 13. This varies from country to country, as provided for in Article 8(1) of the General Data Protection Regulation (GDPR). This policy uses the lowest age for consistency. ↩︎
-
The Domain Name Systems (DNS) translates domain names such as Brave.com in to the IP addresses that web browsers use. Cloudflare is our DNS provider. See https://www.cloudflare.com/learning/dns/what-is-dns/. ↩︎
-
Content Management Networks (CDNs) attempt to speed up websites by using servers near to the user requesting the site. Fastly is our CDN provider. See https://www.fastly.com/solutions/digital-publishing. ↩︎
-
Personal data means any information that relates to an identified or identifiable living individual. In the USA, this is often referred to as Personal Information (PI) or Personally Identifiable Information (PII). These terms are equivalent but not identical.
This can include information that can directly identify an individual—such as name or email address—and any other information that may make a person indirectly identifiable—such as online identifiers that could be combined with other data to identify an individual, or used on their own to single out individuals and distinguish one person from another with an intent to learn something about them or to take an action towards them. ↩︎
