This is GitHub's General Privacy Statement, effective April 27, 2026
The document is the GitHub General Privacy Statement with a stated effective date of April 27, 2026. Only this dated version is analyzed; earlier or later versions are not supplied.
Supporting quotations
GitHub General Privacy Statement
Effective date: April 27, 2026
Qualifications & exceptions
The date is the effective date printed on the saved version; no successor version is supplied.
Use & Processing · Context
The Statement covers Personal Data GitHub, Inc. or GitHub B.V. processes as Data Controller for Services that display it
The Statement describes how GitHub handles your "Personal Data", meaning information directly linked or linkable to you. It applies to Personal Data that GitHub, Inc. or GitHub B.V. processes as the "Data Controller" when you interact with websites, applications and services that display this Statement (together, the "Services"). It does not apply to services or products that do not display it, such as Previews, where relevant.
Supporting quotations
This is where we describe how we handle your “Personal Data”, which is information that is directly linked or can be linked to you.
It applies to the Personal Data that GitHub, Inc. or GitHub B.V., processes as the “Data Controller” when you interact with websites, applications, and services that display this Statement (collectively, “Services”).
This Statement does not apply to services or products that do not display this Statement, such as Previews, where relevant.
Qualifications & exceptions
Scope is limited to processing where GitHub, Inc. or GitHub B.V. is the Data Controller; where an organization supplies your account, GitHub is mostly a Data Processor (see the organization-account cards).
Services that do not display this Statement, such as Previews where relevant, are outside it.
Not stated here
The Statement does not say which of GitHub, Inc. or GitHub B.V. is the controller for a given user in this passage.
Sharing & Disclosure · Company practice
A school or employer that supplies your account becomes Data Controller and can manage it and access your data
When a school or employer supplies your GitHub account, that organization takes the role of Data Controller for most Personal Data used in the Services. This lets it manage and administer your account, including adjusting privacy settings, and access and use your Personal Data, including details of how you use the Services and your content and files.
Supporting quotations
When a school or employer supplies your GitHub account, they assume the role of Data Controller for most Personal Data used in our Services.
Manage and administer your GitHub account, including adjusting privacy settings.
Access and utilize your Personal Data, which includes details on how you use the Services, as well as your content and files.
Qualifications & exceptions
Applies only to accounts supplied by an organization such as a school or employer.
The organization is controller for "most" Personal Data, not all; GitHub stays controller for specific activities defined in the Data Protection Agreement.
Use & Processing · Context
For organization-provided accounts GitHub acts as Data Processor under a Data Protection Agreement
If you use GitHub through an account provided by an organization such as your employer or school, the organization becomes the Data Controller and this Statement's direct applicability to you changes. GitHub then acts as a Data Processor and follows the controller's instructions about processing your Personal Data. A Data Protection Agreement governs the relationship between GitHub and the organization, and you are pointed to the organization's own privacy statement for its practices. GitHub says it remains dedicated to preserving your privacy rights.
Supporting quotations
Should you access a GitHub Service through an account provided by an organization, such as your employer or school, the organization becomes the Data Controller, and this Privacy Statement's direct applicability to you changes.
In such circumstances, GitHub functions as a Data Processor, adhering to the Data Controller's instructions regarding your Personal Data's processing.
A Data Protection Agreement governs the relationship between GitHub and the Data Controller.
For further details regarding their privacy practices, please refer to the privacy statement of the organization providing your account.
Even so, GitHub remains dedicated to preserving your privacy rights.
Qualifications & exceptions
The organization's privacy statement and the Data Protection Agreement are not supplied with this document.
Not stated here
The Statement does not say which parts of this Statement still apply to you directly when an organization is controller, beyond the specific activities in the Data Protection Agreement.
Legal Rights & Agreement Rules · Context
With an organization account, GitHub is Data Controller only for activities defined in the Data Protection Agreement
Where your organization grants access to GitHub products, GitHub acts as Data Controller only for specific processing activities defined in the Data Protection Agreement with your organization. For those limited purposes this Statement governs how your Personal Data is handled; for all other aspects of your GitHub product use, your organization's policies apply. GitHub links its standard Data Protection Agreement.
Supporting quotations
In cases where your organization grants access to GitHub products, GitHub acts as the Data Controller solely for specific processing activities.
These activities are clearly defined in a contractual agreement with your organization, known as a Data Protection Agreement.
For those limited purposes, this Statement governs the handling of your Personal Data. For all other aspects of GitHub product usage, your organization's policies apply.
Qualifications & exceptions
Which activities GitHub controls is defined in the Data Protection Agreement, which is linked but not supplied here.
Not stated here
The specific processing activities for which GitHub is controller are not listed in this Statement.
Third-party extensions, integrations and links follow the third parties' own privacy policies
When you use third-party extensions or integrations, or follow references and links within GitHub's Services, the third parties' privacy policies apply to Personal Data you provide to or consent to share with them, and their privacy statements govern how that data is processed.
Supporting quotations
When you use third-party extensions, integrations, or follow references and links within our Services, the privacy policies of these third parties apply to any Personal Data you provide or consent to share with them.
Their privacy statements will govern how this data is processed.
Qualifications & exceptions
Covers Personal Data you provide or consent to share with the third party; those policies are not supplied here.
Data Access & Collection · Company practice
GitHub collects Personal Data from you, automatically from your device, and from third parties
GitHub collects Personal Data directly from you, automatically from your device and from third parties. What it processes depends on how you interact with the Services (web, desktop or mobile apps), the features you use (such as pull requests, Codespaces or GitHub Copilot) and how you access the Services (such as your IDE).
Supporting quotations
Personal Data is collected from you directly, automatically from your device, and also from third parties.
The Personal Data GitHub processes when you use the Services depends on variables like how you interact with our Services (such as through web interfaces, desktop or mobile applications), the features you use (such as pull requests, Codespaces, or GitHub Copilot) and your method of accessing the Services (your preferred IDE).
Data Access & Collection · Company practice
Account data: handle, name, email, password, payment and transaction information when you open an account
When you open an account GitHub collects information such as your GitHub handle, name, email address, password, payment information and transaction information.
Supporting quotations
Account Data: We collect certain information when you open an account such as your GitHub handle, name, email address, password, payment information and transaction information.
Qualifications & exceptions
The list is introduced by "such as", so it gives examples rather than a complete list.
Data Access & Collection · Company practice
Personal Data inside your content is collected, including code, inputs, AI outputs, documents, images and feedback
When you use the Services GitHub collects Personal Data included in the information you provide, such as code, inputs, AI outputs, text, documents, images or feedback.
Supporting quotations
User Content and Files: When you use our Services, we collect Personal Data included as part of the information you provide such as code, inputs, AI outputs, text, documents, images, or feedback.
Qualifications & exceptions
The collected object is Personal Data that is part of what you provide, with examples introduced by "such as".
Data Access & Collection · Company practice
In some cases you provide demographic details such as ethnicity or gender
In some cases users provide GitHub with ethnicity, gender or similar demographic details, and GitHub lists these as data it collects from you.
Supporting quotations
Demographic information: In some cases, you provide us with ethnicity, gender, or similar demographic details.
Qualifications & exceptions
Collected only "in some cases" where you provide it.
Not stated here
The Statement does not say in which situations demographic details are requested or whether providing them is optional.
Data Access & Collection · Company practice
Feedback and support data: survey and review answers, and code, text or files sent to support
GitHub collects information you submit through surveys, reviews or interactive features, and, when you seek customer support, details such as code, text or multimedia files.
Supporting quotations
Feedback Data: This consists of information you submit through surveys, reviews, or interactive features.
Support Data: When you seek customer support, we collect details like code, text, or multimedia files.
Charges & Financial Obligations · Company practice
Paid subscriptions: name, billing address and payment details are collected
For paid subscriptions GitHub collects details such as your name, billing address and payment specifics.
Supporting quotations
Payment Information: For paid subscriptions, we collect details like name, billing address, and payment specifics.
Data Access & Collection · Company practice
Profile information such as a photo, extra emails, job title or biography is collected to create your profile
GitHub collects information to create a user profile, which may include a photo, additional email addresses, a job title or a biography.
Supporting quotations
Profile Information: We collect information to create a user profile, which may include a photo, additional email addresses, job title, or biography.
Data Access & Collection · Company practice
Sales and marketing data: name, email and company name given for promotional communications
GitHub collects information provided for promotional communications, such as your name, email address and company name.
Supporting quotations
Sales and Marketing Data: This includes information provided for promotional communications, such as name, email address, and company name.
Sharing & Disclosure · Company practice
Third-party buttons and content such as Twitter or LinkedIn links may send browser information to those companies
The Services may contain links or buttons leading to third-party services like Twitter or LinkedIn. Using these features may result in data collection, and engaging with them may automatically send certain browser information to those companies. GitHub refers you to those companies' privacy statements.
Supporting quotations
Our Services may contain links or buttons that lead to third-party services like Twitter or LinkedIn.
Use of these features may result in data collection. Engaging with these buttons, tools, or content may automatically send certain browser information to these companies.
Please review the privacy statements of these companies for more information.
Qualifications & exceptions
The transfer is described as something that "may" happen when you engage with these features.
Not stated here
The browser information sent is not specified, and the third parties' statements are not supplied.
Data Access & Collection · Company practice
Essential cookies and similar technologies store settings and recognize you
GitHub uses cookies and similar technologies to provide essential functionality, such as storing settings and recognizing you while you use the Services.
Supporting quotations
Essential Cookies and Similar Tracking Technologies: We use cookies and similar technologies to provide essential functionality like storing settings and recognizing you while using our Services.
Linking & Identification · Company practice
Depending on jurisdiction, analytics and third-party advertising cookies may be used; some places require your consent
Depending on your jurisdiction, GitHub may use online analytics products with cookies to analyze how de-identified users use the Services and to enhance your experience. It may also use third-party cookies to gather data for interest-based advertising. In some jurisdictions GitHub uses non-essential cookies only after obtaining your consent. The Statement points to a separate section for details and controls.
Supporting quotations
Depending on your jurisdiction, we may use online analytics products that use cookies to help us analyze how de-identified users use our Services and to enhance your experience when you use the Services.
We may also employ third-party Cookies to gather data for interest-based advertising.
In some jurisdictions, we only use non-essential cookies after obtaining your consent.
Qualifications & exceptions
Use "may" happen and depends on your jurisdiction.
Consent before non-essential cookies applies only "in some jurisdictions", which are not named here.
Not stated here
The jurisdictions that require consent are not named in this passage.
Marketing emails may contain web beacons that report device, email client, opens and link clicks
GitHub's emails may contain web beacons that provide information on your device type, email client, email reception, opens and link clicks.
Supporting quotations
Email Marketing Interactions: Our emails may have web beacons that offer information on your device type, email client, email reception, opens, and link clicks.
Qualifications & exceptions
Emails "may" include beacons; not every email is said to.
Data Access & Collection · Company practice
Regional geolocation data is collected depending on the Service's functionality
Depending on a Service's functionality, GitHub collects regional geolocation data.
Supporting quotations
Geolocation Information: Depending on the Service's functionality, we collect regional geolocation data.
Qualifications & exceptions
The Statement describes the geolocation as regional, and collection depends on the Service's functionality.
Not stated here
How precise "regional" is and which Services collect it are not stated.
Data Access & Collection · Company practice
Service usage data: IP address, device and session details, timestamps, app versions and repository contributions
GitHub collects data about your interactions with the Services, such as IP address, device information, session details, date and time of requests, device type and ID, operating system and application version, information related to your contributions to repositories, and performance of specific features or Services. It also automatically logs website interactions, including the referring site, date and time of visit, pages viewed and links clicked.
Supporting quotations
Service Usage Information: We collect data about your interactions with the Services, such as IP address, device information, session details, date and time of requests, device type and ID, operating system and application version, information related to your contributions to repositories, and performance of specific features or Services.
Website Usage Data: We automatically log data about your Website interactions, including the referring site, date and time of visit, pages viewed, and links clicked.
Data Access & Collection · Company practice
Other users may share information about you through issues and comments, or by naming you on a company account
Other users may share information about you when they submit issues and comments. GitHub may also receive information about you if you are identified as a representative or administrator on your company's account.
Supporting quotations
Other users may share information about you when they submit issues and comments.
We may also receive information about you if you are identified as a representative or administrator on your company's account.
Data Access & Collection · Company practice
GitHub may acquire information about you from publicly available sources
GitHub may acquire information about you from publicly available sources.
Supporting quotations
Publicly Available Sources: We may acquire information about you from publicly available sources.
Not stated here
The public sources and the information obtained are not specified.
Data Access & Collection · Company practice
Linked third-party services, such as Google sign-in, send GitHub information based on your settings with them
When you or your administrator integrate third-party apps or services with GitHub, GitHub receives information based on your settings with those services, which can include your name and email from services like Google for authentication. What GitHub receives depends on the third party's settings and privacy policies, which GitHub tells you to review.
Supporting quotations
When you or your administrator integrate third-party apps or services with our Services, we receive information based on your settings with those services.
This can include details like your name and email from services like Google for authentication.
The information we receive depends on the third-party's settings and privacy policies.
Qualifications & exceptions
An administrator, not only you, can set up the integration.
Data Access & Collection · Company practice
Vendors, resellers, partners and affiliates may give GitHub information about you
GitHub may receive information about you from third parties such as vendors, resellers, partners or affiliates, for the purposes described in the Statement.
Supporting quotations
Vendors, Partners, and Affiliates: We may receive information about you from third parties, like vendors, resellers, partners, or affiliates for the purposes outlined in this statement.
Use & Processing · Context
The purposes list describes all the potential ways GitHub may process your Personal Data
GitHub says the Personal Data it processes depends on your interfaces, features and access tools, and that this section details all the potential ways it may process your Personal Data. For all these activities GitHub says it practices data minimization and uses the minimum amount of Personal Information required.
Supporting quotations
This section details all the potential ways GitHub may process your Personal Data:
When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.
Qualifications & exceptions
The data-minimization statement is GitHub's own description; the Statement does not say how minimization is measured.
Use & Processing · Company practice
Personal Data is used for billing, accounting, compensation and aggregated internal and financial reporting
GitHub uses Personal Data for business operations like billing, accounting and compensation, including creating aggregated statistical data for internal reporting, financial reporting, revenue planning, capacity planning and forecast modeling, including product strategy.
Supporting quotations
Business Operations: We use Personal Data for activities like billing, accounting, and compensation.
This includes creating aggregated statistical data for internal reporting, financial reporting, revenue planning, capacity planning, and forecast modeling (including product strategy).
When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.
Qualifications & exceptions
GitHub says it practices data minimization and uses the minimum Personal Information required for these activities.
Use & Processing · Company practice
GitHub uses your data to send offers and promotions as well as invoices, security alerts and administrative messages
GitHub uses Personal Data to inform you about new Services, features, offers, promotions and other pertinent information, and to send confirmations, invoices, technical notices, updates, security alerts and administrative messages.
Supporting quotations
Communication: We use Personal Data to inform you about new Services, features, offers, promotions, and other pertinent information.
This also includes sending confirmations, invoices, technical notices, updates, security alerts, and administrative messages.
When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.
Qualifications & exceptions
GitHub says it practices data minimization and uses the minimum Personal Information required for these activities.
Not stated here
This passage does not say how to opt out of promotional messages.
Inference & Profiling · Company practice
GitHub infers preferences and characteristics, such as your general location from your IP address
GitHub generates new information from other data it collects to derive likely preferences or other characteristics. For example, it infers your general geographic location from your IP address.
Supporting quotations
Inference: We generate new information from other data we collect to derive likely preferences or other characteristics.
For instance, we infer your general geographic location based on your IP address.
When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.
Qualifications & exceptions
GitHub says it practices data minimization and uses the minimum Personal Information required for these activities.
Not stated here
Apart from general location, the preferences or characteristics inferred are not listed.
Use & Processing · Company practice
Personal Data is used to personalize the Service and to measure enterprise ads and promotions
GitHub uses Personal Data to customize the Service to your preferences, to evaluate the effectiveness of enterprise business ads and promotional communications, and to keep the user experience seamless and consistent.
Supporting quotations
Personalization: We use Personal Data to customize the Service to your preferences, to evaluate the effectiveness of enterprise business ads and promotional communications, and to ensure a seamless and consistent user experience.
When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.
Qualifications & exceptions
GitHub says it practices data minimization and uses the minimum Personal Information required for these activities.
Security & Safeguards · Company practice
Data is processed with automated and sometimes manual techniques to detect abuse and terms violations
To promote safety, integrity and security across the Services, GitHub processes Personal Data using automated and, at times, manual techniques for abuse detection and prevention and for violations of its terms of service.
Supporting quotations
To promote safety, integrity, and security across our Services, we process Personal Data, using both automated and, at times, manual techniques for abuse detection, prevention, and violations of terms of service.
When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.
Qualifications & exceptions
GitHub says it practices data minimization and uses the minimum Personal Information required for these activities.
Manual review happens "at times", not always.
Use & Processing · Company practice
Personal Data is used to deliver, update, troubleshoot and maintain the Services and personalize recommendations
GitHub uses Personal Data to deliver and update the Services as you configure and use them, to make ongoing personalized experiences and recommendations, to identify and resolve technical issues, and to keep the Services up to date and performant and meet productivity, reliability, efficacy, quality, privacy, accessibility and security needs.
Supporting quotations
Service Provision: We use Personal Data to deliver and update our Services as configured and used by You, and to make ongoing personalized experiences and recommendations.
Troubleshooting: We use Personal Data to identify and resolve technical issues.
Ongoing Service Performance: Personal Data helps us keep the Services up to date and performant, and meet user productivity, reliability, efficacy, quality, privacy, accessibility and security needs.
When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.
Qualifications & exceptions
GitHub says it practices data minimization and uses the minimum Personal Information required for these activities.
Use & Processing · Company practice
GitHub uses Personal Data to develop products, including training AI and machine learning models
GitHub uses Personal Data to develop and improve its products, services and technologies, including artificial intelligence and machine learning technologies. This includes improving features, developing new offerings, enhancing safety and security capabilities and training models. GitHub says it applies appropriate technical safeguards, including aggregation and de-identification where feasible, to protect your privacy while making these improvements.
Supporting quotations
Product Development and Improvement: We use Personal Data to develop and improve our products, services, and technologies, including artificial intelligence and machine learning technologies.
This includes improving features, developing new offerings, enhancing safety and security capabilities, and training models.
We apply appropriate technical safeguards, including aggregation and de-identification techniques where feasible, to protect your privacy while enabling these improvements.
When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.
Qualifications & exceptions
Aggregation and de-identification are applied only "where feasible", so model training is not limited to de-identified data.
GitHub says it practices data minimization and uses the minimum Personal Information required for these activities.
Not stated here
The Statement does not say which Personal Data, such as code or AI inputs, is used for training, or whether you can opt out of training here.
Organization-provided accounts may be governed by a Data Protection Agreement that is not supplied.
Legal Rights & Agreement Rules · Company practice
Personal Data is used to meet legal obligations, including Data Subject Requests, tax, agreements and disputes
GitHub uses Personal Data to comply with and resolve legal obligations, including responding to Data Subject Requests for Personal Data it processes as Controller (for example website data), tax requirements, agreements and disputes.
Supporting quotations
Complying with and resolving legal obligations: including responding to Data Subject Requests for Personal Data processed by GitHub as Controller (for example website data), tax requirements, agreements and disputes.
When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.
Qualifications & exceptions
GitHub says it practices data minimization and uses the minimum Personal Information required for these activities.
The Data Subject Request example covers Personal Data GitHub processes as Controller.
Use & Processing · Company practice
Personal Data is used to deliver and improve Professional Services such as training, consulting and migration
GitHub uses Personal Data to deliver training, consulting or implementation ("Professional Services"), including technical support, planning, advice, guidance, data migration, deployment and solution or software development. It also uses it to improve the delivery, efficacy, quality and security of Professional Services and the underlying products based on issues found while providing them, including fixing software defects.
Supporting quotations
Delivering Professional Services: We use Personal Data to deliver training, consulting or implementation (“Professional Services”).
This includes providing technical support, professional planning, advice, guidance, data migration, deployment, and solution/software development services.
Improving Professional Services: Enhancing delivery, efficacy, quality, and security of Professional Services and the underlying product(s) based on issues identified while providing Professional Services, including fixing software defects, and otherwise keeping the Professional Services up to date and performant.
When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.
Qualifications & exceptions
GitHub says it practices data minimization and uses the minimum Personal Information required for these activities.
Sharing & Disclosure · Company practice
GitHub may disclose data in good faith to prevent fraud, abuse or attacks, or to protect GitHub and users
GitHub may disclose Personal Data to abuse and fraud prevention entities based on a good-faith belief that it is needed to prevent fraud, abuse or attacks on the Services, or to protect the safety of GitHub and its users.
Supporting quotations
We may share Personal Data with the following recipients:
Abuse and Fraud Prevention Entities: We may disclose Personal Data based on a good faith belief it is needed to prevent fraud, abuse, or attacks on our Services, or to protect the safety of GitHub and our users.
Qualifications & exceptions
The trigger is GitHub's own good-faith belief, not a legal request.
Not stated here
The recipient entities are not named.
Sharing & Disclosure · Company practice
Affiliates, including Microsoft, may receive data for marketing, advertising and AI training, among other purposes
Personal Data may be shared with GitHub affiliates, including Microsoft, for customer service, marketing and advertising, order fulfillment, billing, technical support, legal and compliance obligations, product development and improvement (including training and improving artificial intelligence and machine learning technologies), and for other purposes described in the affiliates' own privacy statements. GitHub says affiliates will process the data in line with applicable law and their privacy commitments.
Supporting quotations
We may share Personal Data with the following recipients:
Personal Data may be shared with GitHub affiliates, including Microsoft, to facilitate customer service, marketing and advertising, order fulfillment, billing, technical support, legal and compliance obligations, product development and improvement (including training and improving artificial intelligence and machine learning technologies), and for other purposes described in their respective privacy statements.
When we share data with affiliates, they will process it in accordance with applicable law and their privacy commitments.
Qualifications & exceptions
Affiliates may also use the data for "other purposes described in their respective privacy statements", which are not supplied here, so the purposes are not limited to the listed ones.
Not stated here
Which affiliates besides Microsoft receive data, and which data, is not stated.
Sharing & Disclosure · Company practice
If an organization adds you to its account, GitHub may share your data with that organization
If an organization adds you to its GitHub account, GitHub might share Personal Data with that organization to fulfill the commercial relationship. In that case your use of the Services is covered by a data protection agreement and terms between your organization and GitHub.
Supporting quotations
We may share Personal Data with the following recipients:
If an organization adds you to their GitHub account, we might share Personal Data with that organization to fulfill the commercial relationship.
In such a case, your use of the Services is protected by a data protection agreement and terms between your organization and GitHub
Qualifications & exceptions
The data protection agreement and terms with the organization are not supplied.
Legal Rights & Agreement Rules · Company practice
GitHub may disclose data to law enforcement, regulators and courts on lawful request or to protect its rights
GitHub may disclose Personal Data to authorized law enforcement, regulators, courts or other public authorities in response to lawful requests or to protect its rights and safety. More detail is in GitHub's Guidelines for Legal Requests of User Data, which is linked but not supplied.
Supporting quotations
We may share Personal Data with the following recipients:
We may disclose Personal Data to authorized law enforcement, regulators, courts, or other public authorities in response to lawful requests or to protect our rights and safety.
Qualifications & exceptions
Disclosure can also happen "to protect our rights and safety", not only on a lawful request.
The linked legal-request guidelines are not supplied.
Sharing & Disclosure · Company practice
Data may be disclosed in a sale, merger or other strategic business transaction
GitHub might disclose Personal Data, within the limits of the law and in line with this Statement, for strategic business transactions such as a sale or merger.
Supporting quotations
We may share Personal Data with the following recipients:
Corporate Transaction Entities: we might disclose Personal Data within the limits of the law and in accordance with this Privacy Statement for strategic business transactions such as sales or a merger.
Qualifications & exceptions
Disclosure is limited to what the law allows and to this Statement's terms.
Sharing & Disclosure · Company practice
Partners and resellers may receive your data where allowed, with your consent when required
GitHub works with third parties offering sales, consulting, support and technical services for its Services, and may share your data with these partners and resellers where allowed, and with your consent when required.
Supporting quotations
We may share Personal Data with the following recipients:
We cooperate with third-parties that offer sales, consulting, support, and technical services for our Services.
We may share your data with these partners and resellers where allowed, and with your consent when required.
Qualifications & exceptions
Consent is sought only "when required"; otherwise sharing happens "where allowed".
Not stated here
When consent is required is not specified.
Sharing & Disclosure · Company practice
Vendors handle hosting, marketing, advertising, analytics, payments and security under contract
GitHub may use vendors to provide services on its behalf, including hosting, marketing, advertising, social, analytics, support ticketing, credit card processing and security services. GitHub says they are bound by contractual obligations to ensure the security, privacy and confidentiality of your information. A list of Subprocessors is published on a linked page that is not supplied.
Supporting quotations
We may share Personal Data with the following recipients:
We may use vendors to provide services on our behalf, including hosting, marketing, advertising, social, analytics, support ticketing, credit card processing, or security services.
They are bound by contractual obligations to ensure the security, privacy, and confidentiality of your information.
Qualifications & exceptions
The subprocessor list is on a linked page that is not supplied.
Data Access & Collection · User right or choice
Codespaces and github.dev collect some VS Code telemetry by default; you can opt out in VS Code settings
GitHub Codespaces and github.dev offer Visual Studio Code in a web browser, where some telemetry is collected by default. Details are on the VS Code website. To opt out, go to File > Preferences > Settings in VS Code; opting out syncs that preference across all future web sessions in Codespaces and github.dev.
Supporting quotations
GitHub Codespaces and github.dev offer Visual Studio Code in a web browser, where some telemetry is collected by default.
To opt out, go to File > Preferences > Settings in the top left menu of VS Code. Opting out will sync this preference across all future web sessions in GitHub Codespaces and github.dev.
Qualifications & exceptions
Telemetry is on by default; you must opt out.
The opt-out applies to future web sessions.
Not stated here
The telemetry details are on the VS Code website, which is not supplied.
The recipient of the telemetry is not named in this passage, although it is listed under sharing.
Sharing & Disclosure · Restriction or exception
On your instruction, GitHub may share data with Marketplace apps; you are responsible for what you share
Upon your instruction, GitHub may share Personal Data with third-party applications available on its Marketplace. You are responsible for the data you instruct GitHub to share with these applications.
Supporting quotations
We may share Personal Data with the following recipients:
Upon your instruction, we may share Personal Data with third-party applications available on our Marketplace. You are responsible for the data you instruct us to share with these applications.
Sharing & Disclosure · User right or choice
Depending on your settings, your data may be shared with other users and the public
Depending on your account settings, GitHub may share Personal Data with other users and the public. You control what information is made public and can change it under User Settings in your profile. Anything you share in a collaborative context may become publicly accessible.
Supporting quotations
We may share Personal Data with the following recipients:
Depending on your account settings, we may share Personal Data with other users of the Services and the public. You control what information is made public.
Please be aware that any information you share in a collaborative context may become publicly accessible.
Qualifications & exceptions
Information shared in a collaborative context may become public regardless of profile settings.
Content & IP Rights · Context
GitHub's access to private repositories is governed by Section E of the GitHub Terms of Service
If your account has private repositories, GitHub's ability and rights to access private repository information are set out in Section E (Private Repositories) of the GitHub Terms of Service, not in this Statement.
Supporting quotations
If your GitHub account has private repositories, our ability and rights to access private repository information is set forth in Section E (Private Repositories) of the GitHub Terms of Service.
Qualifications & exceptions
The GitHub Terms of Service are a separate document not supplied with this Statement.
Not stated here
What Section E of the Terms permits is not stated here.
Legal Rights & Agreement Rules · Context
For EEA and UK users, GitHub relies on a lawful basis under the GDPR that varies by data and context
For EEA and UK end users, GitHub says it processes Personal Data in compliance with the GDPR with a lawful basis for each processing activity. The basis varies with the data type and context, including how you access the Services, and typically falls under contractual necessity, legal obligation, legitimate interests or consent.
Supporting quotations
Lawful Bases for Processing Personal Data (Applicable to EEA and UK End Users)
GitHub processes Personal Data in compliance with the GDPR, ensuring a lawful basis for each processing activity.
The basis varies depending on the data type and the context, including how you access the services.
Qualifications & exceptions
The heading limits this section to EEA and UK end users.
The GDPR is an external law; its content is not supplied by this Statement.
Not stated here
The Statement does not map each purpose to a specific lawful basis.
Legal Rights & Agreement Rules · Context
EEA/UK: contractual necessity and legal obligation are lawful bases for processing
For EEA and UK end users, GitHub processes data when required to fulfill its contractual duties to you under the GitHub Terms of Service, and when necessary to comply with applicable laws or to protect the rights, safety and property of GitHub, its affiliates, users or third parties.
Supporting quotations
Lawful Bases for Processing Personal Data (Applicable to EEA and UK End Users)
Contractual Necessity: Processing is required to fulfill our contractual duties to you, in accordance with the GitHub Terms of Service.
Legal Obligation: We process data when it's necessary to comply with applicable laws or to protect the rights, safety, and property of GitHub, our affiliates, users, or third parties.
Qualifications & exceptions
The legal-obligation item also covers protecting rights, safety and property of GitHub, affiliates, users or third parties.
Legal Rights & Agreement Rules · Context
EEA/UK: GitHub relies on legitimate interests for security, communication and AI development
For EEA and UK end users, GitHub processes data for purposes in its legitimate interests, such as securing the Services, communicating with you, and developing and improving the Services including artificial intelligence and machine learning technologies. It does so only when those interests are not overridden by your data protection rights or fundamental rights and freedoms.
Supporting quotations
Lawful Bases for Processing Personal Data (Applicable to EEA and UK End Users)
We process data for purposes that are in our legitimate interests, such as securing our Services, communicating with you, and developing and improving our Services, which include artificial intelligence and machine learning technologies.
This is done only when these interests are not overridden by your data protection rights or your fundamental rights and freedoms.
Qualifications & exceptions
Limited to cases where GitHub's interests are not overridden by your rights and freedoms.
Legal Rights & Agreement Rules · User right or choice
EEA/UK: where processing relies on consent, you can withdraw it at any time
For EEA and UK end users, GitHub processes some data because you explicitly consented. Where consent is the legal basis, you can withdraw it at any time; GitHub says withdrawal procedures are in this Statement and on its website.
Supporting quotations
Lawful Bases for Processing Personal Data (Applicable to EEA and UK End Users)
Consent: We process data when you have explicitly consented to such processing. When we rely on consent as the legal basis, you have the right to withdraw your consent for data processing at any time.
The procedures for withdrawal are detailed in this Statement and available on our website.
Not stated here
Which processing relies on consent is not listed here.
Account & Service Control · User right or choice
Depending on where you live, you may access your data and request details of what was collected in the past 12 months
Depending on where you live, you may have the right to access the data collected about you and to request detailed information about the specific types of Personal Data GitHub collected over the past 12 months, including data disclosed for business purposes.
Supporting quotations
Depending on your residence location, you may have specific legal rights regarding your Personal Data:
The right to access the data collected about you
The right to request detailed information about the specific types of Personal Data we've collected over the past 12 months, including data disclosed for business purposes
Qualifications & exceptions
These rights depend on where you live; the Statement says you "may" have them.
Account & Service Control · User right or choice
You may be able to correct, erase, limit or object to processing of your data, under conditions
Depending on where you live, you may have the right to rectify or update inaccurate or incomplete Personal Data under certain circumstances, to erase or limit its processing under specific conditions, and to object to processing as allowed by applicable law.
Supporting quotations
Depending on your residence location, you may have specific legal rights regarding your Personal Data:
The right to rectify or update inaccurate or incomplete Personal Data under certain circumstances
The right to erase or limit the processing of your Personal Data under specific conditions
The right to object to the processing of your Personal Data, as allowed by applicable law
Qualifications & exceptions
These rights depend on where you live; the Statement says you "may" have them.
Each right is conditional: "under certain circumstances", "under specific conditions" or "as allowed by applicable law".
Not stated here
The circumstances and conditions are not specified in the Statement.
Account & Service Control · User right or choice
You may withdraw consent and receive your data in a portable machine-readable format where feasible
Depending on where you live, you may have the right to withdraw consent where processing is based on it, and to receive your collected Personal Data in a structured, commonly used, machine-readable format to transfer it to another company, where technically feasible.
Supporting quotations
Depending on your residence location, you may have specific legal rights regarding your Personal Data:
The right to withdraw consent, where processing is based on your consent
The right to receive your collected Personal Data in a structured, commonly used, and machine-readable format to facilitate its transfer to another company, where technically feasible
Qualifications & exceptions
These rights depend on where you live; the Statement says you "may" have them.
Portability applies only where technically feasible; withdrawal applies only to consent-based processing.
Account & Service Control · Procedure
Exercise rights by emailing privacy@github.com; GitHub may ask for more information to verify your identity
To exercise these rights you email privacy[at]github[dot]com and follow the instructions. GitHub may request extra information to verify your identity before handling the request. Feedback or concerns go to the Data Protection Officer at dpo[at]github[dot]com.
Supporting quotations
To exercise these rights, please send an email to privacy[at]github[dot]com and follow the instructions provided.
To verify your identity for security, we may request extra information before addressing your data-related request.
Please contact our Data Protection Officer at dpo[at]github[dot]com for any feedback or concerns.
Legal Rights & Agreement Rules · User right or choice
Depending on region, you can complain to your local Data Protection Authority, such as the UK ICO
Depending on your region, you have the right to complain to your local Data Protection Authority. European users can find authority contacts on the European Data Protection Board website and UK users on the Information Commissioner's Office website.
Supporting quotations
Depending on your region, you have the right to complain to your local Data Protection Authority.
European users can find authority contacts on the European Data Protection Board website, and UK users on the Information Commissioner’s Office website.
Qualifications & exceptions
Available depending on your region.
Retention & Deletion · Restriction or exception
GitHub aims to respond promptly but may keep some data for legal obligations or legal claims
GitHub aims to respond promptly to rights requests in line with legal requirements. It may retain certain data as necessary for legal obligations or for establishing, exercising or defending legal claims.
Supporting quotations
We aim to promptly respond to requests in compliance with legal requirements.
Please note that we may retain certain data as necessary for legal obligations or for establishing, exercising, or defending legal claims.
Qualifications & exceptions
This retention exception limits erasure requests.
Not stated here
No response deadline is stated; "promptly" is an aim.
Your data is stored and processed in many countries, including the United States
GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States and other countries where GitHub, its affiliates, subsidiaries or subprocessors operate.
Supporting quotations
GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations.
Legal Rights & Agreement Rules · Company practice
Transfers from the EU, UK and Switzerland to non-adequate countries generally rely on standard contractual clauses
GitHub transfers Personal Data from the European Union, the United Kingdom and Switzerland to countries the European Commission has not recognized as providing adequate protection. For such transfers it generally relies on the standard contractual clauses published by the European Commission under Commission Implementing Decision 2021/914, to help your protections travel with your data.
Supporting quotations
We transfer Personal Data from the European Union, the United Kingdom, and Switzerland to countries that the European Commission has not recognized as having an adequate level of data protection.
When we engage in such transfers, we generally rely on the standard contractual clauses published by the European Commission under
Qualifications & exceptions
GitHub "generally" relies on standard contractual clauses, so other mechanisms (such as the Data Privacy Framework described separately) may apply.
The Commission decision is an external legal instrument and is not supplied.
Legal Rights & Agreement Rules · Company commitment
GitHub is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension
GitHub says it complies with the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework as set by the U.S. Department of Commerce, and has certified that it adheres to the related Principles for personal data received from the EU, the UK (and Gibraltar) and Switzerland in reliance on those frameworks. If this Statement conflicts with the EU-U.S. or Swiss-U.S. DPF Principles, the Principles govern.
Supporting quotations
GitHub also complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.
GitHub has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.
If there is any conflict between the terms in this privacy statement and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.
Qualifications & exceptions
Applies to personal data received in reliance on the frameworks from the EU, UK (and Gibraltar) and Switzerland.
The DPF Principles are external and not supplied here.
Legal Rights & Agreement Rules · Company commitment
GitHub stays liable under the DPF if its agents mishandle transferred data, unless it proves it is not responsible
GitHub is responsible for personal data it receives under the DPF Principles and then transfers to a third party acting as its agent. It remains liable under the Principles if the agent processes the data inconsistently with them, unless it proves it is not responsible for the event that caused the damage.
Supporting quotations
GitHub has the responsibility for the processing of Personal Data it receives under the Data Privacy Framework (DPF) Principles and subsequently transfers to a third party acting as an agent on GitHub’s behalf.
GitHub shall remain liable under the DPF Principles if its agent processes such Personal Data in a manner inconsistent with the DPF Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.
Qualifications & exceptions
Liability ends if GitHub proves it is not responsible for the event giving rise to the damage.
Legal Rights & Agreement Rules · Procedure
DPF complaints go first to GitHub's DPO, then to a free independent dispute service and possibly binding arbitration
EU, UK and Swiss individuals with DPF-related inquiries or complaints should first contact GitHub at dpo[at]github[dot]com. If GitHub does not acknowledge the complaint in a timely way or does not resolve it to your satisfaction, you can use the International Centre for Dispute Resolution service at no cost to you. Under certain conditions you may invoke binding arbitration for DPF complaints not resolved by the other DPF mechanisms.
Supporting quotations
GitHub commits to resolve DPF Principles-related complaints about our collection and use of your personal information.
EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension, and the Swiss-U.S. DPF should first contact GitHub at: dpo[at]github[dot]com.
If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit
The services of the International Centre for Dispute Resolution are provided at no cost to you.
An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.
Qualifications & exceptions
Limited to complaints about personal data received in reliance on the DPF.
Binding arbitration is available only under certain conditions and after other DPF mechanisms.
Not stated here
The conditions for arbitration are on an external page not supplied.
Legal Rights & Agreement Rules · Context
GitHub is subject to FTC enforcement of its DPF commitments
GitHub is subject to the investigatory and enforcement powers of the Federal Trade Commission. Under Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), failing to keep DPF commitments may be challenged as deceptive by the FTC, which can prohibit such misrepresentations through administrative orders or court orders.
Supporting quotations
GitHub is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).
Under Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), an organization's failure to abide by commitments to implement the DPF Principles may be challenged as deceptive by the FTC.
Qualifications & exceptions
Section 5 of the Federal Trade Commission Act is an external law cited by the Statement; its text is not supplied.
Security & Safeguards · Company commitment
GitHub uses administrative, technical and physical security controls to protect your data
GitHub says it uses appropriate administrative, technical and physical security controls to protect your Personal Data. The separate Security section words this as using such controls "where appropriate".
Supporting quotations
GitHub uses appropriate administrative, technical, and physical security controls to protect your Personal Data.
GitHub uses administrative, technical, and physical security controls where appropriate to protect your Personal Data.
Qualifications & exceptions
The two security statements differ slightly: one says "appropriate" controls, the other "where appropriate"; neither names specific measures.
Not stated here
No specific security measures or standards are named.
Retention & Deletion · Company practice
Data is kept while your account is active and as needed for contracts, legal duties, disputes and enforcement
GitHub retains your Personal Data as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes and enforce agreements. The retention period depends on the purpose of collection and any legal obligations.
Supporting quotations
We’ll retain your Personal Data as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements.
The retention duration depends on the purpose of data collection and any legal obligations.
Qualifications & exceptions
Retention can continue after account closure where needed for the listed purposes.
Not stated here
No specific retention periods are given.
Legal Rights & Agreement Rules · Procedure
Contact GitHub through its contact form or the Data Protection Officer; GitHub B.V. and GitHub, Inc. addresses are given
You can contact GitHub through its contact form or by emailing its Data Protection Officer at dpo[at]github[dot]com. The listed addresses are GitHub B.V. in Amsterdam, the Netherlands, and GitHub, Inc. in San Francisco, United States.
Supporting quotations
Contact us via our contact form or by emailing our Data Protection Officer at dpo[at]github[dot]com.
GitHub B.V. Prins Bernhardplein 200, Amsterdam 1097JB The Netherlands
GitHub, Inc. 88 Colin P. Kelly Jr. St. San Francisco, CA 94107 United States
Account & Service Control · Restriction or exception
The Services are not intended for children under 13, and GitHub does not intentionally collect their data
GitHub's Services are not intended for individuals under 13, and GitHub does not intentionally gather Personal Data from them. If you become aware that a minor has provided Personal Data, you are asked to notify GitHub.
Supporting quotations
Our Services are not intended for individuals under the age of 13. We do not intentionally gather Personal Data from such individuals.
Qualifications & exceptions
The commitment is not to collect "intentionally"; it does not say collection never happens.
Not stated here
The Statement does not say what GitHub does after being notified.
Legal Rights & Agreement Rules · Company commitment
Material changes to the Statement get at least 30 days' notice by website update or email
GitHub may revise the Statement periodically. For material changes it will give at least 30 days' prior notice by updating its website or by emailing the primary email address on your GitHub account.
Supporting quotations
GitHub may periodically revise this Privacy Statement.
If there are material changes to the statement, we will provide at least 30 days prior notice by updating our website or sending an email to your primary email address associated with your GitHub account.
Qualifications & exceptions
The 30-day notice applies only to material changes, and a website update alone can count as notice.
Not stated here
What counts as a material change is not defined.
Legal Rights & Agreement Rules · Context
The English version controls over translations; a French PDF and other languages are offered
The Statement offers translations, including a French version as a PDF and other languages through the docs site's language menu. If any translation conflicts with, is uncertain against or appears inconsistent with the English version, the English version controls.
Supporting quotations
In the event of any conflict, uncertainty, or apparent inconsistency between any of those versions and the English version, this English version is the controlling version.
Cliquez ici pour obtenir la version française: Déclaration de confidentialité de GitHub (PDF).
For translations of this statement into other languages, please visit
Qualifications & exceptions
The translations themselves are not supplied; only the English text is analyzed.
Data Access & Collection · Company practice
Cookies keep you logged in, remember preferences, secure your device and compile statistics
GitHub uses cookies to provide, secure and improve its Service and to develop new features, for example to keep you logged in, remember your preferences, identify your device for security and fraud purposes, compile statistical reports and inform future development. It also uses similar technologies such as web beacons, local storage and mobile analytics to operate and provide the Services. GitHub says it provides more information about the cookies it sets, why, and when they expire.
Supporting quotations
GitHub uses cookies to provide, secure and improve our Service or to develop new features and functionality of our Service.
For example, we use them to (i) keep you logged in, (ii) remember your preferences, (iii) identify your device for security and fraud purposes, including as needed to maintain the integrity of our Service, (iv) compile statistical reports, and (v) provide information and insight for future development of GitHub.
We use cookies and similar technologies, such as web beacons, local storage, and mobile analytics, to operate and provide our Services.
Qualifications & exceptions
In the saved version this cookie text follows the "Other translations" heading without a heading of its own; it is read as the Statement's cookie section.
Not stated here
The more detailed cookie list it mentions is not supplied in this text.
Linking & Identification · Company practice
On Enterprise Marketing Pages such as resources.github.com, non-essential cookies and ad IDs serve targeted advertising
On Enterprise Marketing Pages, such as resources.github.com, GitHub may also use non-essential cookies and additional technologies like advertising IDs to gather information about enterprise users' interests and online activities to personalize ads, content, recommendations and marketing, and to serve and measure targeted advertising. On mobile devices, mobile identifiers may let GitHub and its third-party analytics and advertising partners collect data for sales and marketing. GitHub says it will place non-essential cookies on pages where it markets to enterprise customers. If you disable non-essential cookies there, the ads and content you see may be less relevant.
Supporting quotations
For Enterprise Marketing Pages, we may also use non-essential cookies to (i) gather information about enterprise users’ interests and online activities to personalize their experiences, including by making the ads, content, recommendations, and marketing seen or received more relevant and (ii) serve and measure the effectiveness of targeted advertising and other marketing efforts.
If you disable the non-essential cookies on the Enterprise Marketing Pages, the ads, content, and marketing you see may be less relevant.
When visiting Enterprise Marketing Pages, like resources.github.com, these and additional cookies, like advertising IDs, may be used for sales and marketing purposes.
When visiting Enterprise Marketing pages, like resources.github.com, on a mobile device these may allow us and our third-party analytics and advertising partners to collect data for sales and marketing purposes.
GitHub will place non-essential cookies on pages where we market products and services to enterprise customers, for example, on resources.github.com.
Qualifications & exceptions
In the saved version this cookie text follows the "Other translations" heading without a heading of its own; it is read as the Statement's cookie section.
This describes Enterprise Marketing Pages; the separate cookie bullet says consent is required first only in some jurisdictions.
Not stated here
How to disable these cookies is not described in this passage.
Data Access & Collection · Company practice
Emails may contain a pixel tag that tells GitHub whether you opened them and your IP address
GitHub's emails to users may contain a pixel tag, a small clear image that can show whether you opened the email and what your IP address is. GitHub says it uses it to make its emails more effective and to avoid sending you unwanted email.
Supporting quotations
Our emails to users may contain a pixel tag, which is a small, clear image that can tell us whether or not you have opened an email and what your IP address is.
We use this pixel tag to make our email communications more effective and to make sure we are not sending you unwanted email.
Qualifications & exceptions
In the saved version this cookie text follows the "Other translations" heading without a heading of its own; it is read as the Statement's cookie section.
Retention & Deletion · Context
Session cookies last until you stop browsing; persistent cookies last until they expire or are deleted
How long a cookie stays depends on its type: session cookies stay only until you stop browsing, while persistent cookies stay until they expire or are deleted. A persistent cookie's expiry depends on its purpose and the tool used. You may be able to delete cookie data.
Supporting quotations
Session cookies will only stay on your device until you stop browsing. Persistent cookies stay until they expire or are deleted.
The expiration time or retention period applicable to persistent cookies depends on the purpose of the cookie collection and tool used. You may be able to delete cookie data.
Qualifications & exceptions
In the saved version this cookie text follows the "Other translations" heading without a heading of its own; it is read as the Statement's cookie section.
Deleting cookie data is described as something you "may be able" to do.
Not stated here
No specific expiry periods are given.
Linking & Identification · Context
Cookies, web beacons and third-party content let servers, often third parties, recognize your browser
Cookies are small text files your browser stores that can uniquely identify your device and let a web server recognize your browser over time. Web beacons are single-pixel images in websites or emails that make your browser connect to the server hosting the image, typically run by a third party, which can log device information and set and read its own cookies. Third-party content on GitHub's websites, such as embedded videos, plug-ins or ads, likewise connects your browser to the third party's server.
Supporting quotations
The text in a cookie contains a string of numbers and letters that may uniquely identify your device and can contain other information as well.
This allows the web server to recognize your browser over time, each time it connects to that web server.
When your browser opens a webpage or email that contains a web beacon, it automatically connects to the web server that hosts the image (typically operated by a third party).
This allows that web server to log information about your device and to set and read its own cookies.
In the same way, third-party content on our websites (such as embedded videos, plug-ins, or ads) results in your browser connecting to the third-party web server that hosts that content.
Qualifications & exceptions
In the saved version this cookie text follows the "Other translations" heading without a heading of its own; it is read as the Statement's cookie section.
Data Access & Collection · Company practice
GitHub may use flash cookies (Local Shared Objects) to store information about your use
GitHub may also use flash cookies, also known as Local Shared Objects, to collect and store information about your use of the Services. The Statement notes these are commonly used for advertisements and videos.
Supporting quotations
We may also use so-called “flash cookies” (also known as “Local Shared Objects” or “LSOs”) to collect and store information about your use of our Services.
Flash cookies are commonly used for advertisements and videos.
Qualifications & exceptions
In the saved version this cookie text follows the "Other translations" heading without a heading of its own; it is read as the Statement's cookie section.
Not stated here
The Statement does not say how flash cookies can be removed or controlled.
Linking & Identification · Company practice
Cookies track use and support inferences; ad partners may track you across services for targeted ads
GitHub's Services use cookies and similar technologies to store preferences, enable sign-in, analyze performance, track your interaction with the Services, develop inferences, combat fraud and other legitimate purposes. Some are provided by third parties, including service providers and advertising partners, which may use them to collect personal information such as pages visited, links clicked, identifiers and device information about your online activities over time and across Services, including for targeted advertising.
Supporting quotations
The GitHub Services use cookies and similar technologies for a variety of purposes, including to store your preferences and settings, enable you to sign-in, analyze how our Services perform, track your interaction with the Services, develop inferences, combat fraud, and fulfill other legitimate purposes.
Some of these cookies and technologies may be provided by third parties, including service providers and advertising partners.
For example, our analytics and advertising partners may use these technologies in our Services to collect personal information (such as the pages you visit, the links you click on, and similar usage information, identifiers, and device information) related to your online activities over time and across Services for various purposes, including targeted advertising.
Qualifications & exceptions
In the saved version this cookie text follows the "Other translations" heading without a heading of its own; it is read as the Statement's cookie section.
The cookie bullet earlier says non-essential cookies are used only after consent in some jurisdictions; this passage does not restate that limit.
Not stated here
The Statement does not say which Services, beyond Enterprise Marketing Pages, carry third-party advertising cookies.
Sharing & Disclosure · Company practice
GitHub and its partners share collected or inferred information with third parties for these cookie purposes
GitHub and/or its partners also share the information collected or inferred through cookies and similar technologies with third parties for the cookie purposes described, including targeted advertising.
Supporting quotations
We and/or our partners also share the information we collect or infer with third parties for these purposes.
Qualifications & exceptions
In the saved version this cookie text follows the "Other translations" heading without a heading of its own; it is read as the Statement's cookie section.
"These purposes" refers back to the cookie purposes, which include targeted advertising.
Not stated here
The third parties are not named.
Data Access & Collection · Company practice
Required cookies run essential functions such as login, language, cart, traffic routing and audience measurement
In the cookie table, required cookies perform essential website functions and provide the services, for example logging you in, saving language preferences, providing a shopping cart, improving performance, routing traffic, detecting screen size, measuring page load times, improving user experience and audience measurement. GitHub says these cookies are necessary for its websites to work.
Supporting quotations
GitHub uses required cookies to perform essential website functions and to provide the services.
For example, cookies are used to log you in, save your language preferences, provide a shopping cart experience, improve performance, route traffic between web servers, detect the size of your screen, determine page load times, improve user experience, and for audience measurement.
These cookies are necessary for our websites to work.
Qualifications & exceptions
Row of the cookie table (Purpose / Description).
Audience measurement is listed among the required-cookie uses.
Linking & Identification · Company practice
Third parties may use analytics cookies on GitHub's websites, and some analytics cookies serve personalized ads
GitHub allows third parties to use analytics cookies to understand how you use its websites, for example which pages you visit and how many clicks a task takes. GitHub also uses some analytics cookies to provide personalized advertising.
Supporting quotations
We allow third parties to use analytics cookies to understand how you use our websites so we can make them better.
For example, cookies are used to gather information about the pages you visit and how many clicks you need to accomplish a task.
We also use some analytics cookies to provide personalized advertising.
Qualifications & exceptions
Row of the cookie table (Purpose / Description).
Linking & Identification · Company practice
Social media cookies target ads using your social profiles and GitHub activity, and help third parties build products
GitHub and third parties use social media cookies to show you ads and content based on your social media profiles and activity on GitHub's websites, so that ads on GitHub's websites and on social media reflect your interests. This also lets third parties develop and improve their products, which they may use on websites not owned or operated by GitHub.
Supporting quotations
GitHub and third parties use social media cookies to show you ads and content based on your social media profiles and activity on GitHub’s websites.
This also enables third parties to develop and improve their products, which they may use on websites that are not owned or operated by GitHub.
Qualifications & exceptions
Row of the cookie table (Purpose / Description).
Not stated here
The third parties are not named.
Linking & Identification · Company practice
Advertising cookies track ad clicks and later purchases, and show ads based on browsing history and social interests
GitHub and third parties use advertising cookies to show you new ads based on ads you have already seen. Cookies also track which ads you click and purchases you make after clicking an ad, both for payment purposes and to show you more relevant ads, including ads based on your social media interests and website browsing history.
Supporting quotations
In addition, GitHub and third parties use advertising cookies to show you new ads based on ads you've already seen.
Cookies also track which ads you click or purchases you make after clicking an ad. This is done both for payment purposes and to show you ads that are more relevant to you.
For example, cookies are used to detect when you click an ad and to show you ads based on your social media interests and website browsing history.
Qualifications & exceptions
Row of the cookie table (Purpose / Description).
Linking & Identification · User right or choice
Pages with non-essential cookies have a footer cookie-settings link; some users also get a consent banner
Among the options to disable non-essential cookies, specifically on GitHub Enterprise Marketing Pages: any GitHub page that serves non-essential cookies has a footer link to cookie settings where you can change your preferences at any time. Some users can also manage non-essential cookies through a consent banner with options to accept, manage or reject all of them.
Supporting quotations
You have several options to disable non-essential cookies:
Specifically on GitHub Enterprise Marketing Pages
Any GitHub page that serves non-essential cookies will have a link in the page’s footer to cookie settings. You can express your preferences at any time by clicking on that link and updating your settings.
Some users will also be able to manage non-essential cookies via a cookie consent banner, including the options to accept, manage, and reject all non-essential cookies.
Qualifications & exceptions
The banner is available only to "some users"; which users is not stated.
Linking & Identification · Company commitment
If your browser sends Do Not Track, GitHub will not set non-essential cookies or load third-party resources that do
If your browser sends a Do Not Track (DNT) signal, GitHub will not set non-essential cookies and will not load third-party resources that set non-essential cookies.
Supporting quotations
GitHub will not set non-essential cookies and will not load third party resources which set non-essential cookies.
If GitHub detects a Global Privacy Control signal, it will not share your data; GitHub says it does not sell data
You can use the Global Privacy Control (GPC) to communicate privacy preferences. If GitHub detects the GPC signal from your device, it will not share your data; GitHub also states that it does not sell your data.
Supporting quotations
You may use the Global Privacy Control (GPC) to communicate your privacy preferences. If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).
These choices are specific to the browser you are using.
Qualifications & exceptions
Applies when GitHub detects the signal from your device; the choices are browser-specific.
"Will not share your data" is not defined here; other sections describe sharing with service providers, affiliates and authorities.
Not stated here
Which kinds of sharing a GPC signal stops is not specified.
Browser controls, tracker and content blockers, and industry ad opt-outs can limit cookies and ad targeting
You can control cookies with widely available tools: many browsers offer cookie controls; tracking-blocking extensions such as Privacy Badger may disable non-essential cookies; content-blocking extensions such as uBlock Origin disable them to the extent that the content setting them is blocked. GitHub's advertising partners may participate in associations offering ad-targeting opt-outs, listed for the United States (NAI and DAA), Canada and Europe.
Supporting quotations
You can control the cookies you encounter on the web using a variety of widely-available tools.
Many browsers provide cookie controls which may limit the types of cookies you encounter online.
non-essential cookies set by a website or third parties may be disabled.
non-essential cookies will be disabled to the extent that content that sets non-essential cookies will be blocked.
Our advertising partners may participate in associations that provide simple ways to opt out of ad targeting, which you can access at:
United States:
Canada:
Europe:
Qualifications & exceptions
Partners "may" participate in these associations; participation is not guaranteed.
Linking & Identification · Procedure
Cookie choices are per browser; repeat them on each device and browser you use
These cookie choices are specific to the browser you use. If you access GitHub from other devices or browsers, you need to take these actions there for your choices to apply to data collected on those systems.
Supporting quotations
These choices are specific to the browser you are using. If you access our Services from other devices or browsers, take these actions from those systems to ensure your choices apply to the data collected when you use those systems.
Legal Rights & Agreement Rules · Context
Extra rights apply to residents of certain US states with their own privacy laws, once those laws take effect
The US State Specific Information section gives extra information for residents of certain US states with distinct privacy laws, which may grant specific rights when they come into effect. In this section "personal information" means the same as "Personal Data".
Supporting quotations
US State Specific Information
This section provides extra information specifically for residents of certain US states that have distinct data privacy laws and regulations. These laws may grant specific rights to residents of these states when the laws come into effect.
This section uses the term “personal information” as an equivalent to the term “Personal Data.”
Qualifications & exceptions
Rights depend on the state law applying to you and on that law being in effect.
Account & Service Control · User right or choice
US state residents can request details of the personal information collected and correct inaccuracies
Under rights common to US state privacy laws, you can request details of the specific personal information GitHub has collected about you and correct inaccurate information by contacting GitHub. You can also access and edit basic account information in your settings.
Supporting quotations
US State Specific Information
These rights are common to the US State privacy laws:
You have the right to request details on the specific personal information we’ve collected about you and the right to correct inaccurate information. You can exercise this right by contacting us. You can also access and edit basic account information in your settings.
Qualifications & exceptions
Applies to residents of certain US states with their own privacy laws; the states are not all named in this section.
Sharing & Disclosure · Context
Under US state rights, GitHub says it shares information with service providers for operations such as hosting
Under the right to know data recipients, GitHub says it shares your information with service providers for legitimate business operations, such as data storage and hosting, and points to a "Sharing Your Information" section below for details.
Supporting quotations
US State Specific Information
We share your information with service providers for legitimate business operations, such as data storage and hosting.
For more details, please see “Sharing Your Information” below.
Qualifications & exceptions
Applies to residents of certain US states with their own privacy laws; the states are not all named in this section.
This short description mentions only service providers; the California disclosures and the general sharing section list more recipients, including advertising networks and affiliates.
Not stated here
No section titled "Sharing Your Information" appears below in the saved version; the closest is "Sharing of Personal Data" earlier in the Statement.
Cross-references
contrast (model-proposed): California: identifiers, network activity and inferences were shared with ad, analytics and social networks — contrast: The US-state recipients right mentions only service providers for operations such as hosting, while the California disclosures say identifiers, network activity and inferences were "shared" with advertising networks, analytics providers and social networks. Read together, the shorter description is not a complete list of recipients.
Account & Service Control · User right or choice
US state residents can request deletion, subject to legal, fraud, abuse and security exceptions
You can request deletion of your data, except where GitHub must retain it to comply with legal obligations, detect fraud, investigate abuse reports or other Terms of Service violations, or fix security issues. On a verified request GitHub will promptly delete your personal information (unless an exception applies) and instruct its service providers to do the same. GitHub says it uses brief retention terms by design.
Supporting quotations
US State Specific Information
You reserve the right to request the deletion of your data, barring a few exceptions.
Such exceptions include circumstances where we are required to retain data to comply with legal obligations, detect fraudulent activity, investigate reports of abuse or other violations of our Terms of Service, or rectify security issues.
Upon receiving your verified request, we will promptly delete your personal information (unless an exception applies), and instruct our service providers to do the same.
We employ brief retention terms by design.
Qualifications & exceptions
Applies to residents of certain US states with their own privacy laws; the states are not all named in this section.
Deletion follows only a verified request and is subject to the listed exceptions, which are introduced by "include" and may not be exhaustive.
Not stated here
"Brief retention terms" are not quantified.
Account & Service Control · Company commitment
Two free requests per 12 months, answered within 45 days, extendable by 45 more in complex cases
You can make two free requests in any 12-month period. GitHub commits to responding within 45 days and may extend this by another 45 days in complex cases. GitHub will not hold it against you when you exercise your rights.
Supporting quotations
US State Specific Information
You are allowed to make two free requests in any 12-month period. We commit to responding to your request within 45 days. In complex cases, we may extend our response time by an additional 45 days.
We will not hold it against you when you exercise any of your rights.
Qualifications & exceptions
Applies to residents of certain US states with their own privacy laws; the states are not all named in this section.
Not stated here
The Statement does not say whether further requests in the same period are charged or refused.
Data Access & Collection · Company practice
US notice: collected categories include identifiers, demographics, payment, network activity, geolocation and inferences
GitHub may collect categories of personal information about website visitors and users of its Services, including identifiers and contact information, demographic information, payment and commercial information, internet or network activity, geolocation, audio, electronic, visual or similar information, and inferences drawn from them. It collects them for purposes including identifying accessibility gaps and offering targeted support, fostering diversity and representation, providing services, troubleshooting, billing and security, improving products and supporting research, communications, personalization, and safety and security.
Supporting quotations
US State Specific Information
That information includes identifiers/contact information, demographic information, payment information, commercial information, internet or electronic network activity information, geolocation data, audio, electronic, visual, or similar information, and inferences drawn from such information.
This includes identifying accessibility gaps and offering targeted support, fostering diversity and representation, providing services, troubleshooting, conducting business operations such as billing and security, improving products and supporting research, communicating important information, ensuring personalized experiences, and promoting safety and security.
Qualifications & exceptions
Applies to residents of certain US states with their own privacy laws; the states are not all named in this section.
Account & Service Control · Procedure
Make US state requests by emailing privacy@github.com; authorized agents need your signed permission
To make an access, deletion, correction or opt-out request, email privacy[at]github[dot]com and follow the instructions. GitHub may need to verify your identity first. An authorized agent may submit a request for you if they have your signed permission or power of attorney as required.
Supporting quotations
US State Specific Information
To make an access, deletion, correction, or opt-out request, please send an email to privacy[at]github[dot]com and follow the instructions provided. We may need to verify your identity before processing your request.
If you choose to use an authorized agent to submit a request on your behalf, please ensure they have your signed permission or power of attorney as required.
Qualifications & exceptions
Applies to residents of certain US states with their own privacy laws; the states are not all named in this section.
Sharing & Disclosure · User right or choice
Opt out of sharing via the footer "Do Not Share My Personal Information" link or Global Privacy Control
To opt out of the sharing of your personal information, you can click the "Do Not Share My Personal Information" link in the footer of GitHub's websites or use the Global Privacy Control if available. Authorized agents can also submit opt-out requests for you.
Supporting quotations
US State Specific Information
To opt out of the sharing of your personal information, you can click on the "Do Not Share My Personal Information" link on the footer of our Websites or use the Global Privacy Control ("GPC") if available. Authorized agents can also submit opt-out requests on your behalf.
Qualifications & exceptions
Applies to residents of certain US states with their own privacy laws; the states are not all named in this section.
California: categories collected in the last 12 months include identifiers, gender, payment card and inferences
For California compliance, GitHub discloses that in the last 12 months it collected identifiers and contact information, demographic information (such as gender), payment card information, commercial information, internet or network activity, geolocation, audio, electronic, visual or similar information, and inferences, from you directly, automatically or from third parties, for the purposes summarized in the Statement's Processing Purposes section.
Supporting quotations
California
We also make the following disclosures for purposes of compliance with California privacy law:
We collected the following categories of personal information in the last 12 months: identifiers/contact information, demographic information (such as gender), payment card information associated with you, commercial information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above.
The sources of personal information from whom we collected are: directly from you, automatically or from third parties.
The business or commercial purposes of collecting personal information are as summarized above and in our Privacy Statement under Processing Purposes.
Qualifications & exceptions
California disclosure covering the last 12 months.
Sharing & Disclosure · Context
California: all listed categories were disclosed for business purposes to partners, providers and social sites
GitHub discloses that in the last 12 months it disclosed, for a business purpose, identifiers and contact information, demographic information (such as gender and rough geographic location), payment and commercial information, network activity, geolocation, audio, electronic, visual or similar information, and inferences. Each category went to third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third parties described in the Sharing of Personal Data section.
Supporting quotations
California
We also make the following disclosures for purposes of compliance with California privacy law:
We disclosed the following categories of personal information for a business purpose in the last 12 months: identifiers/contact information, demographic information (such as gender and rough geographic location), payment information, commercial information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above.
We disclosed each category to third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third parties as described in the Sharing of Personal Data section of our Privacy Statement.
Qualifications & exceptions
California disclosure covering the last 12 months.
Sharing & Disclosure · Context
California: identifiers, network activity and inferences were shared with ad, analytics and social networks
As defined by applicable law, GitHub says it "shared" identifiers and contact information, internet or network activity information and inferences in the last 12 months with advertising networks, data analytics providers and social networks, to help with marketing, advertising and audience measurement.
Supporting quotations
California
We also make the following disclosures for purposes of compliance with California privacy law:
As defined by applicable law, we “shared” the following categories of personal information in the last 12 months: identifiers/contact information, Internet or other electronic network activity information, and inferences drawn from the above. We shared each category to or with advertising networks, data analytics providers, and social networks.
The business or commercial purpose of sharing personal information is to assist us with marketing, advertising, and audience measurement.
Qualifications & exceptions
"Shared" is used in the sense of applicable law, which the Statement does not define here.
You can opt out of this sharing via the footer link or Global Privacy Control.
Sharing & Disclosure · Company commitment
GitHub does not sell or share the personal information of known minors under 16
In its California disclosures GitHub states that it does not "sell" or "share" the personal information of known minors under 16 years of age.
Supporting quotations
We do not “sell” or “share” the personal information of known minors under 16 years of age.
Qualifications & exceptions
Limited to "known" minors under 16; "sell" and "share" are used in their legal sense.
Sharing & Disclosure · Company commitment
California Shine the Light: GitHub says it does not disclose personal information for third parties' direct marketing
Under California Civil Code section 1798.83 (the "Shine the Light" law), California Customers may ask whether a business disclosed personal information to third parties for those parties' direct marketing. GitHub says it does not make such disclosures as defined by that law. California Customers can ask for more information by emailing privacy[at]github[dot]com; businesses must answer one request per customer each year and may not have to answer requests sent another way.
Supporting quotations
Under California Civil Code section 1798.83, also known as the “Shine the Light” law,
Please be aware that we do not disclose personal information to any third parties for their direct marketing purposes as defined by this law.
California Customers may request further information about our compliance with this law by emailing (privacy[at]github[dot]com). Please note that businesses are required to respond to one request per California Customer each year and may not be required to respond to requests made by means other than through the designated email address.
Qualifications & exceptions
"Direct marketing purposes" is used as defined by the cited California law, which is not supplied.
Separately, GitHub discloses that it "shared" some categories with advertising networks for marketing and advertising (gh-ps-095); the two statements use different legal terms.
Cross-references
contrast (model-proposed): California: identifiers, network activity and inferences were shared with ad, analytics and social networks — contrast: GitHub says it does not disclose personal information for third parties' own direct marketing under the Shine the Light law, yet it also says it "shared" some categories with advertising networks for its own marketing and advertising. The statements use different legal terms; the first concerns third parties' direct marketing, the second sharing for GitHub's advertising.
Content & IP Rights · User right or choice
California residents under 18 can remove or request removal of content they publicly posted, without a guarantee
California residents under 18 who are registered users have a right under California Business and Professions Code Section 22581 to remove, or request removal of, content or information they publicly posted. You can submit a Private Information Removal request or send GitHub support a detailed description. A request does not guarantee complete or comprehensive removal, and the law may not permit or require removal in some circumstances.
Supporting quotations
California residents under the age of 18 who are registered users of online sites, services, or applications have a right under California Business and Professions Code Section 22581 to remove, or request and obtain removal of, content or information they have publicly posted.
Please be aware that your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.
Qualifications & exceptions
Limited to California residents under 18 who are registered users.
Removal is not guaranteed.
Legal Rights & Agreement Rules · Procedure
Questions about privacy practices can go to the Data Protection Officer
GitHub says it values your trust and is committed to handling your personal information with care and respect, and invites questions or concerns to its Data Protection Officer at dpo[at]github[dot]com.
Supporting quotations
If you have any questions or concerns about our privacy practices, please email our Data Protection Officer at dpo[at]github[dot]com.
Account & Service Control · User right or choice
Colorado, Connecticut and Virginia residents can appeal a denied rights request
If you live in Colorado, Connecticut or Virginia and GitHub denies your rights request, you can appeal; GitHub will provide the information needed to appeal at that time.
Supporting quotations
If you live in Colorado, Connecticut, or Virginia you have some additional rights:
If we deny your rights request, you have the right to appeal that decision. We will provide you with the necessary information to submit an appeal at that time.
Inference & Profiling · Company commitment
GitHub says it does no profiling with legal or similarly significant effects as defined by Colorado law
Residents of Colorado, Connecticut and Virginia have the right to opt out of profiling that furthers decisions with legal or similarly significant effects. GitHub says it does not engage in such profiling as defined by Colorado law, so there is no need to opt out.
Supporting quotations
If you live in Colorado, Connecticut, or Virginia you have some additional rights:
You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. GitHub does not engage in such profiling as defined by Colorado law, so there’s no need to opt out.
Qualifications & exceptions
The no-profiling statement is framed by Colorado law's definition, though the right is listed for Colorado, Connecticut and Virginia.
GitHub does infer characteristics for other purposes (gh-ps-028); this statement concerns only profiling with legal or similarly significant effects.
Sharing & Disclosure · Company commitment
Nevada: GitHub says it does not sell covered information under Chapter 603A
GitHub says it does not sell your covered information as defined under Chapter 603A of the Nevada Revised Statutes. Questions can go to privacy[at]github[dot]com.
Supporting quotations
We do not sell your covered information, as defined under Chapter 603A of the Nevada Revised Statutes.
Qualifications & exceptions
"Covered information" and "sell" have the meaning in the cited Nevada law, which is not supplied.