GitHub Privacy Statement

This document is GitHub's General Privacy Statement, governing the collection, use, storage, sharing, and protection of personal data across GitHub's products and services, with Microsoft Corporation as GitHub's parent entity and data controller for certain processing activities. The statement asserts that GitHub collects registration information (name, email, password), profile data, payment information, device and usage data, cookies and tracking data, and content users upload; the terms authorize use of this data for service delivery, security, legal compliance, personalization, and to improve GitHub products including AI features such as GitHub Copilot. The policy discloses that personal data may be shared with Microsoft affiliates, service providers, advertising partners, and third parties in the context of business transactions, and that public repository content is visible globally and may be indexed by search engines, which is operationally distinct from platforms where user-generated content defaults to private. The statement engages GDPR for EU/EEA users (including rights of access, rectification, erasure, portability, and objection), the California Consumer Privacy Act for California residents, and additional state privacy laws; GitHub designates a Data Protection Officer and commits to Standard Contractual Clauses for international transfers. Compliance teams should note that the policy's AI training data provisions, the breadth of affiliate data sharing with Microsoft, and the treatment of public repository content as non-private warrant specific review under applicable data minimization and purpose limitation obligations.