Policies

Privacy policy

Last updated October 29, 2026

This policy explains what Brave Pilots ("we", "us") collects when you visit bravepilots.com, sign in or order coffee, what we do with it, and the choices you have. The short version: we collect what we need to roast, ship and support your orders and to learn which of our efforts bring people to the store. We don't sell your information, and we don't use it for targeted advertising.

Brave Pilots is based in Austin, Texas, and the store serves customers in the United States.

What we collect

What you give us

Account details. Your email address and your name. You sign in with a one-time code sent to your email, or with Google or Apple. We never ask for or keep a password.
Orders. The coffees you choose (origin, roast level, grind and number of bags), your shipping address, what you paid, the discounts and Miles you used, and your order's progress, carrier and tracking number.
Scheduled flights. For a monthly plan: the coffee, roast level, grind, number of bags and the Friday roast you picked.
Payment details. Our payment processor handles card payments. We never see or store your full card number. We keep only the card's brand and last four digits, so you can tell which card is on file.
Miles. Your Miles balance and its history: Miles earned, spent, returned or adjusted.
Reviews and survey answers. If you review a coffee, we keep your rating and your words, shown with your first name, last initial and, if you share it, your city. If you answer "How did you hear about us?" after an order, we keep your answer.
Messages. What you write to us at [email protected], and our replies.

If you choose Continue with Google, Google shares your name, your email address and whether Google has verified that address. If you choose Continue with Apple, Apple shares your email address and, the first time only, your name. If you chose Apple's Hide My Email, the address we get is a private relay address that forwards to you.

We use this only to create your account and sign you in. We never receive your Google or Apple password, and we get no access to your contacts, files, calendar or anything else in those accounts. You can stop using either sign-in at any time in your Google Account or Apple Account settings. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

What we collect when you visit

How you found us. The website that sent you (only its address, like google.com), the campaign tags in the link you followed (utm_source and the like), and the ad's click ID when you came from an ad (like Google's gclid). This tells us which channels bring visitors and customers.
Your visit. The pages you open, the coffees you look at or add to your Flight Bag, whether you reach checkout and any order you place, plus the kind of device you use (phone, tablet or computer), which we work out from your browser.
A visitor ID. A random number kept in a cookie that ties your visits together. It holds no name or email. When you create an account or place an order, where you first came from is saved with your customer record.

We don't record IP addresses in this visit data, and we don't buy information about you from anyone.

Google Analytics

We use Google Analytics to see how people use the store as a whole: which pages they read, how they move through the store, and which devices and browsers they use. Google Analytics sets its own cookies and collects the pages you view, your device and browser, how you interact with the store, and your approximate location (country, region and city), which Google works out from your IP address without storing it. Google processes this for us; this page explains how. You can opt out with Google's browser add-on.

Apart from Google Analytics, no other company collects information about what you do on our store.

Cookies

Cookies are small files a website keeps in your browser. These are ours:

Cookie	What it's for	How long it lasts
`bp_session`	Keeps you signed in	30 days
`bp_oauth`	Ties a Google or Apple sign-in to your browser while it happens	10 minutes
`bp_bag`	Remembers what's in your Flight Bag	30 days after the last change
`bp_visitor`	The random visitor ID described above	180 days after your last visit
`_ga`, `_ga_*`	Google Analytics: tells visitors and visits apart	Up to 2 years

Our team's own tools use a few more cookies that visitors and customers never get. You can block or delete cookies in your browser's settings. The store works without the visitor and Google Analytics cookies, but you need the others to stay signed in and keep a Flight Bag.

Our store doesn't respond to the "Do Not Track" setting some browsers send. We don't sell your information or use it for targeted advertising either way.

How we use your information

To take, roast, pack, ship and support your orders, including Scheduled flights.
To run your account and your Miles.
To email you about your orders and plans: receipts, shipping and delivery updates, a reminder 3 days before every Scheduled flight charge, requests for a review, and replies to your messages.
To learn which of our marketing brings visitors and customers, and to make the store better.
To keep the store and our customers safe, prevent fraud and misuse, and keep the records taxes and accounting require.

We don't send marketing emails today. If we start, we'll follow the law on them, and every one will have an unsubscribe link.

We share information only with the companies that help us run the store, and only what each one needs:

Our roasting and fulfillment partner roasts, packs and ships some of our coffees. For those orders it gets your name, email address, shipping address and the coffees you ordered.
Shipping carriers get your name and address on the label and use them to deliver.
Our payment processor handles card payments.
Our email provider sends our emails.
Our hosting providers run the store, our database and our files.
Google provides Google Analytics and, if you use it, Sign in with Google. Apple provides Sign in with Apple and, if you use Hide My Email, forwards our emails to you.

These companies may use your information only to do their work for us. If you're a customer and want to know more about who handles your information, write to us.

We may also share information when the law requires it, to protect someone's safety or our rights, or as part of selling or transferring our business, in which case this policy keeps applying to it.

We don't sell your personal information, and we don't share it for targeted advertising.

How long we keep it

Visitor records are deleted automatically 180 days after your last visit, and visit records 400 days after the visit.
Your Flight Bag stays in your browser for 30 days after its last change.
Your account, orders and Miles history stay while your account is open, and after that as long as we need them for accounting, taxes and questions about orders.

Deleting your account in Account settings closes it right away and pauses any Scheduled flights. We keep the record because your orders refer to it, and signing in again with the same email reopens it. If you'd rather have your personal information erased, write to us: we'll delete everything we aren't required to keep.

Your choices and rights

Wherever you live, you can:

See and correct your name and shipping address in Account settings.
Ask us for a copy of the personal information we hold about you.
Ask us to correct or delete your information.
Close your account in Account settings.
Opt out of Google Analytics with Google's add-on, and block cookies in your browser.

Write to [email protected] from the email address on your account, so we know it's you. We'll answer within 45 days. If we can't do what you asked, we'll tell you why, and you can reply to ask us to reconsider. Some states, including Texas and California, give their residents these rights by law. We give them to everyone.

Children

The store is for adults: you must be 18 or older to create an account or place an order. We don't knowingly collect information from children under 13. If you believe a child has given us information, write to us and we'll delete it.

Security

The store runs over an encrypted connection (https), sign-ins are protected, and only the team members who need your information can see it. No system is perfectly secure, so we can't promise that nothing will ever go wrong, but if a breach affects your information, we'll tell you as the law requires.

Changes to this policy

When we change this policy, we update the date at the top. If a change affects how we use information we already have in a way that matters, we'll email account holders before it takes effect.

Contact us

Brave Pilots
5900 Balcones Drive, Ste 100
Austin, TX 78731
[email protected]