# Security & Privacy Scorecard

## Brave Private Web Browser, VPN

**Version:** 1.85.120 (Chromium 143.1.85.120)  
**Scan Date:** 2026-02-06  
**Platform:** Android

## What This Means for You

The device connects to Google's infrastructure through several built-in Google services, including location, sign-in, and vision APIs. Firebase components report installation and usage data back to Google. The VPN feature uses WireGuard, but overall data exposure to Google is significant despite the browser's privacy branding.

## Recommendation: Use With Caution

**Best For:** Ad-blocking users comfortable with Google services  
**Avoid If:** Those trying to avoid Google's data ecosystem

## Key Findings

**Data Security** - 2 findings (1 critical, 1 high)

**Network Security** - 2 findings (1 critical, 1 medium)

**Code Safety** - 0 findings

**Privacy** - 7 findings (1 critical, 6 high)

## Privacy Concerns

### What Data is Collected

The app collects location data, sign-in information, and usage patterns through multiple Google services embedded in its core functionality. Firebase components gather device identifiers and report installation events. Google Play Billing monitors in-app purchase activity.

### Third-Party Data Sharing

User data is shared with the following third-party services:

- Firebase Cloud Messaging
- Firebase Installations
- Google DataTransport
- Google Play Services Cast
- Google Play Billing
- Google Location Services
- Google Sign-In API
- Google Vision API
- Google Safe Browsing
- WireGuard VPN

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 65/100 |
| Privacy | 60/100 |
| Data Security | 65/100 |
| Network Security | 70/100 |
| Code Safety | 85/100 |
| Data Collection | 65/100 |
| Data Sharing | 60/100 |
| User Control | 75/100 |

## Positive Security Features

- The VPN feature is built on WireGuard, a modern protocol with a strong security design.
- Google Safe Browsing integration helps shield browsing from known harmful sites.

## Areas for Improvement

- Connections to Google services run throughout the app, sharing usage data with Google even during private browsing sessions. Reducing these integrations would bring the app closer to its stated privacy goals.
- Network activity reaches multiple Google-operated servers in ways that are not always easy to disable, limiting how effectively users can keep their browsing patterns private.
- Location, sign-in, and usage data flow across several Google services simultaneously, meaning a single company has a broad picture of user activity despite the app's privacy positioning.

---

## About This Analysis

This scorecard is based on static analysis of the app as distributed on the scan date. Results reflect the app's code and configuration at that point in time and do not cover server-side behavior.

### App Details

- **App Name:** Brave Private Web Browser, VPN
- **Package ID:** com.brave.browser
- **Version:** 1.85.120 (Chromium 143.1.85.120)
- **Scan Date:** 2026-02-06