If you open up your BAT token reward page it lists EVERY website tokens have been allocated for.
This is effectively giving anyone with access to your browser your entire browsing history REGARDLESS of having cleared all data.
There is no apparent way to delete these sites or prevent this data collection.
Not only that it also shows sites which aren’t currently set up to receive BAT in a separate list. This data can be deleted but if you don’t know it’s there could also represent a privacy hole.