Sourcegraph updated its Privacy Policy on June 16, 2026 with substantial restructuring and expanded definitions. The policy previously stated it did not apply to customer data processed under business agreements; the updated version now explicitly distinguishes between data Sourcegraph collects as a controller (covered by the policy) and user content processed on behalf of customers (covered by separate customer agreements). The policy added a detailed index, expanded definitions of data types (Account Information, Activity Data, Analytics Data), and clarified the scope of coverage for website visitors, service users, and communication recipients.
The updated policy clarifies that Sourcegraph's Privacy Policy covers personal data it collects directly when individuals visit the website, use services, or receive communications. The policy explicitly states it does not cover user content (such as code) processed through services on behalf of customers, which is instead governed by separate customer agreements. The restructuring adds detailed definitions of data categories and creates a navigable index, but does not appear to materially change what data is collected or how it is used.
The updated policy clarifies the boundary between Sourcegraph's direct data collection and customer data it processes on behalf of clients. For organizations using Sourcegraph, this distinction is operationally significant because it establishes that data protection compliance depends on separate customer agreements rather than the main privacy policy, requiring vendors to verify that their data processing agreements are properly executed and current. The restructuring does not appear to change actual practices but may affect contract management and privacy documentation workflows.
Policy now explicitly clarifies that it covers only data Sourcegraph collects directly; customer data processed on behalf of customers is governed by separate customer agreements.
The previous statement 'By using our Service, you agree to the terms of this Privacy Policy and our Terms of Service' was removed, creating potential ambiguity about acceptance mechanism.
Added comprehensive index and expanded definitions (Account Information, Activity Data, Analytics Data) for clarity and navigability.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Sourcegraph clarified the scope of its Privacy Policy to explicitly separate data controller and data processor roles. Where the policy previously stated it did not apply to customer personal data processed under business agreements, the updated language now defines this distinction in its opening section. This clarification may affect how customers evaluate data processing obligations in their own privacy notices and vendor assessments, particularly regarding the division of responsibility between Sourcegraph and its customers for data processed through the service. The change appears procedural and clarifying rather than substantive.
GDPR (controller vs. processor distinction), CCPA (collection and use disclosures)
Full compliance analysis
Obligation analysis, escalation trigger, board language, and recommended action.
Monitor: regulatory citations + obligations. Compliance: full compliance memo.
ConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-003016.
See the full side-by-side comparison of every sentence added, removed, and modified.
🔒 Full diff — MonitorSourcegraph restructured how its Terms of Service are organized and applied. Previously, the document listed separate term variants for different …
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get alerted when this policy changes again — including what changed and why it matters.
Prefer a weekly summary instead?
Get the biggest policy changes across 320+ platforms every Sunday.