Brave, the open-source browser designed to prioritize privacy by blocking third-party ads and trackers, is facing criticism from users for redirecting URLs from cryptocurrency companies to affiliate links that Brave profits from, Decrypt reported.

Unlike the “opt-in” principle by which the company abides—advertisements are optional on the browser and pay out cryptocurrency to anyone who views them—Brave never asked its 15 million monthly users about these redirects.

A Twitter user spotted the redirect when he typed “binance.us” into the Brave search bar, and the browser autocompleted it to “binance.us/en?ref=35089877.” Both URLs go to the same page, but the affiliate link at the end can be used to track users and generate income. Many websites, including Vox Media and The Verge, use affiliate links, but most are transparent about doing so.

Brave co-founder and CEO Brendan Eich tweeted that the company had made a mistake and was correcting it. “Brave default autocompletes verbatim ‘http://binance.us’ in address bar to add an affiliate code. We are a Binance affiliate, we refer users via the opt-in trading widget on the new tab page, but autocomplete should not add any code.”

Eich said on Twitter that Brave was trying to build a viable business that prioritizes users and their data, “but we seek skin-in-game affiliate revenue too,” Eich added. “This includes bringing new users to Binance & other exchanges via opt-in trading widgets/other UX that preserves privacy prior to opt-in. It includes search revenue deals, as all major browsers do.”