GitHub General Privacy Statement

GitHub · agreement dated April 27, 2026 · Official agreement

Read the agreement

4 of 118 cards in Retention & Deletion

Retention & Deletion · Restriction or exception

GitHub aims to respond to requests promptly but may keep certain data for legal obligations or legal claims

GitHub says it aims to respond promptly to requests in compliance with legal requirements. It notes that it may retain certain data as necessary for legal obligations or for establishing, exercising or defending legal claims. The aim to respond promptly is not a fixed deadline in this section.

Details
What it does
respond promptly; retain certain data
Exception
legal obligations or legal claims

Supporting quotations

We aim to promptly respond to requests in compliance with legal requirements. Please note that we may retain certain data as necessary for legal obligations or for establishing, exercising, or defending legal claims.

Qualifications & exceptions

  • Retention is allowed as necessary for legal obligations or legal claims.

Not stated here

  • No response deadline is stated in this section; the US state section gives timing for some requests.

Retention & Deletion · Company practice

GitHub keeps Personal Data while your account is active and as needed for contracts, law, disputes and enforcement

GitHub says it retains your Personal Data as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes and enforce agreements. It says the retention duration depends on the purpose of the data collection and any legal obligations. No specific retention periods are given.

Details
What it does
retain Personal Data
Condition
while the account is active, and as needed for contracts, legal requirements, disputes and enforcement

Supporting quotations

We’ll retain your Personal Data as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements. The retention duration depends on the purpose of data collection and any legal obligations.

Qualifications & exceptions

  • Duration depends on the purpose of collection and legal obligations.

Not stated here

  • No specific retention periods are stated; what happens to data after account closure beyond these needs is not detailed.
Also annotated in the same passage (1)

Retention & Deletion · User right or choice

US state residents can request deletion, with exceptions; GitHub says it tells service providers to delete too

You can request deletion of your data, apart from a few exceptions. The exceptions given include circumstances where GitHub must retain data to comply with legal obligations, detect fraudulent activity, investigate reports of abuse or other violations of its Terms of Service, or rectify security issues. On receiving your verified request, GitHub says it will promptly delete your personal information unless an exception applies, and instruct its service providers to do the same. It adds that it employs brief retention terms by design.

Details
What it does
request deletion; GitHub deletes and instructs service providers to do the same
Exception
legal obligations, fraud detection, abuse or terms investigations, security fixes

Supporting quotations

Right to request Deletion: You reserve the right to request the deletion of your data, barring a few exceptions. Such exceptions include circumstances where we are required to retain data to comply with legal obligations, detect fraudulent activity, investigate reports of abuse or other violations of our Terms of Service, or rectify security issues. Upon receiving your verified request, we will promptly delete your personal information (unless an exception applies), and instruct our service providers to do the same. We employ brief retention terms by design.

Qualifications & exceptions

  • Deletion follows a verified request.
  • Exceptions: legal obligations, detecting fraud, investigating abuse or Terms of Service violations, and rectifying security issues.

Not stated here

  • "Brief retention terms" is not defined, and the exceptions are introduced as examples ("such exceptions include").