Last updated: 19 July 2026
This Privacy Policy explains how Brewser (“we,” “us,” “our”) collects, uses, and protects your personal data when you use the brewser.io website, the Brewser web platform, the developer portal, the catalogue, and the Brewser Homebrew Runtime (together, the “Services”). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Dutch law. This Policy forms part of, and should be read together with, our Terms and Conditions.
1. Who we are (Data Controller)
The data controller responsible for your personal data is the operator of the Brewser project, based in the Netherlands. For any privacy-related questions, requests, or complaints, you can contact us at info@brewser.io.
2. What data we collect
We aim to collect only what is necessary to operate the Services. Depending on how you use Brewser, we may process the following categories of data:
- Account data (via third-party sign-in): When you sign in with Google, we receive a unique account identifier (“sub”), your name, email address, and profile picture. We use this to identify you across the platform and on your Switch.
- Authentication tokens: A signed session token is issued when you sign in and, on the Switch, is stored locally on your console so applications can recognise you. This token contains your account identifier and basic profile fields.
- Publisher and submission data: If you submit applications, we process the content you upload, its manifest metadata (such as app name, ID, and author), and the account identifier associated with your submission.
- Usage and interaction data: We may record actions such as likes, saves, downloads, ratings, and leaderboard scores, associated with your account identifier, to operate those features.
- Technical data: Standard information automatically generated when you access a website, such as IP address, browser type, device information, and access timestamps, primarily for security, diagnostics, and abuse prevention.
- Communications: If you contact us, we process the information you choose to provide in your message.
We do not intentionally collect special categories of personal data (such as data revealing health, religion, or political opinions), and we ask that you do not submit such data through the Services.
3. How we use your data and our legal bases
Under the GDPR, we must have a lawful basis for processing your personal data. We rely on the following:
- Performance of a contract (Art. 6(1)(b)): To create and manage your account, authenticate you across platforms, process and publish your submissions, and provide features such as saves, leaderboards, and downloads.
- Legitimate interests (Art. 6(1)(f)): To keep the Services secure, prevent abuse and fraud, maintain and improve the platform, and understand aggregate usage. Where we rely on legitimate interests, we balance them against your rights and freedoms.
- Consent (Art. 6(1)(a)): Where required, for example for any non-essential cookies or optional communications. You may withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)): Where we must process data to comply with a legal requirement, such as responding to valid legal requests or takedown obligations.
4. Cookies and local storage
The Services use cookies and similar local-storage technologies. Strictly necessary cookies and storage are used to keep you signed in and to make core features work; these do not require consent. On the Switch, a local authentication record is stored on your console to maintain your session. If we use any non-essential or analytics cookies, we will request your consent through a cookie banner, and you can manage your preferences at any time. You can also control cookies through your browser settings.
5. How your data is shared
We do not sell your personal data. We share data only as necessary to operate the Services, including with:
- Identity providers: Google, when you choose to sign in, in accordance with their own privacy policy.
- Infrastructure and hosting providers: Services that host the website, store submissions, and support the platform (which may include code-hosting platforms such as GitHub used in our publishing pipeline).
- Other users, where you choose: Certain data is public by design — for example, a published application’s author name and metadata, or a name/score shown on a public leaderboard.
- Authorities or third parties: Where required by law, to enforce our Terms, or to protect the rights, safety, and security of Brewser, our users, or the public.
6. International data transfers
Some of our service providers (such as identity or hosting providers) may process data outside the European Economic Area (EEA). Where this occurs, we rely on appropriate safeguards recognised under the GDPR, such as European Commission adequacy decisions or Standard Contractual Clauses, to ensure your data receives an equivalent level of protection.
7. How long we keep your data
We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by law. Account data is kept while your account is active. Published submissions and their associated public metadata may remain available while published, and may persist in version history or backups after removal. Pending submissions in staging may be automatically purged after a limited period. Technical logs are kept for a limited time for security and diagnostic purposes. When data is no longer needed, we delete or anonymise it.
8. Your rights
Under the GDPR, you have the following rights regarding your personal data:
- Access — to obtain a copy of the personal data we hold about you;
- Rectification — to correct inaccurate or incomplete data;
- Erasure — to request deletion of your data (“right to be forgotten”), subject to legal limits;
- Restriction — to limit how we process your data in certain circumstances;
- Portability — to receive your data in a structured, commonly used format;
- Objection — to object to processing based on legitimate interests;
- Withdraw consent — where processing is based on consent, at any time, without affecting prior lawful processing.
To exercise any of these rights, contact us at info@brewser.io. We will respond within the timeframes required by law. Please note that some data — such as content already published publicly or distributed to other users — may not be fully recoverable or removable once shared.
9. Right to lodge a complaint
If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). We would, however, appreciate the chance to address your concerns directly first.
10. Data security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse, including the use of signed authentication tokens and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Children’s privacy
The Services are not directed at children under the age of 16. We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.
12. Third-party links and content
The Services may contain links to, or host applications from, third parties. This Policy does not cover the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party site or application you interact with.
13. Changes to this Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, provide a more prominent notice. Your continued use of the Services after changes take effect indicates your acceptance of the updated Policy.
14. Contact
For any questions about this Privacy Policy or how we handle your personal data, please contact us at info@brewser.io.