GitHub General Privacy Statement

Sharing & Disclosure · Context

Third-party extensions, integrations and linked sites handle data under their own privacy policies

If you use third-party extensions or integrations, or follow references and links within the Services, the privacy policies of those third parties apply to Personal Data you provide or consent to share with them. Their privacy statements govern how that data is processed. The Statement does not say what those third parties do with it.

Supporting quotations

When you use third-party extensions, integrations, or follow references and links within our Services, the privacy policies of these third parties apply to any Personal Data you provide or consent to share with them. Their privacy statements will govern how this data is processed.

Qualifications & exceptions

• Covers data you provide or consent to share with the third party.

Not stated here

• The third parties' own policies are not part of this source.

Sharing & Disclosure · Company practice

Buttons and content from other companies, such as Twitter or LinkedIn, can send browser information to those companies

The Services may contain links or buttons leading to third-party services such as Twitter or LinkedIn. Using these features may result in data collection, and engaging with the buttons, tools or content may automatically send certain browser information to those companies. GitHub tells you to review those companies' privacy statements.

Supporting quotations

Our Services may contain links or buttons that lead to third-party services like Twitter or LinkedIn. Use of these features may result in data collection. Engaging with these buttons, tools, or content may automatically send certain browser information to these companies. Please review the privacy statements of these companies for more information.

Qualifications & exceptions

• Happens when you engage with the third-party buttons, tools or content.

Not stated here

• The source does not say exactly which browser information is sent.

Sharing & Disclosure · Company practice

GitHub may share Personal Data with the listed categories of recipients

The Statement says GitHub "may" share Personal Data with the recipients listed below: abuse and fraud prevention entities, affiliates, GitHub organization accounts, competent authorities, corporate transaction entities, partners and resellers, subprocessors and service providers, Visual Studio Code telemetry, third-party applications, and other users and the public. Each recipient has its own purpose and limits, explained in separate cards.

Supporting quotations

We may share Personal Data with the following recipients:

Qualifications & exceptions

• Stated as "may share", not as a statement that sharing always happens.

Cross-references

• referred to by (model-proposed): California disclosures: categories disclosed for a business purpose in the last 12 months, and to whom — The California disclosure of categories disclosed for a business purpose refers to recipients "as described in the Sharing of Personal Data section" of the Statement, which the sharing cards describe.

Sharing & Disclosure · Permission or license

GitHub may disclose Personal Data when it believes in good faith that this prevents fraud, abuse or attacks

GitHub may disclose Personal Data to abuse and fraud prevention entities when it has a good faith belief that disclosure is needed to prevent fraud, abuse or attacks on the Services, or to protect the safety of GitHub and its users.

Supporting quotations

Abuse and Fraud Prevention Entities: We may disclose Personal Data based on a good faith belief it is needed to prevent fraud, abuse, or attacks on our Services, or to protect the safety of GitHub and our users.

Qualifications & exceptions

• Requires a good faith belief that disclosure is needed for these purposes.

Sharing & Disclosure · Permission or license

GitHub may share Personal Data with affiliates, including Microsoft, for service, marketing, billing and AI development

Personal Data may be shared with GitHub affiliates, including Microsoft, to facilitate customer service, marketing and advertising, order fulfillment, billing, technical support, legal and compliance obligations, and product development and improvement, including training and improving artificial intelligence and machine learning technologies. It may also be shared for other purposes described in the affiliates' respective privacy statements. The source says that affiliates will process shared data in accordance with applicable law and their privacy commitments.

Supporting quotations

Affiliates: Personal Data may be shared with GitHub affiliates, including Microsoft, to facilitate customer service, marketing and advertising, order fulfillment, billing, technical support, legal and compliance obligations, product development and improvement (including training and improving artificial intelligence and machine learning technologies), and for other purposes described in their respective privacy statements. When we share data with affiliates, they will process it in accordance with applicable law and their privacy commitments.

Qualifications & exceptions

• "Other purposes" are those in the affiliates' own privacy statements.

Not stated here

• The affiliates' own privacy statements are not part of this source, so the additional purposes they allow are unknown.
• The source does not name the affiliates other than Microsoft.

Sharing & Disclosure · Permission or license

If an organization adds you to its GitHub account, GitHub might share your Personal Data with that organization

If an organization adds you to its GitHub account, GitHub might share Personal Data with that organization to fulfill the commercial relationship. The source says your use of the Services in that case is protected by a data protection agreement and terms between the organization and GitHub. The source does not say which data the organization receives.

Supporting quotations

GitHub Organization Accounts: If an organization adds you to their GitHub account, we might share Personal Data with that organization to fulfill the commercial relationship. In such a case, your use of the Services is protected by a data protection agreement and terms between your organization and GitHub

Qualifications & exceptions

• Applies when an organization adds you to its GitHub account.
• Purpose given is to fulfill the commercial relationship.

Not stated here

• The data protection agreement and terms are not supplied, and the source does not list which Personal Data is shared with the organization.

Sharing & Disclosure · Permission or license

GitHub may disclose Personal Data to authorities on lawful requests or to protect its rights and safety

GitHub may disclose Personal Data to authorized law enforcement, regulators, courts or other public authorities in response to lawful requests, or to protect its rights and safety. The source refers to separate Guidelines for Legal Requests of User Data for more information; those guidelines are linked, not supplied.

Supporting quotations

Competent Authorities: We may disclose Personal Data to authorized law enforcement, regulators, courts, or other public authorities in response to lawful requests or to protect our rights and safety.

Please refer to our Guidelines for Legal Requests of User Data for more information.

Qualifications & exceptions

• In response to lawful requests, or to protect GitHub's rights and safety.

Not stated here

• The linked Guidelines for Legal Requests of User Data are not part of this source.

Sharing & Disclosure · Permission or license

GitHub might disclose Personal Data for strategic business transactions such as a sale or merger

GitHub might disclose Personal Data to corporate transaction entities for strategic business transactions such as a sale or merger. The source says this is within the limits of the law and in accordance with the Privacy Statement. It does not say whether you would be notified.

Supporting quotations

Corporate Transaction Entities: we might disclose Personal Data within the limits of the law and in accordance with this Privacy Statement for strategic business transactions such as sales or a merger.

Qualifications & exceptions

• Within the limits of the law and in accordance with this Privacy Statement.

Not stated here

• The source does not say whether users would be notified or given a choice.

Sharing & Disclosure · Permission or license

GitHub may share your data with sales, consulting and support partners where allowed, and with consent when required

GitHub cooperates with third parties that offer sales, consulting, support and technical services for the Services. It may share your data with these partners and resellers where allowed, and with your consent when required.

Supporting quotations

Partners and Resellers: We cooperate with third-parties that offer sales, consulting, support, and technical services for our Services. We may share your data with these partners and resellers where allowed, and with your consent when required.

Qualifications & exceptions

• Where allowed by law; with your consent when consent is required.

Not stated here

• The source does not say when consent is required.

Sharing & Disclosure · Company practice

GitHub may use vendors, including for marketing and analytics, that are contractually bound to protect your information

GitHub may use vendors to provide services on its behalf, including hosting, marketing, advertising, social, analytics, support ticketing, credit card processing or security services. The source says they are bound by contractual obligations to ensure the security, privacy and confidentiality of your information. It points to a linked list of subprocessors, which is not supplied here.

Supporting quotations

Subprocessors and Service Providers: We may use vendors to provide services on our behalf, including hosting, marketing, advertising, social, analytics, support ticketing, credit card processing, or security services. They are bound by contractual obligations to ensure the security, privacy, and confidentiality of your information.

to see our list of Subprocessors.

Qualifications & exceptions

• Vendors act on GitHub's behalf and are bound by contractual obligations.

Not stated here

• The linked list of subprocessors is not part of this source.

Sharing & Disclosure · Permission or license

On your instruction GitHub may share Personal Data with Marketplace apps; you are responsible for what you instruct

Upon your instruction, GitHub may share Personal Data with third-party applications available on its Marketplace. The source says you are responsible for the data you instruct GitHub to share with these applications.

Supporting quotations

Other Third-party Applications: Upon your instruction, we may share Personal Data with third-party applications available on our Marketplace. You are responsible for the data you instruct us to share with these applications.

Qualifications & exceptions

• Only upon your instruction.

Sharing & Disclosure · User right or choice

Depending on your settings, GitHub may share Personal Data with other users and the public

Depending on your account settings, GitHub may share Personal Data with other users of the Services and with the public. The source says you control what information is made public and can adjust this in User Settings in your profile. It warns that any information you share in a collaborative context may become publicly accessible.

Supporting quotations

Other Users and the Public: Depending on your account settings, we may share Personal Data with other users of the Services and the public. You control what information is made public. To adjust your settings, visit User Settings in your profile. Please be aware that any information you share in a collaborative context may become publicly accessible.

Qualifications & exceptions

• Depends on your account settings.
• Information shared in a collaborative context may become public.

Sharing & Disclosure · Company practice

Web beacons and third-party content such as embedded videos or ads make your browser connect to third-party servers

Web beacons are electronic images ("single-pixel" or "clear GIFs") within a website or email. When your browser opens a page or email containing one, it connects to the web server that hosts the image, typically operated by a third party, which can log information about your device and set and read its own cookies. The Statement says third-party content on its websites (such as embedded videos, plug-ins or ads) likewise causes your browser to connect to the third party's server.

Supporting quotations

Web beacons are electronic images (also called “single-pixel” or “clear GIFs”) that are contained within a website or email. When your browser opens a webpage or email that contains a web beacon, it automatically connects to the web server that hosts the image (typically operated by a third party). This allows that web server to log information about your device and to set and read its own cookies. In the same way, third-party content on our websites (such as embedded videos, plug-ins, or ads) results in your browser connecting to the third-party web server that hosts that content.

Qualifications & exceptions

• The hosting server is "typically" operated by a third party.

Sharing & Disclosure · Company practice

Analytics and advertising partners may use cookies in the Services to track your activity over time for targeted ads

GitHub says its Services use cookies and similar technologies to store preferences and settings, enable sign-in, analyze performance, track your interaction with the Services, develop inferences, combat fraud and fulfill other legitimate purposes. Some may be provided by third parties, including service providers and advertising partners. For example, analytics and advertising partners may use these technologies in the Services to collect personal information (such as pages visited, links clicked, and similar usage information, identifiers and device information) about your online activities over time and across Services, including for targeted advertising. The Statement adds that a table below gives more detail on cookie types.

Supporting quotations

The GitHub Services use cookies and similar technologies for a variety of purposes, including to store your preferences and settings, enable you to sign-in, analyze how our Services perform, track your interaction with the Services, develop inferences, combat fraud, and fulfill other legitimate purposes. Some of these cookies and technologies may be provided by third parties, including service providers and advertising partners.

our analytics and advertising partners may use these technologies in our Services to collect personal information (such as the pages you visit, the links you click on, and similar usage information, identifiers, and device information) related to your online activities over time and across Services for various purposes, including targeted advertising.

The table below provides additional information about how we use different types of cookies:

Purpose Description

Qualifications & exceptions

• Collection by partners is described as occurring over time and across Services.

Not stated here

• The source does not name the analytics and advertising partners.

Sharing & Disclosure · Company practice

GitHub and its partners also share the information they collect or infer with third parties "for these purposes"

The Statement says GitHub and/or its partners also share the information they collect or infer with third parties "for these purposes". It does not say which purposes this refers to (the preceding paragraph lists several, including targeted advertising) or who the third parties are.

Supporting quotations

We and/or our partners also share the information we collect or infer with third parties for these purposes.

Not stated here

• "These purposes" is not defined in the sentence, and the recipients are not named.

Sharing & Disclosure · Company practice

Social media cookies show ads based on your social media profiles and activity, and help third parties develop products

In the cookie table, GitHub and third parties use "Social Media" cookies to show you ads and content based on your social media profiles and activity on GitHub's websites, so that the ads and content you see on GitHub and on social media better reflect your interests. The row also says this enables third parties to develop and improve their products, which they may use on websites not owned or operated by GitHub.

Supporting quotations

Social Media GitHub and third parties use social media cookies to show you ads and content based on your social media profiles and activity on GitHub’s websites. This ensures that the ads and content you see on our websites and on social media will better reflect your interests. This also enables third parties to develop and improve their products, which they may use on websites that are not owned or operated by GitHub.

Qualifications & exceptions

• Third parties may use what they learn to improve products used on websites GitHub does not own or operate.

Sharing & Disclosure · Company commitment

If GitHub detects a Global Privacy Control signal from your device, it says it will not share your data

The Statement says you may use the Global Privacy Control (GPC) to communicate your privacy preferences. If GitHub detects the GPC signal from your device, it says GitHub will not share your data, and adds in parentheses that it does not sell your data. The source does not say what "share" covers in this sentence beyond that parenthetical; the US state section describes opt-out of "sharing" separately.

Supporting quotations

You may use the Global Privacy Control (GPC) to communicate your privacy preferences. If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).

Qualifications & exceptions

• Applies when GitHub detects the GPC signal from your device.

Not stated here

• The source does not define "share" here; the US state section describes "sharing" for particular categories.

Sharing & Disclosure · User right or choice

Advertising partners may take part in opt-out programs run by US, Canadian and European advertising associations

GitHub says its advertising partners may participate in associations that provide simple ways to opt out of ad targeting. The Statement points to the NAI and DAA for the United States, the Digital Advertising Alliance of Canada, and the European Digital Advertising Alliance. These are external opt-out sites; the Statement does not say which partners participate.

Supporting quotations

Advertising controls. Our advertising partners may participate in associations that provide simple ways to opt out of ad targeting, which you can access at:

United States:

Canada:

Europe:

Qualifications & exceptions

• Participation is stated as "may participate".

Not stated here

• The linked opt-out sites are not supplied, and the source does not name which partners take part.

Sharing & Disclosure · User right or choice

US state section: GitHub says it shares information with service providers for operations such as storage and hosting

Under "Right to Know Data Recipients", GitHub says it shares your information with service providers for legitimate business operations, such as data storage and hosting. It directs you to "Sharing Your Information" below for more details. That title does not appear as a heading in the supplied text; the sharing section is headed "Sharing of Personal Data", and this card does not assume the two are the same.

Supporting quotations

Right to Know Data Recipients: We share your information with service providers for legitimate business operations, such as data storage and hosting. For more details, please see “Sharing Your Information” below.

Qualifications & exceptions

• The example given is service providers for data storage and hosting; the Statement's full list of recipients is in its sharing section.

Not stated here

• The cross-reference "Sharing Your Information" does not match a heading in the supplied text.

Sharing & Disclosure · User right or choice

Opt out of the sharing of your personal information with the "Do Not Share My Personal Information" footer link or GPC

To opt out of the sharing of your personal information, you can click the "Do Not Share My Personal Information" link in the footer of GitHub's Websites or use the Global Privacy Control (GPC) if available. Authorized agents can also submit opt-out requests on your behalf.

Supporting quotations

To opt out of the sharing of your personal information, you can click on the "Do Not Share My Personal Information" link on the footer of our Websites or use the Global Privacy Control ("GPC") if available. Authorized agents can also submit opt-out requests on your behalf.

Qualifications & exceptions

• The GPC option applies "if available".

Sharing & Disclosure · Company practice

California disclosures: categories disclosed for a business purpose in the last 12 months, and to whom

GitHub says that in the last 12 months it disclosed these categories of personal information for a business purpose: identifiers and contact information, demographic information (such as gender and rough geographic location), payment information, commercial information, internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above. It says it disclosed each category to third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third parties as described in the Sharing of Personal Data section.

Supporting quotations

We disclosed the following categories of personal information for a business purpose in the last 12 months: identifiers/contact information, demographic information (such as gender and rough geographic location), payment information, commercial information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above. We disclosed each category to third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third parties as described in the Sharing of Personal Data section of our Privacy Statement.

Qualifications & exceptions

• Covers the last 12 months and each listed category; recipients are stated for "each category".

Cross-references

• refers to (model-proposed): GitHub may share Personal Data with the listed categories of recipients — The California disclosure of categories disclosed for a business purpose refers to recipients "as described in the Sharing of Personal Data section" of the Statement, which the sharing cards describe.

Sharing & Disclosure · Company practice

California: identifiers, internet activity and inferences were "shared" with ad, analytics and social networks

GitHub says that, as defined by applicable law, it "shared" these categories of personal information in the last 12 months: identifiers and contact information, internet or other electronic network activity information, and inferences drawn from the above. It says it shared each category to or with advertising networks, data analytics providers and social networks. The stated business or commercial purpose is to assist with marketing, advertising and audience measurement.

Supporting quotations

As defined by applicable law, we “shared” the following categories of personal information in the last 12 months: identifiers/contact information, Internet or other electronic network activity information, and inferences drawn from the above. We shared each category to or with advertising networks, data analytics providers, and social networks.

The business or commercial purpose of sharing personal information is to assist us with marketing, advertising, and audience measurement.

Qualifications & exceptions

• "Shared" is used as defined by applicable law.
• Covers the last 12 months.

Sharing & Disclosure · Company commitment

GitHub says it does not "sell" or "share" the personal information of known minors under 16

Among its California disclosures, GitHub says it does not "sell" or "share" the personal information of known minors under 16 years of age. The statement is limited to minors GitHub knows to be under 16.

Supporting quotations

We do not “sell” or “share” the personal information of known minors under 16 years of age.

Qualifications & exceptions

• Limited to known minors under 16.
• Listed in the California disclosures.

Not stated here

• The source does not say how GitHub identifies known minors.

Sharing & Disclosure · User right or choice

California residents can ask whether GitHub disclosed their data for others' direct marketing; GitHub says it does not

Under California's "Shine the Light" law, California residents who have provided personal information to a business with which they have a business relationship for personal, family or household purposes ("California Customers") may request information on whether the business disclosed personal information to third parties for those third parties' direct marketing. GitHub says it does not disclose personal information to any third parties for their direct marketing purposes as defined by the law. California Customers can request further information about compliance by emailing privacy[at]github[dot]com. The Statement notes that businesses must respond to one request per California Customer each year and may not have to respond to requests made by other means than the designated email address.

Supporting quotations

Under California Civil Code section 1798.83, also known as the “Shine the Light” law, California residents who have provided personal information to a business with which the individual has established a business relationship for personal, family, or household purposes (“California Customers”) may request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marketing purposes.

Please be aware that we do not disclose personal information to any third parties for their direct marketing purposes as defined by this law.

California Customers may request further information about our compliance with this law by emailing (privacy[at]github[dot]com). Please note that businesses are required to respond to one request per California Customer each year and may not be required to respond to requests made by means other than through the designated email address.

Qualifications & exceptions

• Applies to California Customers: California residents who provided personal information for personal, family or household purposes to a business they have a relationship with.
• One request per California Customer each year; requests by means other than the designated email may not be answered.

Not stated here

• The text of California Civil Code section 1798.83 is not supplied; the Statement describes the law only as summarized here.

Sharing & Disclosure · Company commitment

GitHub says it does not sell Nevada covered information, as defined in Nevada Revised Statutes Chapter 603A

In the Nevada subsection, GitHub says it does not sell your covered information, as defined under Chapter 603A of the Nevada Revised Statutes. For questions about covered information or anything else in the Statement, you can email privacy[at]github[dot]com. The text of Chapter 603A is not supplied.

Supporting quotations

Nevada

We do not sell your covered information, as defined under Chapter 603A of the Nevada Revised Statutes. If you still have questions about your covered information or anything else in our Privacy Statement, please send an email to privacy[at]github[dot]com.

Qualifications & exceptions

• Covers "covered information" as defined in Nevada law.

Not stated here

• The Nevada statute's definition of covered information is not supplied.