GitHub Privacy Statement

This document explains what information GitHub collects about you, how it uses that information, and who it shares it with—including Microsoft and third-party advertisers who may track you across services over time. If a school or employer gave you your GitHub account, that organization controls most of your data, not you directly. GitHub will give you at least 30 days' notice before making material changes to these rules.

GitHub's Privacy Statement establishes the scope of Personal Data GitHub collects—including user-provided code, AI outputs, text, documents, images, and feedback—and the purposes for which that data is used, including developing and improving AI and machine learning technologies. It defines data-sharing relationships with affiliates (including Microsoft), analytics and advertising partners, organizations that add users to their accounts, and parties to corporate transactions. The Statement assigns Data Controller status to institutions (schools or employers) that supply user accounts, sets a 30-day advance notice requirement for material policy changes, and specifies that data is retained beyond account closure for legal, contractual, dispute, and enforcement purposes. International transfers rely generally on European Commission standard contractual clauses under Decision 2021/914, with the EU-U.S. and Swiss-U.S. DPF Principles governing where they conflict with the Statement.

GitHub collects a broad range of personal data from content you create and interact with, including code, AI outputs, and feedback, and uses it to build and improve AI and machine learning systems. Third-party analytics and advertising partners may track your activity across GitHub's services over time for targeted advertising. If an organization added you to its GitHub account, that organization—not GitHub—acts as the primary Data Controller for most of your personal data, reducing your direct control. Your data may be retained after you close your account to meet legal or contractual obligations. If GitHub makes material changes to its privacy practices, it will notify you at least 30 days in advance via its website or your primary email address, giving you a defined window to review those changes.