Brave Leo does not store your conversations, does not log your IP address, and does not use your prompts to train AI models.
Queries are routed through an anonymous reverse proxy, and responses are discarded immediately after delivery.
If you use Leo Premium, your subscription is validated through unlinkable tokens, so Brave cannot connect your payment details to what you ask.
That is the short version.
But “we don’t collect your data” is easy to say. Every AI company says it.
The more useful question is: what does Brave actually do differently at a technical level, and where do the privacy guarantees end?
I have been using Brave as a secondary browser for about two years, and I switched Leo on the month it launched on desktop.
I am not a Brave evangelist. I still use Chrome for most of my work.
But I pay attention to how AI assistants handle data because I write about these tools every week, and the gap between marketing language and actual architecture matters more than most people realize.
What Brave Leo Sends to Its Servers
Every time you type a prompt into Leo, your query and the conversation context travel to Brave’s backend servers.
If you ask Leo to summarize a webpage, it also sends the page content (or the text you have highlighted).
If you use the tab organization feature, it sends the titles and URLs of your open non-private tabs.
That part is unavoidable. Leo is not running models locally on your machine (with one exception I will get to). Your prompts have to reach a server to get a response.
But here is where Brave’s approach differs from ChatGPT or Copilot: all requests pass through an anonymizing reverse proxy before they reach the AI model.
The proxy strips your IP address from the request, so the server processing your query cannot link it back to you.
Brave’s privacy policy puts it directly: “We do not collect identifiers such as your IP Address that can be linked to you.”
After the model generates a response, both your prompt and the response are discarded.
Brave says it may cache large prompts for performance, but those caches are deleted within minutes.
The Privacy Architecture, Explained Simply
Three mechanisms do the heavy lifting:
1. The reverse proxy. Your prompt goes to an intermediary server first. That server strips identifying information before forwarding the request to the AI model. The model never sees who you are.
2. No server-side storage. Brave does not keep conversation logs. There is no dashboard where a Brave employee could pull up your chat history, because the history does not exist on their servers. If you enable local chat history, that is encrypted and stored on your device only.
3. Unlinkable tokens for Premium. This is the piece most people skip over. When you subscribe to Leo Premium ($14.99/month), Brave issues cryptographic tokens that prove you have a valid subscription without revealing who you are.
Your payment information and your Leo usage are two separate, unconnected systems. Brave cannot tell which queries came from which paying customer.
Compare that to ChatGPT, where your account, payment method, conversation history, and usage patterns are all tied to one identity.
Or to Microsoft Copilot, where your queries feed into a Microsoft account that is connected to your email, documents, and browsing history.
What Data Leo Actually Collects (the Non-Zero List)
“We don’t collect your data” is not quite the full picture.
Brave does collect some metadata, but they use privacy-preserving aggregation protocols called STAR and Nebula to do it.
What they gather through these protocols:
- The broad category of your query (not the query itself)
- The language your query is written in
- Which AI model you used
That is aggregate, non-identifying data. They cannot trace any of it back to a specific user. They use it for product decisions, like figuring out which models are most popular or which languages need better support.
What they explicitly do not collect:
- Your IP address
- Your prompts or responses
- Your browsing history
- Any link between your subscription and your queries
The New TEE Layer: Cryptographic Proof of Privacy
In 2025, Brave started rolling out something more ambitious: Trusted Execution Environments (TEEs) for AI inference.
Here is the idea.
Even if you trust Brave’s privacy policy today, policies can change. Companies get acquired. Employees go rogue. Court orders happen. A written promise not to log your data is only as strong as the people keeping the promise.
TEEs solve this differently.
They use specialized hardware (Nvidia Hopper GPUs, in this case) to create isolated, encrypted computing spaces where even a compromised operating system cannot access the data being processed.
The model runs inside the TEE, your prompt enters encrypted, the response leaves encrypted, and the hardware itself generates a cryptographic attestation proving that the code running inside the TEE has not been tampered with.
Brave is doing this through a partnership with NEAR AI, and it is currently available in Brave Nightly with the DeepSeek V3.1 model. Early days. But the direction matters: it is a shift from “trust us” to “verify it yourself.”
The current limitation is real, though.
Right now, Brave performs the verification internally and displays a green “Verifiably Private” label.
Users cannot independently re-verify the attestation yet.
Brave says they plan to open-source the verification pipeline and let users confirm it themselves, but that has not happened as of this writing.
What Leo Can See When You Use It
Leo’s privacy story is about what happens to your data after it reaches the server. But Leo still has access to things on your end:
- Page content. When you ask Leo to summarize a page, it reads the full text of that page. If you highlight specific text, it reads that.
- Tab titles and URLs. The tab organization feature sends the titles and URLs of your open non-private tabs. It does not send the content of those tabs, but tab titles alone can reveal what you are working on.
- Conversation context. Each follow-up question includes the prior conversation so Leo can maintain context. The full thread travels to the server each time.
None of this is stored, per Brave’s policy. But it does leave your browser and reach a server. If your concern is “no data ever leaves my machine,” Leo’s default mode does not satisfy that.
Bring Your Own Model: The Actual Zero-Data Option
For users who want true local processing, Leo supports Bring Your Own Model (BYOM).
You can connect a local model running on your own hardware, and your prompts never leave your device at all.
This is the only configuration where “Brave sees nothing” is literally true.
But it requires you to run and maintain your own AI model, which is not practical for most people.
How Leo Compares on Privacy
I spend most of my workweek evaluating AI tools, so here is how Leo’s privacy model stacks up against the major alternatives:
| Feature | Brave Leo | ChatGPT | Claude | DuckDuckGo AI Chat |
| Trains on your data by default | No | Yes | No | No |
| Stores conversations server-side | No | Yes (30 days in temp mode) | Yes (account-tied) | No (deleted post-response) |
| Requires an account | No (free tier) | Yes | Yes | No |
| IP address logging | No (reverse proxy) | Yes | Yes | No (metadata stripped) |
| Payment unlinkable from usage | Yes (unlinkable tokens) | No | No | N/A (free) |
| TEE verification available | Yes (limited) | No | No | Yes (select models) |
ChatGPT is the weakest on defaults.
It trains on your conversations unless you manually disable it, and a 2025 court case demonstrated that retention policies can be overridden by legal orders regardless of what the privacy page says.
Claude is better. Anthropic does not train on conversations by default. But your chat history is tied to your account, and you need an account to use it.
DuckDuckGo AI Chat is the closest competitor to Leo on privacy.
It strips metadata, does not retain conversations, and has started offering TEE-backed models. But it is a standalone chat page, not a browser-integrated assistant that can read and summarize your current tab.
The Limitations Worth Knowing
Leo’s privacy model is strong, but it is not perfect. A few things to keep in mind:
Browser lock-in. Leo only works inside Brave. If you use one of the other top AI browsers for most of your browsing, you either switch browsers or you do not get Leo. There is no extension, no API, no standalone app.
Rate limits on free tier. Free users hit rate limits faster than you would expect during sustained sessions.
Brave does not publish exact numbers, but in my experience, a longer research session (10-15 back-and-forth exchanges) can trigger the limit. Premium removes this, but at $14.99/month, you are paying ChatGPT Plus prices.
No conversation memory across sessions. Every Leo session starts fresh. There is no persistent memory, no project context, no way to pick up where you left off. For quick questions and page summaries, this is fine. For ongoing work, it is a real limitation.
The privacy is contractual, not fully technical (yet). The TEE implementation is still in Nightly and only covers one model. For every other model, the privacy guarantee is “we say we don’t log your data.”
That is a corporate promise, not a mathematical proof. The STAR and Nebula protocols are a step up from most competitors, but they do not cover the core inference pipeline yet.
No enterprise tier. No team accounts, no admin controls, no SOC 2 compliance, no organization-level management. If you are evaluating this for a company, Leo is not ready.
The Models You Get
Leo offers a surprisingly wide selection for a browser-embedded assistant:
Free tier: Qwen 3 VL 30B, Claude 4.5 Haiku, Llama 3.1 8B, Llama 4 Scout, Llama 4 Maverick, GPT-OSS 20B
Premium ($14.99/month): Everything in free, plus Qwen 3 VL 235B, Qwen 3 Coder 480B, DeepSeek V3.1, Claude 4.6 Sonnet, Claude 4.6 Opus, Mistral Large 2407, Pixtral Large 2502, GPT-OSS 120B, Gemma 3 12B
All models run on Brave’s infrastructure or through zero-retention configurations with providers like AWS Bedrock.
Brave states that no data is shared with the model creators, regardless of which model you pick.
The Automatic Mode (launched spring 2025) routes your query to whichever model fits best. You can see which model was selected and switch manually if you prefer.
Is the Privacy Premium Worth $14.99/Month?
If your primary reason for choosing Leo is privacy, the free tier already covers the core protections: no IP logging, no conversation storage, no training on your data, reverse proxy anonymization.
Premium gets you higher rate limits, access to stronger models (Claude Opus and Sonnet, the larger Qwen models), and faster responses.
The privacy protections are identical across both tiers.
At $14.99/month, Leo Premium costs the same as ChatGPT Plus but gives you fewer features (no image generation, no custom GPTs, no persistent memory). What it gives you instead is a privacy model that ChatGPT does not offer at any price tier.
Whether that trade-off works depends on what you need.
For quick research, page summaries, and coding help inside a privacy-first browser, Leo is hard to beat.
For deep, multi-session work that requires persistent context, you will probably keep a ChatGPT or Claude subscription alongside it.
FAQs
Does Brave Leo store my conversations?
No. Brave Leo does not store conversations on its servers. Responses are discarded immediately after generation. If you enable local chat history in settings, that data is encrypted and stored on your device only, not on Brave’s infrastructure.
Can Brave see what I ask Leo?
Your prompts pass through Brave’s anonymizing reverse proxy, which strips your IP address before the query reaches the AI model. Brave states it does not log prompts or responses. The prompts do travel through Brave’s servers, but they are not stored or linked to your identity.
Does Brave Leo use my data to train AI models?
No. Brave explicitly states that conversations are not used for model training, and no personal data is retained by Brave or any third-party model providers.
Is Brave Leo free to use?
Yes. The free tier includes access to several models (Qwen 3, Claude 4.5 Haiku, Llama 3.1, Llama 4) with rate limits. Leo Premium costs $14.99/month or $149.99/year and adds stronger models, higher limits, and early feature access.
How is Brave Leo different from ChatGPT on privacy?
ChatGPT trains on your conversations by default (you can opt out), stores conversation history tied to your account, and logs your IP address. Brave Leo does none of these things.
Leo also does not require an account for free use, and Premium subscribers get unlinkable tokens so their payment cannot be connected to their usage.
