GitHub
- Your data trains their AI unless you switch it off in settings.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The policy describes staff access for safety and legal checks.
GitHub policies here let them train AI on your content by default, share with Microsoft, and close accounts without notice.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account info, your code and files, device and usage data, cookies, and sometimes demographics.
Read the exact line
Privacy policy
“Personal Data is collected from you directly, automatically from your device, and also from third parties.”
Training
They run the service, advertise, and train AI models on your content unless you opt out in settings.
Read the exact line
Privacy policy
“We use Personal Data to develop and improve our products, services, and technologies, including artificial intelligence and machine learning technologies.”
Sharing
Microsoft and other affiliates, vendors, ad partners, and the public if your repos are public.
Read the exact line
Privacy policy
“Personal Data may be shared with GitHub affiliates, including Microsoft, to facilitate customer service, marketing and advertising”
Kept
They keep data while your account is active; after cancel they say they delete most of it within 90 days.
Read the exact line
Terms of service
“barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination”
Controls
You can opt out of AI training in account settings and email privacy@github.com for access or deletion.
Read the exact line
Terms of service
“unless (a) you opt out through your account settings, or (b) your use of the Service is governed by a GitHub Customer Agreement”
Fine print
They can close you without notice, paid plans are non-refundable, and you must cover their legal costs.
Read the exact line
Terms of service
“GitHub has the right to suspend or terminate your access to all or any part of the Website at any time, with or without cause, with or without notice, effective immediately.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Turn off AI training on Inputs and Outputs
Account settings (Terms Section J.3)
Opt out of personal information sharing
Footer “Do Not Share My Personal Information” link or Global Privacy Control
Request access or deletion of personal data
Email privacy@github.com
Cancel your account in the app
Settings in the global navigation bar, Account screen cancellation link
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They get a license to use what you post to run GitHub and to train AI, including Microsoft’s models.
Read the exact line
Terms of service
“You grant GitHub and our Affiliates the right to store, host, archive, parse, display, and make copies of Your Content as necessary to provide, develop, and improve the Service, including by training AI Features”
For example, code you put in a repo can be used to train Copilot-style tools unless other limits apply.
Chat and Copilot prompts are used for training unless you switch that off.
Read the exact line
Terms of service
“You also grant GitHub and its Affiliates a license to collect and use your Inputs and Outputs to develop, train and improve artificial intelligence and machine learning models”
For example, a private snippet you paste into Copilot can be used to improve models until you opt out.
They can shut your account instantly for any reason and do not have to warn you first.
Read the exact line
Terms of service
“GitHub has the right to suspend or terminate your access to all or any part of the Website at any time, with or without cause, with or without notice, effective immediately.”
For example, you could lose access to repos overnight with no email first.
If someone sues over how you used GitHub or AI output, you may have to pay GitHub’s legal bills.
Read the exact line
Terms of service
“You agree to us, defend us, and hold us harmless from and against any and all claims, liabilities, and expenses, including attorneys’ fees, arising out of your use of the Website and the Service”
For example, if Copilot output in your product draws a lawsuit, you may have to defend GitHub too.
Paid plans charge ahead of time and they say they will not refund unused time.
Read the exact line
Terms of service
“For monthly or yearly payment plans, the Service is billed in advance on a monthly or yearly basis respectively and is non-refundable.”
For example, if you cancel a yearly plan after a week, they keep the full year payment.
Ad companies can track you on GitHub pages to show targeted ads.
Read the exact line
Privacy policy
“We may also employ third-party Cookies to gather data for interest-based advertising.”
For example, visiting a marketing page can feed ad networks a profile of your browsing.
Microsoft and other GitHub companies can get your data for ads, support, and AI training.
Read the exact line
Privacy policy
“Personal Data may be shared with GitHub affiliates, including Microsoft, to facilitate customer service, marketing and advertising, order fulfillment, billing, technical support, legal and compliance obligations, product development and improvement (including training and improving artificial intelligence and machine learning technologies)”
For example, usage data from GitHub can go to Microsoft for model improvement.
People can look at your data when they think there is abuse or a rules break.
Read the exact line
Privacy policy
“To promote safety, integrity, and security across our Services, we process Personal Data, using both automated and, at times, manual techniques for abuse detection, prevention, and violations of terms of service.”
For example, a reviewer might inspect a private repo if malware is suspected.
You can stop future Copilot-style training of your prompts in account settings.
Read the exact line
Terms of service
“If you opt out, GitHub will not collect or use your Inputs and Outputs for the purposes described in this paragraph from the effective date of your opt-out going forward.”
For example, after you opt out, new Copilot chats should not go into that training use.
Big privacy changes should come with 30 days’ warning.
Read the exact line
Privacy policy
“If there are material changes to the statement, we will provide at least 30 days prior notice by updating our website or sending an email to your primary email address associated with your GitHub account.”
For example, they should email you before a major new data use starts.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- inputs and outputs
- Inputs are what you type, say or upload to an AI; outputs are what it gives back to you. For example, the question you ask a chatbot is an input and its answer is an output, and both may be stored.
- model training
- Using your content and conversations as examples to teach an AI system, which can then echo them in future answers. For example, a story you write in a chatbot may be studied by the company to make the next version of the bot.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
How we got here · grade B · score 52/100 · 15 of 15 policy answers backed by a verified quote · 2 not stated
What does the app collect beyond what it needs to work?
They collect account data, your content, device IDs, IP, usage logs, cookies, and sometimes demographics and regional location.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Inputs and outputs are used to train AI unless you opt out in account settings.
Can employees or contractors read your conversations, and when?
They say people may review data with automated and manual methods for abuse, security, support, or legal reasons, especially private repos.
Are you profiled or tracked for advertising?
They use third-party cookies and partners for interest-based and targeted advertising.
Do they sell or share your data, and can you opt out?
They share with Microsoft, vendors, and ad networks; California “sharing” has a Do Not Share link and GPC opt-out. They say they do not sell Nevada covered information.
What rights do they take over what you type and what the AI makes?
You own your content; you license GitHub to host it and to develop and train AI. That license is said to end when you remove the content, except forks.
How long do they keep your data after you delete it, and can you delete it in the app?
You can cancel in Settings; they say they delete profile and repo content within 90 days, with legal and backup exceptions.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They say they use administrative, technical, and physical security controls. No audit or leak history is described here.
Is there a real age gate, and are teens protected?
You must be 13 or older. They do not describe age checks beyond that rule and closing under-13 accounts.
Will they tell you when the rules change, and is the policy specific?
The policies are dated. Material changes get at least 30 days’ notice by site or email.
Can they close your account without warning, and can you get your data out first?
GitHub may suspend or terminate anytime, with or without cause or notice. You can request a copy of content within 90 days after cancel.
If something goes wrong, who pays?
The service is as-is with broad damage limits, and you must indemnify GitHub for claims from your use, including AI output.
Do subscriptions renew on their own, and can you get a refund?
Plans bill in advance monthly or yearly and are non-refundable. Prices can change at the end of a term.
The privacy policy is 6,015 words at a college graduate level (Flesch reading ease 34.2); the terms are 7,285 words at a college level.
