GitHub Privacy Statement

This is GitHub's privacy policy explaining what personal information GitHub collects about the roughly 100 million developers who use its platform — including your name, email, IP address, browsing behavior, code repositories, and payment details. The most important thing to know is that GitHub shares your personal data with Microsoft (its parent company), third-party service providers, advertising partners, and government authorities, meaning your developer activity and profile data travel well beyond GitHub itself. If you are a California resident or in the EU/UK, you have specific rights to access, delete, or opt out of certain data uses, which you can exercise by contacting GitHub's Privacy team at privacy@github.com.

The GitHub General Privacy Statement governs the collection, use, sharing, and retention of personal data across GitHub's products and services, with legal bases including contractual necessity, legitimate interests, consent, and legal obligation under GDPR Art. 6. GitHub collects a broad range of personal data including usage data, device/log information, location inferred from IP address, payment information, and content users upload, and shares this data with third-party service providers, corporate affiliates (including Microsoft), advertising partners, and government authorities upon lawful request. A notable provision permits GitHub to use aggregate and de-identified data derived from user content without restriction, and the policy allows sharing of personal data with Microsoft and other affiliates for joint operations, which expands data exposure beyond what many users would anticipate for a developer platform. The policy engages GDPR (including Chapter V cross-border transfer mechanisms via SCCs and adequacy decisions), CCPA/CPRA (§1798.100 et seq.) for California residents, and COPPA for users under 13; EU and UK residents are afforded specific rights including erasure, portability, and objection, while GitHub Inc. (a Microsoft subsidiary) serves as the data controller for most processing. Material compliance considerations include the breadth of third-party sharing with advertising and analytics vendors, the reliance on legitimate interests as a basis for certain processing, and the absence of an explicit opt-out mechanism for all non-essential data sharing outside of California and EU-specific rights.