How we handle your data.
Brale Analytics is built with privacy by design. We use a tiered collection model that automatically adjusts based on where you are and what you're doing — no cookie banner needed.
Two modes, automatic switching
Your experience depends on context and location. On regulated financial service domains (brale.com, brale.xyz), device analysis and session integrity are required for jurisdiction verification and fraud detection — these are legal prerequisites to providing the service. On other surfaces, EU/EEA/UK/Swiss visitors automatically get our privacy-safe lite mode.
Lite Privacy mode
EU/EEA/UK/CH visitors on non-regulated surfaces
- No cookies or localStorage
- No cross-session tracking
- No device fingerprinting
- Country-level geo only
- Daily-rotating IP hash
- No behavioral biometrics
Full Standard mode
Non-EU visitors, regulated domains, or EU visitors who opt in
- Durable browser ID (localStorage + cookie)
- Session continuity across pages
- Device capability detection
- Precise geo (city-level)
- Behavioral signals (scroll, engagement)
- Identity resolution
What we never do
- Sell, rent, or share personal data with third parties
- Track you across unrelated websites
- Store keystroke content, mouse coordinates, or form values
- Use advertising IDs or ad-tech integrations
- Retain raw IP addresses beyond 5 years
Legal basis
Regulated domains (brale.com, brale.xyz): Brale is a FinCEN-registered MSB. Device analysis, IP geolocation, and session integrity are strictly necessary for jurisdiction verification (state MTL licensing, OFAC/SDN screening) and BSA/AML fraud detection. These are regulatory prerequisites — the service cannot be legally provided without them (ePrivacy Art. 5(3) strictly necessary exemption).
Lite mode (EU visitors on non-regulated surfaces): No cookies or terminal storage are accessed, so the ePrivacy consent requirement is not triggered. Server-side processing of HTTP metadata operates under GDPR Art. 6(1)(f) legitimate interest. No individual profiling is possible.
Full mode opt-in: EU visitors on non-regulated surfaces can consent to full analytics via the button below (GDPR Art. 6(1)(a)). For non-EU visitors, other applicable privacy laws may govern (e.g., CCPA in California).
DNT: We honor Do Not Track headers voluntarily. If your browser sends this signal, device fingerprints and behavioral data are stripped regardless of mode.
GPC: We honor Global Privacy Control signals. In California (CCPA §7025) and 10+ US states, this is a legal requirement — your opt-out preference is processed automatically.
Contact
Questions about data practices or to exercise your rights: legal@brale.xyz
Full privacy policy: brale.xyz/legal/privacy