Updates to our Privacy Statement and Terms of Service: How we use your data

[site-policy-bot]

Hey GitHub Community,

We've made some important updates to our Privacy Statement and Terms of Service to keep you informed about how we handle your data. Notably, from April 24 onward we will begin using interaction data—specifically inputs, outputs, code snippets, and associated context—from Copilot Free, Pro, and Pro+ users to train and improve our AI models unless you opt out. Copilot Business and Copilot Enterprise users are not affected by this update.

Here's a quick overview of the changes and how they affect your GitHub experience.

What's new in the Privacy Statement?

You'll notice the following changes, and clarifications in this Privacy Statement update:

1. Sharing with affiliates: We've updated the Affiliates section to expand the purposes for which we share personal data with GitHub affiliates, including Microsoft. GitHub affiliates are companies within our corporate family—they do not include third-party AI model providers or other independent service providers. Affiliates may now use shared data for additional purposes, including developing and improving artificial intelligence and machine learning technologies, subject to applicable law and their own privacy commitments. If GitHub shares your data with affiliates for AI model training, your opt-out preferences and enterprise data protections travel with the data. You can review Microsoft's privacy practices in the Microsoft Privacy Statement.
2. Product development and improvement:: We've added a new processing purpose to explain how we use personal data to develop, improve, and train our products, services, and technologies, including AI and machine learning models. This includes improving features, developing new offerings, enhancing safety and security, and training models that power GitHub's AI-assisted features like GitHub Copilot. We apply appropriate technical safeguards, including filters designed to detect and remove sensitive data, and de-identification techniques.
3. Lawful basis for AI development: For users in the European Economic Area (EEA) and UK, we've updated our lawful bases section to specify developing artificial intelligence and machine learning technologies as a legitimate interest. This processing is done only when our interests are not overridden by your data protection rights or fundamental rights and freedoms.
4. Private Repository Access Consolidated in Terms of Service: We moved the description of when GitHub personnel may access private repository content from the Privacy Statement to Section E (Private Repositories) of the Terms of Service. This is a consolidation, not a change — the same access limitations apply. We made this move because private repository access rights are contractual commitments about how we treat your content, and they belong alongside our confidentiality obligations in the Terms of Service rather than in a document focused on personal data processing. The Privacy Statement continues to reference Section E for details.

What's new in the Terms of Service?

Alongside the Privacy Statement changes, we've updated the Terms of Service to clearly describe how AI features work, how your data may be used for training if you do not opt out, and what controls you have. Here's a rundown:

1. Updated Definitions: We've added new defined terms — "AI Feature," "Affiliate," "Input," "Output," and "Your Content" — so the agreement is clearer and easier to follow.
2. Refreshed User-Generated Content Section (Section D): We've rewritten Section D in plainer language to make your rights and responsibilities clearer. The ownership and license structure is easier to follow, the license grant to GitHub now explicitly extends to our Affiliates and clarifies that it includes using Your Content for providing and improving AI models and AI. You still own Your Content — that hasn't changed.
3. Private Repositories and AI (Section E): We've added a new provision that spells out that if you provide Private Repository content as Input to an AI Feature, we may use that Input to improve AI Features (subject to your opt out right). But we still will not otherwise use or access your Private Repository contents.
4. New Section J — AI features, training, and your data: We've added a dedicated section that brings all AI-related terms together in one place. Unless you opt out, you grant GitHub and our affiliates a license to collect and use your inputs (like prompts and code context) and outputs (like suggestions) to develop, train, and improve AI models. Once you opt out, we stop collecting from that point forward. We will not share your inputs or outputs with third-party AI model providers for their own independent training. GitHub does not claim ownership of your inputs or outputs. They're yours.

AI model training: What you need to know

Here's what this means in practice:

• Applicable products: This applies to GitHub Copilot Free, Pro, and Pro+. As our AI features evolve, the list of applicable products may expand, and these commitments will apply to those products too.
• Your control: You control your data, including inputs, outputs, code snippets, and associated context. You can disable the use of it for AI training through your settings. This opt-out applies to GitHub and its affiliates.
• Data minimization: We're committed to using the minimum amount of personal data necessary. When possible, we de-identify or aggregate your data during the training process to protect your privacy.
• Enterprise customers: These changes apply only to individual consumer accounts. Enterprise and organization-provided accounts remain governed by your Data Protection Agreement. Your data will not be used for AI training.
• Private repositories: This update does not change our treatment of private repository source code stored on GitHub. We do not use private repository content at rest to train AI models. The interaction data covered by this update (e.g., prompts, suggestions, and code snippets generated during your use of Copilot) may be generated while you are working in a private repository, but we are not accessing or training on the stored contents of that repository at rest.

When will these changes take effect?

These changes take effect on April 24. Not interested? Opt out in settings under "Privacy". If you previously opted out of the setting allowing GitHub to collect this data for product improvements, your preference has been retained. Your choice is preserved, and your data will not be used for training unless you opt in.

Who is affected?

These changes affect Copilot Free, Pro, and Pro+ users. Copilot Business and Copilot Enterprise users are not affected by this update.

Your privacy rights

You continue to have the rights described in our Privacy Statement, including:

• The right to access your data
• The right to correct inaccurate data
• The right to request deletion of your data
• The right to object to processing based on legitimate interests

To exercise these rights, contact us at privacy@github.com.

Got questions?

If you have questions, visit our FAQ and related discussion.

Thank you for being a part of GitHub. We're dedicated to continuously improving our services while respecting your privacy.

The GitHub Team