GitHub General Privacy Statement

Legal Rights & Agreement Rules · Context

The Statement covers Personal Data that GitHub, Inc. or GitHub B.V. controls across Services that display it

This is the General Privacy Statement for websites, applications and services that display it (called the "Services"). It describes how GitHub handles "Personal Data", defined as information that is directly linked or can be linked to you, when GitHub, Inc. or GitHub B.V. acts as the "Data Controller". The Statement is global in its wording; it does not name a single country or a single type of user in this opening.

Supporting quotations

Welcome to the GitHub Privacy Statement. This is where we describe how we handle your “Personal Data”, which is information that is directly linked or can be linked to you. It applies to the Personal Data that GitHub, Inc. or GitHub B.V., processes as the “Data Controller” when you interact with websites, applications, and services that display this Statement (collectively, “Services”).

which is information that is directly linked or can be linked to you

Qualifications & exceptions

• Applies where GitHub, Inc. or GitHub B.V. processes the data as Data Controller.

Not stated here

• The source does not list which websites, applications and services display the Statement.

Legal Rights & Agreement Rules · Restriction or exception

Services or products that do not display this Statement, such as Previews, are outside it

The Statement does not apply to services or products that do not display it. Previews are given as an example. The source adds "where relevant", so it does not say that every Preview is always outside the Statement.

Supporting quotations

This Statement does not apply to services or products that do not display this Statement, such as Previews, where relevant.

Qualifications & exceptions

• The source qualifies the exclusion with "where relevant".

Not stated here

• The source does not say which Previews exist or what privacy terms govern them.

Legal Rights & Agreement Rules · Context

This version of the Statement states an effective date of April 27, 2026

The page states "Effective date: April 27, 2026". The source does not describe earlier or later versions in this opening.

Supporting quotations

Effective date: April 27, 2026

Account & Service Control · Company practice

If a school or employer supplies your GitHub account, it becomes Data Controller for most of your Personal Data

When an organization such as your employer or school provides your GitHub account, that organization takes the role of Data Controller for most Personal Data used in the Services, and this Statement's direct applicability to you changes. The source says this lets the organization manage and administer your account, including adjusting privacy settings, and access and use your Personal Data, including details on how you use the Services and your content and files. GitHub says it remains dedicated to preserving your privacy rights and points you to the organization's own privacy statement for its practices.

Supporting quotations

End User Notice: Organization-Provided GitHub Accounts

When a school or employer supplies your GitHub account, they assume the role of Data Controller for most Personal Data used in our Services.

Manage and administer your GitHub account, including adjusting privacy settings.

Access and utilize your Personal Data, which includes details on how you use the Services, as well as your content and files.

Should you access a GitHub Service through an account provided by an organization, such as your employer or school, the organization becomes the Data Controller, and this Privacy Statement's direct applicability to you changes.

Qualifications & exceptions

• Stated as "most Personal Data" in the first paragraph; the later paragraph says the organization becomes the Data Controller without that qualifier.
• This applies to accounts supplied by an organization, not to personal accounts you open yourself.

Not stated here

• The source does not say which Personal Data the organization does not control.
• The organization's own privacy statement is not part of this source.

Use & Processing · Company practice

For organization-provided accounts, GitHub acts as a Data Processor following the organization's instructions

In that case GitHub functions as a Data Processor and follows the Data Controller's instructions on how your Personal Data is processed. A Data Protection Agreement governs the relationship between GitHub and the organization. For details about their privacy practices, the source tells you to refer to the privacy statement of the organization providing your account.

Supporting quotations

In such circumstances, GitHub functions as a Data Processor, adhering to the Data Controller's instructions regarding your Personal Data's processing. A Data Protection Agreement governs the relationship between GitHub and the Data Controller. For further details regarding their privacy practices, please refer to the privacy statement of the organization providing your account.

Qualifications & exceptions

• Only for accounts provided by an organization.

Not stated here

• The terms of the Data Protection Agreement are not part of this paragraph.

Cross-references

• qualified by (model-proposed): With organization-granted product access, GitHub is controller only for activities in a Data Protection Agreement — The processor card says GitHub acts as a Data Processor for organization-provided accounts. The product-access paragraph adds that where the organization grants access to GitHub products, GitHub is the Data Controller for specific processing activities defined in a Data Protection Agreement, and this Statement governs those limited purposes.

Legal Rights & Agreement Rules · Restriction or exception

With organization-granted product access, GitHub is controller only for activities in a Data Protection Agreement

Where your organization grants access to GitHub products, GitHub acts as Data Controller solely for specific processing activities defined in a contractual Data Protection Agreement with the organization. For those limited purposes this Statement governs the handling of your Personal Data. For all other aspects of using GitHub products, your organization's policies apply. The source links its standard Data Protection Agreement.

Supporting quotations

In cases where your organization grants access to GitHub products, GitHub acts as the Data Controller solely for specific processing activities.

For those limited purposes, this Statement governs the handling of your Personal Data. For all other aspects of GitHub product usage, your organization's policies apply.

Qualifications & exceptions

• This Statement governs only the limited purposes defined in the Data Protection Agreement; for everything else, your organization's policies apply.

Not stated here

• The source does not list the specific processing activities for which GitHub is controller; they are in the linked agreement, which is not supplied.

Cross-references

• qualifies (model-proposed): For organization-provided accounts, GitHub acts as a Data Processor following the organization's instructions — The processor card says GitHub acts as a Data Processor for organization-provided accounts. The product-access paragraph adds that where the organization grants access to GitHub products, GitHub is the Data Controller for specific processing activities defined in a Data Protection Agreement, and this Statement governs those limited purposes.

Sharing & Disclosure · Context

Third-party extensions, integrations and linked sites handle data under their own privacy policies

If you use third-party extensions or integrations, or follow references and links within the Services, the privacy policies of those third parties apply to Personal Data you provide or consent to share with them. Their privacy statements govern how that data is processed. The Statement does not say what those third parties do with it.

Supporting quotations

When you use third-party extensions, integrations, or follow references and links within our Services, the privacy policies of these third parties apply to any Personal Data you provide or consent to share with them. Their privacy statements will govern how this data is processed.

Qualifications & exceptions

• Covers data you provide or consent to share with the third party.

Not stated here

• The third parties' own policies are not part of this source.

Data Access & Collection · Company practice

GitHub collects Personal Data from you, automatically from your device, and from third parties

The Statement says Personal Data is collected in three ways: directly from you, automatically from your device, and from third parties. What GitHub processes depends on how you interact with the Services (such as web interfaces or desktop and mobile applications), the features you use (such as pull requests, Codespaces or GitHub Copilot) and how you access the Services, for example your preferred IDE. The lists that follow detail each channel.

Supporting quotations

Personal Data is collected from you directly, automatically from your device, and also from third parties.

The Personal Data GitHub processes when you use the Services depends on variables like how you interact with our Services (such as through web interfaces, desktop or mobile applications), the features you use (such as pull requests, Codespaces, or GitHub Copilot) and your method of accessing the Services (your preferred IDE)

Qualifications & exceptions

• The data processed varies with the interface, the features used and the access method.

Data Access & Collection · Company practice

On account opening GitHub collects your handle, name, email, password, and payment and transaction information

GitHub collects "Account Data" when you open an account: your GitHub handle, name, email address, password, payment information and transaction information.

Supporting quotations

Account Data: We collect certain information when you open an account such as your GitHub handle, name, email address, password, payment information and transaction information.

Qualifications & exceptions

• Collected when you open an account.

Data Access & Collection · Company practice

GitHub collects Personal Data included in the code, inputs, AI outputs, text, files and feedback you provide

"User Content and Files": when you use the Services, GitHub collects the Personal Data that is part of what you provide, such as code, inputs, AI outputs, text, documents, images or feedback. This describes collection of Personal Data within your content; it does not say here what GitHub does with it, which the purposes and sharing sections address.

Supporting quotations

User Content and Files: When you use our Services, we collect Personal Data included as part of the information you provide such as code, inputs, AI outputs, text, documents, images, or feedback.

Qualifications & exceptions

• Covers Personal Data included in information you provide while using the Services.

Data Access & Collection · Company practice

In some cases you provide ethnicity, gender or similar demographic details, which GitHub collects

GitHub lists "Demographic information" among the data it collects from you: in some cases you provide ethnicity, gender or similar demographic details. The source does not say when or how GitHub asks for this information.

Supporting quotations

Demographic information: In some cases, you provide us with ethnicity, gender, or similar demographic details.

Qualifications & exceptions

• Only "in some cases".

Not stated here

• The source does not say in which situations demographic details are requested or whether providing them is optional.

Data Access & Collection · Company practice

Information you submit through surveys, reviews or interactive features is collected as Feedback Data

"Feedback Data" is information you submit through surveys, reviews or interactive features.

Supporting quotations

Feedback Data: This consists of information you submit through surveys, reviews, or interactive features.

Charges & Financial Obligations · Company practice

For paid subscriptions GitHub collects your name, billing address and payment specifics

For paid subscriptions, GitHub collects payment information such as your name, billing address and "payment specifics". The source does not define what payment specifics include beyond these examples.

Supporting quotations

Payment Information: For paid subscriptions, we collect details like name, billing address, and payment specifics.

Qualifications & exceptions

• Applies to paid subscriptions.

Not stated here

• "Payment specifics" is not defined beyond the examples given.

Data Access & Collection · Company practice

GitHub collects information to build your profile, such as a photo, extra email addresses, job title or biography

To create a user profile, GitHub collects information that may include a photo, additional email addresses, job title or biography. The list is introduced by "may include", so it is not stated to be complete.

Supporting quotations

Profile Information: We collect information to create a user profile, which may include a photo, additional email addresses, job title, or biography.

Qualifications & exceptions

• The listed items are examples ("may include").

Data Access & Collection · Company practice

Information you provide for promotional communications, such as name, email and company name, is collected

"Sales and Marketing Data" is information you provide for promotional communications, such as your name, email address and company name.

Supporting quotations

Sales and Marketing Data: This includes information provided for promotional communications, such as name, email address, and company name.

Data Access & Collection · Company practice

When you seek customer support, GitHub collects details such as code, text or multimedia files

"Support Data" is what you provide when you seek customer support, such as code, text or multimedia files.

Supporting quotations

Support Data: When you seek customer support, we collect details like code, text, or multimedia files.

Qualifications & exceptions

• Collected when you seek customer support.

Sharing & Disclosure · Company practice

Buttons and content from other companies, such as Twitter or LinkedIn, can send browser information to those companies

The Services may contain links or buttons leading to third-party services such as Twitter or LinkedIn. Using these features may result in data collection, and engaging with the buttons, tools or content may automatically send certain browser information to those companies. GitHub tells you to review those companies' privacy statements.

Supporting quotations

Our Services may contain links or buttons that lead to third-party services like Twitter or LinkedIn. Use of these features may result in data collection. Engaging with these buttons, tools, or content may automatically send certain browser information to these companies. Please review the privacy statements of these companies for more information.

Qualifications & exceptions

• Happens when you engage with the third-party buttons, tools or content.

Not stated here

• The source does not say exactly which browser information is sent.

Data Access & Collection · Company practice

GitHub uses cookies and similar technologies for essential functions like storing settings and recognizing you

GitHub says it uses cookies and similar technologies to provide essential functionality, such as storing settings and recognizing you while you use the Services. These are described as essential; the cookies section later separates required from non-essential uses.

Supporting quotations

Essential Cookies and Similar Tracking Technologies: We use cookies and similar technologies to provide essential functionality like storing settings and recognizing you while using our Services.

Data Access & Collection · Company practice

Depending on jurisdiction, GitHub may use analytics and third-party ad cookies, in some places only after consent

GitHub says that, depending on your jurisdiction, it may use online analytics products that use cookies to analyze how de-identified users use the Services and to enhance your experience. It may also employ third-party cookies to gather data for interest-based advertising. In some jurisdictions it uses non-essential cookies only after obtaining your consent. The source points to the cookies section for details and controls.

Supporting quotations

Non-essential Cookies: Depending on your jurisdiction, we may use online analytics products that use cookies to help us analyze how de-identified users use our Services and to enhance your experience when you use the Services. We may also employ third-party Cookies to gather data for interest-based advertising. In some jurisdictions, we only use non-essential cookies after obtaining your consent. See this section for more details and control options.

Qualifications & exceptions

• Varies by jurisdiction.
• In some jurisdictions non-essential cookies are used only after consent.

Not stated here

• The source does not list which jurisdictions require consent.

Data Access & Collection · Company practice

GitHub emails may carry web beacons that report device type, email client, opens and link clicks

GitHub's emails may contain web beacons that provide information on your device type, email client, email reception, opens and link clicks.

Supporting quotations

Email Marketing Interactions: Our emails may have web beacons that offer information on your device type, email client, email reception, opens, and link clicks.

Qualifications & exceptions

• Applies to emails that contain web beacons ("may have").

Data Access & Collection · Company practice

Depending on a Service's functionality, GitHub collects regional geolocation data

Depending on a Service's functionality, GitHub collects regional geolocation data. The source says "regional", and does not describe precise location collection in this list.

Supporting quotations

Geolocation Information: Depending on the Service's functionality, we collect regional geolocation data.

Qualifications & exceptions

• Depends on the functionality of the Service.

Data Access & Collection · Company practice

GitHub collects usage data such as IP address, device details, session details, request times and contributions

"Service Usage Information" covers your interactions with the Services: IP address, device information, session details, date and time of requests, device type and ID, operating system and application version, information about your contributions to repositories, and how specific features or Services perform.

Supporting quotations

Service Usage Information: We collect data about your interactions with the Services, such as IP address, device information, session details, date and time of requests, device type and ID, operating system and application version, information related to your contributions to repositories, and performance of specific features or Services.

Data Access & Collection · Company practice

GitHub logs your website activity: referring site, visit time, pages viewed and links clicked

GitHub automatically logs data about your interactions with its websites: the referring site, date and time of visit, pages viewed and links clicked.

Supporting quotations

Website Usage Data: We automatically log data about your Website interactions, including the referring site, date and time of visit, pages viewed, and links clicked.

Data Access & Collection · Company practice

Other users can give GitHub information about you, and company accounts can identify you as a representative

Other users may share information about you when they submit issues and comments. GitHub may also receive information about you if you are identified as a representative or administrator on your company's account.

Supporting quotations

Information from Other Users of the Services: Other users may share information about you when they submit issues and comments. We may also receive information about you if you are identified as a representative or administrator on your company's account.

Qualifications & exceptions

• Applies to issues and comments submitted by others, and to company accounts that identify you as a representative or administrator.

Data Access & Collection · Company practice

GitHub may acquire information about you from publicly available sources

GitHub says it may acquire information about you from publicly available sources. The source does not say which sources or what information.

Supporting quotations

Publicly Available Sources: We may acquire information about you from publicly available sources.

Not stated here

• The source does not name the public sources or the kinds of information obtained.

Data Access & Collection · Company practice

When you or an administrator link third-party services, GitHub receives information based on your settings there

When you or your administrator integrate third-party apps or services with the Services, GitHub receives information based on your settings with those services. This can include details like your name and email from services such as Google for authentication. What GitHub receives depends on the third party's settings and privacy policies, and GitHub tells you to review them.

Supporting quotations

Services you linked to your GitHub account: When you or your administrator integrate third-party apps or services with our Services, we receive information based on your settings with those services. This can include details like your name and email from services like Google for authentication. The information we receive depends on the third-party's settings and privacy policies.

Qualifications & exceptions

• What is received depends on the third party's settings and privacy policies.

Not stated here

• The source gives name and email only as examples; the full range of data depends on each third party.

Data Access & Collection · Company practice

GitHub may receive information about you from vendors, resellers, partners or affiliates

GitHub may receive information about you from third parties such as vendors, resellers, partners or affiliates, for the purposes outlined in the Statement.

Supporting quotations

Vendors, Partners, and Affiliates: We may receive information about you from third parties, like vendors, resellers, partners, or affiliates for the purposes outlined in this statement.

Qualifications & exceptions

• For the purposes outlined in this Statement.

Not stated here

• The source does not say what information these parties provide.

Use & Processing · Context

GitHub lists the ways it may process your Personal Data, which vary with your interface, features and access tools

The Statement says the Personal Data it processes depends on how you interact with and access the Services: the interface (web, desktop, mobile apps), the features used (such as pull requests, Codespaces, GitHub Copilot) and your preferred access tools, like your IDE. The section that follows describes "all the potential ways" GitHub may process Personal Data.

Supporting quotations

The Personal Data we process depends on your interaction and access methods with our Services, including the interfaces (web, desktop, mobile apps), features used (pull requests, Codespaces, GitHub Copilot), and your preferred access tools (like your IDE). This section details all the potential ways GitHub may process your Personal Data:

Qualifications & exceptions

• The processing that applies to you depends on your interaction and access methods.

Cross-references

• referred to by (model-proposed): California disclosures: categories collected in the last 12 months, their sources and the purposes — The California disclosures say the business or commercial purposes of collecting personal information are as summarized in the Statement under Processing Purposes, which is the section the purposes cards describe.

Use & Processing · Company practice

GitHub uses Personal Data for billing, accounting, compensation and aggregated internal reporting and planning

"Business Operations": GitHub uses Personal Data for activities like billing, accounting and compensation. This includes creating aggregated statistical data for internal reporting, financial reporting, revenue planning, capacity planning and forecast modeling, including product strategy.

Supporting quotations

Business Operations: We use Personal Data for activities like billing, accounting, and compensation. This includes creating aggregated statistical data for internal reporting, financial reporting, revenue planning, capacity planning, and forecast modeling (including product strategy).

Use & Processing · Company practice

GitHub uses Personal Data to tell you about new Services, offers and promotions, and to send administrative messages

"Communication": GitHub uses Personal Data to inform you about new Services, features, offers, promotions and other pertinent information. It also covers sending confirmations, invoices, technical notices, updates, security alerts and administrative messages.

Supporting quotations

Communication: We use Personal Data to inform you about new Services, features, offers, promotions, and other pertinent information. This also includes sending confirmations, invoices, technical notices, updates, security alerts, and administrative messages.

Inference & Profiling · Company practice

GitHub infers likely preferences or characteristics from your data, for example your location from your IP address

"Inference": GitHub generates new information from other data it collects to derive likely preferences or other characteristics. The example given is inferring your general geographic location from your IP address. The word "for instance" shows this is one example, not a full list of inferences.

Supporting quotations

Inference: We generate new information from other data we collect to derive likely preferences or other characteristics. For instance, we infer your general geographic location based on your IP address.

Qualifications & exceptions

• The IP-address location inference is an example only.

Not stated here

• The source does not list the other characteristics GitHub infers.

Use & Processing · Company practice

GitHub uses Personal Data to customize the Service and to evaluate enterprise business ads and promotions

"Personalization": GitHub uses Personal Data to customize the Service to your preferences, to evaluate the effectiveness of enterprise business ads and promotional communications, and to ensure a seamless and consistent user experience.

Supporting quotations

Personalization: We use Personal Data to customize the Service to your preferences, to evaluate the effectiveness of enterprise business ads and promotional communications, and to ensure a seamless and consistent user experience.

Security & Safeguards · Company practice

GitHub uses automated and, at times, manual techniques to detect abuse and terms violations

"Safety and Security": to promote safety, integrity and security across the Services, GitHub processes Personal Data using both automated and, at times, manual techniques for abuse detection, prevention and violations of terms of service.

Supporting quotations

Safety and Security: To promote safety, integrity, and security across our Services, we process Personal Data, using both automated and, at times, manual techniques for abuse detection, prevention, and violations of terms of service.

Qualifications & exceptions

• Manual techniques are used "at times".

Use & Processing · Company practice

GitHub uses Personal Data to deliver and update the Services as you configure them and to personalize recommendations

"Service Provision": GitHub uses Personal Data to deliver and update the Services as configured and used by you, and to make ongoing personalized experiences and recommendations.

Supporting quotations

Service Provision: We use Personal Data to deliver and update our Services as configured and used by You, and to make ongoing personalized experiences and recommendations.

Use & Processing · Company practice

GitHub uses Personal Data to fix technical issues and to keep the Services up to date and performant

"Troubleshooting": GitHub uses Personal Data to identify and resolve technical issues. "Ongoing Service Performance": Personal Data helps keep the Services up to date and performant and meet user productivity, reliability, efficacy, quality, privacy, accessibility and security needs.

Supporting quotations

Troubleshooting: We use Personal Data to identify and resolve technical issues.

Ongoing Service Performance: Personal Data helps us keep the Services up to date and performant, and meet user productivity, reliability, efficacy, quality, privacy, accessibility and security needs.

Use & Processing · Company practice

GitHub uses Personal Data to develop and improve products, including AI and machine learning and training models

"Product Development and Improvement": GitHub uses Personal Data to develop and improve its products, services and technologies, including artificial intelligence and machine learning technologies. This includes improving features, developing new offerings, enhancing safety and security capabilities, and training models. GitHub says it applies appropriate technical safeguards, including aggregation and de-identification techniques where feasible, to protect your privacy while enabling these improvements.

Supporting quotations

Product Development and Improvement: We use Personal Data to develop and improve our products, services, and technologies, including artificial intelligence and machine learning technologies. This includes improving features, developing new offerings, enhancing safety and security capabilities, and training models.

We apply appropriate technical safeguards, including aggregation and de-identification techniques where feasible, to protect your privacy while enabling these improvements.

Qualifications & exceptions

• Aggregation and de-identification safeguards are applied "where feasible", so they are not promised in every case.

Not stated here

• The source does not say which Personal Data, or whose content, is used for model training, or whether an opt-out exists in this section.

Legal Rights & Agreement Rules · Company practice

GitHub uses Personal Data to meet legal obligations, including data subject requests, tax requirements and disputes

GitHub uses Personal Data for complying with and resolving legal obligations. This includes responding to Data Subject Requests for Personal Data that GitHub processes as Controller (website data is the example given), tax requirements, agreements and disputes.

Supporting quotations

Complying with and resolving legal obligations: including responding to Data Subject Requests for Personal Data processed by GitHub as Controller (for example website data), tax requirements, agreements and disputes.

Qualifications & exceptions

• Data Subject Requests are covered for data GitHub processes as Controller.

Use & Processing · Company practice

GitHub uses Personal Data to deliver training, consulting and implementation services, and to improve them

GitHub uses Personal Data to deliver "Professional Services": training, consulting or implementation, including technical support, professional planning, advice, guidance, data migration, deployment and solution or software development. It also uses Personal Data to improve the delivery, efficacy, quality and security of Professional Services and the underlying products, based on issues found while providing them, including fixing software defects.

Supporting quotations

Delivering Professional Services: We use Personal Data to deliver training, consulting or implementation (“Professional Services”). This includes providing technical support, professional planning, advice, guidance, data migration, deployment, and solution/software development services.

Improving Professional Services: Enhancing delivery, efficacy, quality, and security of Professional Services and the underlying product(s) based on issues identified while providing Professional Services, including fixing software defects, and otherwise keeping the Professional Services up to date and performant.

Qualifications & exceptions

• Applies to Professional Services, not to all use of the Services.

Use & Processing · Company commitment

GitHub says it practices data minimization and uses the minimum Personal Information required for these activities

After listing the purposes, the Statement says that when carrying out these activities GitHub practices data minimization and uses the minimum amount of Personal Information required. The source does not define the minimum or describe how it is measured.

Supporting quotations

When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.

Not stated here

• The source does not say how the minimum is determined or checked.

Sharing & Disclosure · Company practice

GitHub may share Personal Data with the listed categories of recipients

The Statement says GitHub "may" share Personal Data with the recipients listed below: abuse and fraud prevention entities, affiliates, GitHub organization accounts, competent authorities, corporate transaction entities, partners and resellers, subprocessors and service providers, Visual Studio Code telemetry, third-party applications, and other users and the public. Each recipient has its own purpose and limits, explained in separate cards.

Supporting quotations

We may share Personal Data with the following recipients:

Qualifications & exceptions

• Stated as "may share", not as a statement that sharing always happens.

Cross-references

• referred to by (model-proposed): California disclosures: categories disclosed for a business purpose in the last 12 months, and to whom — The California disclosure of categories disclosed for a business purpose refers to recipients "as described in the Sharing of Personal Data section" of the Statement, which the sharing cards describe.

Sharing & Disclosure · Permission or license

GitHub may disclose Personal Data when it believes in good faith that this prevents fraud, abuse or attacks

GitHub may disclose Personal Data to abuse and fraud prevention entities when it has a good faith belief that disclosure is needed to prevent fraud, abuse or attacks on the Services, or to protect the safety of GitHub and its users.

Supporting quotations

Abuse and Fraud Prevention Entities: We may disclose Personal Data based on a good faith belief it is needed to prevent fraud, abuse, or attacks on our Services, or to protect the safety of GitHub and our users.

Qualifications & exceptions

• Requires a good faith belief that disclosure is needed for these purposes.

Sharing & Disclosure · Permission or license

GitHub may share Personal Data with affiliates, including Microsoft, for service, marketing, billing and AI development

Personal Data may be shared with GitHub affiliates, including Microsoft, to facilitate customer service, marketing and advertising, order fulfillment, billing, technical support, legal and compliance obligations, and product development and improvement, including training and improving artificial intelligence and machine learning technologies. It may also be shared for other purposes described in the affiliates' respective privacy statements. The source says that affiliates will process shared data in accordance with applicable law and their privacy commitments.

Supporting quotations

Affiliates: Personal Data may be shared with GitHub affiliates, including Microsoft, to facilitate customer service, marketing and advertising, order fulfillment, billing, technical support, legal and compliance obligations, product development and improvement (including training and improving artificial intelligence and machine learning technologies), and for other purposes described in their respective privacy statements. When we share data with affiliates, they will process it in accordance with applicable law and their privacy commitments.

Qualifications & exceptions

• "Other purposes" are those in the affiliates' own privacy statements.

Not stated here

• The affiliates' own privacy statements are not part of this source, so the additional purposes they allow are unknown.
• The source does not name the affiliates other than Microsoft.

Sharing & Disclosure · Permission or license

If an organization adds you to its GitHub account, GitHub might share your Personal Data with that organization

If an organization adds you to its GitHub account, GitHub might share Personal Data with that organization to fulfill the commercial relationship. The source says your use of the Services in that case is protected by a data protection agreement and terms between the organization and GitHub. The source does not say which data the organization receives.

Supporting quotations

GitHub Organization Accounts: If an organization adds you to their GitHub account, we might share Personal Data with that organization to fulfill the commercial relationship. In such a case, your use of the Services is protected by a data protection agreement and terms between your organization and GitHub

Qualifications & exceptions

• Applies when an organization adds you to its GitHub account.
• Purpose given is to fulfill the commercial relationship.

Not stated here

• The data protection agreement and terms are not supplied, and the source does not list which Personal Data is shared with the organization.

Sharing & Disclosure · Permission or license

GitHub may disclose Personal Data to authorities on lawful requests or to protect its rights and safety

GitHub may disclose Personal Data to authorized law enforcement, regulators, courts or other public authorities in response to lawful requests, or to protect its rights and safety. The source refers to separate Guidelines for Legal Requests of User Data for more information; those guidelines are linked, not supplied.

Supporting quotations

Competent Authorities: We may disclose Personal Data to authorized law enforcement, regulators, courts, or other public authorities in response to lawful requests or to protect our rights and safety.

Please refer to our Guidelines for Legal Requests of User Data for more information.

Qualifications & exceptions

• In response to lawful requests, or to protect GitHub's rights and safety.

Not stated here

• The linked Guidelines for Legal Requests of User Data are not part of this source.

Sharing & Disclosure · Permission or license

GitHub might disclose Personal Data for strategic business transactions such as a sale or merger

GitHub might disclose Personal Data to corporate transaction entities for strategic business transactions such as a sale or merger. The source says this is within the limits of the law and in accordance with the Privacy Statement. It does not say whether you would be notified.

Supporting quotations

Corporate Transaction Entities: we might disclose Personal Data within the limits of the law and in accordance with this Privacy Statement for strategic business transactions such as sales or a merger.

Qualifications & exceptions

• Within the limits of the law and in accordance with this Privacy Statement.

Not stated here

• The source does not say whether users would be notified or given a choice.

Sharing & Disclosure · Permission or license

GitHub may share your data with sales, consulting and support partners where allowed, and with consent when required

GitHub cooperates with third parties that offer sales, consulting, support and technical services for the Services. It may share your data with these partners and resellers where allowed, and with your consent when required.

Supporting quotations

Partners and Resellers: We cooperate with third-parties that offer sales, consulting, support, and technical services for our Services. We may share your data with these partners and resellers where allowed, and with your consent when required.

Qualifications & exceptions

• Where allowed by law; with your consent when consent is required.

Not stated here

• The source does not say when consent is required.

Sharing & Disclosure · Company practice

GitHub may use vendors, including for marketing and analytics, that are contractually bound to protect your information

GitHub may use vendors to provide services on its behalf, including hosting, marketing, advertising, social, analytics, support ticketing, credit card processing or security services. The source says they are bound by contractual obligations to ensure the security, privacy and confidentiality of your information. It points to a linked list of subprocessors, which is not supplied here.

Supporting quotations

Subprocessors and Service Providers: We may use vendors to provide services on our behalf, including hosting, marketing, advertising, social, analytics, support ticketing, credit card processing, or security services. They are bound by contractual obligations to ensure the security, privacy, and confidentiality of your information.

to see our list of Subprocessors.

Qualifications & exceptions

• Vendors act on GitHub's behalf and are bound by contractual obligations.

Not stated here

• The linked list of subprocessors is not part of this source.

Data Access & Collection · User right or choice

Visual Studio Code in Codespaces and github.dev collects some telemetry by default; you can opt out in VS Code settings

GitHub Codespaces and github.dev offer Visual Studio Code in a web browser, where some telemetry is collected by default. Details are on the VS Code website. To opt out, go to File > Preferences > Settings in VS Code; opting out syncs the preference across all future web sessions in Codespaces and github.dev.

Supporting quotations

Visual Studio Code (GitHub Codespaces): GitHub Codespaces and github.dev offer Visual Studio Code in a web browser, where some telemetry is collected by default.

To opt out, go to File > Preferences > Settings in the top left menu of VS Code. Opting out will sync this preference across all future web sessions in GitHub Codespaces and github.dev.

Qualifications & exceptions

• Telemetry is on by default; opting out applies to future web sessions.

Not stated here

• The VS Code telemetry details are on a linked website that is not supplied.

Sharing & Disclosure · Permission or license

On your instruction GitHub may share Personal Data with Marketplace apps; you are responsible for what you instruct

Upon your instruction, GitHub may share Personal Data with third-party applications available on its Marketplace. The source says you are responsible for the data you instruct GitHub to share with these applications.

Supporting quotations

Other Third-party Applications: Upon your instruction, we may share Personal Data with third-party applications available on our Marketplace. You are responsible for the data you instruct us to share with these applications.

Qualifications & exceptions

• Only upon your instruction.

Sharing & Disclosure · User right or choice

Depending on your settings, GitHub may share Personal Data with other users and the public

Depending on your account settings, GitHub may share Personal Data with other users of the Services and with the public. The source says you control what information is made public and can adjust this in User Settings in your profile. It warns that any information you share in a collaborative context may become publicly accessible.

Supporting quotations

Other Users and the Public: Depending on your account settings, we may share Personal Data with other users of the Services and the public. You control what information is made public. To adjust your settings, visit User Settings in your profile. Please be aware that any information you share in a collaborative context may become publicly accessible.

Qualifications & exceptions

• Depends on your account settings.
• Information shared in a collaborative context may become public.

Content & IP Rights · Context

GitHub's access to private repository information is set by Section E of the GitHub Terms of Service

For accounts with private repositories, the Statement says GitHub's ability and rights to access private repository information are set forth in Section E (Private Repositories) of the GitHub Terms of Service. This Statement does not itself state what that access is.

Supporting quotations

Private repositories: GitHub Access

If your GitHub account has private repositories, our ability and rights to access private repository information is set forth in Section E (Private Repositories) of the GitHub Terms of Service.

Not stated here

• The GitHub Terms of Service are not supplied with this document, so the access rights in Section E are unknown here.

Legal Rights & Agreement Rules · Company practice

For EEA and UK end users, GitHub says it processes Personal Data under GDPR lawful bases that vary by data and context

This section applies to EEA and UK end users. GitHub says it processes Personal Data in compliance with the GDPR and ensures a lawful basis for each processing activity. The basis varies with the data type and context, including how you access the Services. The typical bases are listed as contractual necessity, legal obligation, legitimate interests and consent.

Supporting quotations

Lawful Bases for Processing Personal Data (Applicable to EEA and UK End Users)

GitHub processes Personal Data in compliance with the GDPR, ensuring a lawful basis for each processing activity. The basis varies depending on the data type and the context, including how you access the services. Our processing activities typically fall under these lawful bases:

Qualifications & exceptions

• Section heading limits it to EEA and UK end users.

Legal Rights & Agreement Rules · Company practice

For EEA and UK users GitHub relies on contractual necessity and legal obligation as lawful bases

Contractual necessity: processing required to fulfill GitHub's contractual duties to you under the GitHub Terms of Service. Legal obligation: processing necessary to comply with applicable laws or to protect the rights, safety and property of GitHub, its affiliates, users or third parties.

Supporting quotations

Contractual Necessity: Processing is required to fulfill our contractual duties to you, in accordance with the GitHub Terms of Service.

Legal Obligation: We process data when it's necessary to comply with applicable laws or to protect the rights, safety, and property of GitHub, our affiliates, users, or third parties.

Qualifications & exceptions

• Listed in the lawful-bases section for EEA and UK end users.

Legal Rights & Agreement Rules · Company practice

For EEA and UK users GitHub relies on legitimate interests, including AI and ML development, unless overridden

Legitimate interests: GitHub processes data for purposes in its legitimate interests, such as securing the Services, communicating with you, and developing and improving the Services, which include artificial intelligence and machine learning technologies. The source says this is done only when those interests are not overridden by your data protection rights or fundamental rights and freedoms.

Supporting quotations

Legitimate Interests: We process data for purposes that are in our legitimate interests, such as securing our Services, communicating with you, and developing and improving our Services, which include artificial intelligence and machine learning technologies. This is done only when these interests are not overridden by your data protection rights or your fundamental rights and freedoms.

Qualifications & exceptions

• Only when GitHub's interests are not overridden by your data protection rights or fundamental rights and freedoms.

Use & Processing · User right or choice

Where GitHub relies on consent you can withdraw it at any time

Consent: GitHub processes data when you have explicitly consented. When consent is the legal basis, you have the right to withdraw it at any time. The source says the procedures for withdrawal are detailed in the Statement and available on GitHub's website.

Supporting quotations

Consent: We process data when you have explicitly consented to such processing. When we rely on consent as the legal basis, you have the right to withdraw your consent for data processing at any time. The procedures for withdrawal are detailed in this Statement and available on our website.

Qualifications & exceptions

• Applies where consent is the legal basis; listed among the bases for EEA and UK end users.

Not stated here

• The source does not set out the withdrawal procedure in this passage.

Account & Service Control · User right or choice

Depending on where you live, you may have rights to access your data and to learn what was collected in 12 months

The Statement says that, depending on your residence location, you may have specific legal rights regarding your Personal Data. Two are the right to access the data collected about you and the right to request detailed information about the specific types of Personal Data collected over the past 12 months, including data disclosed for business purposes. Which rights you actually have depends on the law where you live; the Statement does not say which locations qualify.

Supporting quotations

Depending on your residence location, you may have specific legal rights regarding your Personal Data:

The right to access the data collected about you

The right to request detailed information about the specific types of Personal Data we've collected over the past 12 months, including data disclosed for business purposes

Qualifications & exceptions

• Depends on your residence location.
• The detailed-information right covers the past 12 months.

Not stated here

• The source does not say which residence locations carry each right.

Account & Service Control · User right or choice

You may have qualified rights to correct, erase or limit, and object to the processing of, your Personal Data

The listed rights include the right to rectify or update inaccurate or incomplete Personal Data under certain circumstances, the right to erase or limit processing under specific conditions, and the right to object to processing as allowed by applicable law. Each is qualified in the text, and the Statement does not spell out the circumstances or conditions.

Supporting quotations

The right to rectify or update inaccurate or incomplete Personal Data under certain circumstances

The right to erase or limit the processing of your Personal Data under specific conditions

The right to object to the processing of your Personal Data, as allowed by applicable law

Qualifications & exceptions

• Rectification applies "under certain circumstances".
• Erasure or limiting applies "under specific conditions".
• Objection applies "as allowed by applicable law".

Not stated here

• The circumstances and conditions are not specified in this list.

Account & Service Control · User right or choice

You may have the right to withdraw consent and to receive your data in a machine-readable format where feasible

The listed rights also include withdrawing consent where processing is based on your consent, and receiving your collected Personal Data in a structured, commonly used and machine-readable format so it can be transferred to another company, where technically feasible.

Supporting quotations

The right to withdraw consent, where processing is based on your consent

The right to receive your collected Personal Data in a structured, commonly used, and machine-readable format to facilitate its transfer to another company, where technically feasible

Qualifications & exceptions

• Consent withdrawal applies only where processing is based on consent.
• Portability applies where technically feasible.

Account & Service Control · Procedure

To exercise these rights, email privacy[at]github[dot]com; GitHub may ask for extra information to verify your identity

To exercise the rights listed, you send an email to privacy[at]github[dot]com and follow the instructions provided. For security, GitHub may request extra information to verify your identity before addressing your request. For feedback or concerns you can contact the Data Protection Officer at dpo[at]github[dot]com.

Supporting quotations

To exercise these rights, please send an email to privacy[at]github[dot]com and follow the instructions provided. To verify your identity for security, we may request extra information before addressing your data-related request. Please contact our Data Protection Officer at dpo[at]github[dot]com for any feedback or concerns.

Qualifications & exceptions

• GitHub may ask for extra information to verify your identity before acting.

Legal Rights & Agreement Rules · User right or choice

Depending on your region you may complain to your local Data Protection Authority; EU and UK contact sites are named

Depending on your region, you have the right to complain to your local Data Protection Authority. The Statement says European users can find authority contacts on the European Data Protection Board website, and UK users on the Information Commissioner's Office website.

Supporting quotations

Depending on your region, you have the right to complain to your local Data Protection Authority. European users can find authority contacts on the European Data Protection Board website, and UK users on the Information Commissioner’s Office website.

Qualifications & exceptions

• Depends on your region.

Retention & Deletion · Restriction or exception

GitHub aims to respond to requests promptly but may keep certain data for legal obligations or legal claims

GitHub says it aims to respond promptly to requests in compliance with legal requirements. It notes that it may retain certain data as necessary for legal obligations or for establishing, exercising or defending legal claims. The aim to respond promptly is not a fixed deadline in this section.

Supporting quotations

We aim to promptly respond to requests in compliance with legal requirements. Please note that we may retain certain data as necessary for legal obligations or for establishing, exercising, or defending legal claims.

Qualifications & exceptions

• Retention is allowed as necessary for legal obligations or legal claims.

Not stated here

• No response deadline is stated in this section; the US state section gives timing for some requests.

Use & Processing · Company practice

GitHub stores and processes Personal Data in many places, including your region, the United States and other countries

GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries or subprocessors have operations.

Supporting quotations

GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations.

Legal Rights & Agreement Rules · Company practice

For EU, UK and Swiss transfers to countries without adequacy, GitHub generally relies on standard contractual clauses

GitHub transfers Personal Data from the European Union, the United Kingdom and Switzerland to countries that the European Commission has not recognized as having an adequate level of data protection. For such transfers it generally relies on the standard contractual clauses published by the European Commission under Commission Implementing Decision 2021/914, to help protect your rights. The word "generally" means the source does not say these clauses are used in every case. The Statement also links an article on the Commission's adequacy decisions.

Supporting quotations

We transfer Personal Data from the European Union, the United Kingdom, and Switzerland to countries that the European Commission has not recognized as having an adequate level of data protection. When we engage in such transfers, we generally rely on the standard contractual clauses published by the European Commission under

Commission Implementing Decision 2021/914

to help protect your rights and enable these protections to travel with your data.

Qualifications & exceptions

• GitHub "generally" relies on the clauses; other mechanisms are not described here.

Not stated here

• The linked European Commission article is not supplied; the Statement's Data Privacy Framework section describes another mechanism.

Legal Rights & Agreement Rules · Company commitment

GitHub says it complies with and is certified to the EU-U.S., UK Extension and Swiss-U.S. Data Privacy Frameworks

GitHub states that it complies with the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework, as set forth by the U.S. Department of Commerce. It says it has certified to the Department of Commerce that it adheres to the EU-U.S. DPF Principles for personal data received from the European Union and from the United Kingdom (and Gibraltar), and to the Swiss-U.S. DPF Principles for personal data received from Switzerland, in each case in reliance on the matching framework. The Statement points to the Data Privacy Framework website to view the certification.

Supporting quotations

GitHub also complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.

GitHub has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. GitHub has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.

Qualifications & exceptions

• Covers personal data received from the EU, the UK (and Gibraltar) and Switzerland in reliance on the matching framework.

Not stated here

• The certification itself is on a linked government website that is not supplied.

Legal Rights & Agreement Rules · Restriction or exception

If this Statement conflicts with the DPF Principles, the Principles govern

The Statement says that if there is any conflict between its terms and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles govern.

Supporting quotations

If there is any conflict between the terms in this privacy statement and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.

Qualifications & exceptions

• Applies to personal data received under the Data Privacy Frameworks.

Legal Rights & Agreement Rules · Company commitment

GitHub stays liable under the DPF Principles if its agent mishandles transferred data, unless not responsible

GitHub says it has the responsibility for Personal Data it receives under the DPF Principles and then transfers to a third party acting as an agent on its behalf. It remains liable under the DPF Principles if its agent processes that data inconsistently with the Principles, unless GitHub proves that it is not responsible for the event giving rise to the damage.

Supporting quotations

GitHub has the responsibility for the processing of Personal Data it receives under the Data Privacy Framework (DPF) Principles and subsequently transfers to a third party acting as an agent on GitHub’s behalf. GitHub shall remain liable under the DPF Principles if its agent processes such Personal Data in a manner inconsistent with the DPF Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.

Qualifications & exceptions

• Applies to data received under the DPF and passed to an agent acting on GitHub's behalf.
• GitHub is not liable if it proves it is not responsible for the event giving rise to the damage.

Legal Rights & Agreement Rules · Procedure

EU, UK and Swiss individuals with DPF complaints should first contact GitHub at dpo[at]github[dot]com

GitHub commits to resolve DPF Principles-related complaints about its collection and use of your personal information. EU, UK and Swiss individuals with inquiries or complaints about personal data received in reliance on the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF should first contact GitHub at dpo[at]github[dot]com.

Supporting quotations

GitHub commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension, and the Swiss-U.S. DPF should first contact GitHub at: dpo[at]github[dot]com.

Qualifications & exceptions

• For EU, UK and Swiss individuals, about data received in reliance on the DPF.

Legal Rights & Agreement Rules · Procedure

An unresolved DPF complaint can go to the International Centre for Dispute Resolution at no cost to you

If you do not receive timely acknowledgment of your DPF Principles-related complaint, or GitHub has not addressed it to your satisfaction, the Statement directs you to a linked page to file a complaint. It says the services of the International Centre for Dispute Resolution are provided at no cost to you.

Supporting quotations

If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit

The services of the International Centre for Dispute Resolution are provided at no cost to you.

Qualifications & exceptions

• Applies if GitHub does not acknowledge the complaint in time or does not address it to your satisfaction.

Not stated here

• The linked complaint page is not supplied; "timely" is not defined.

Legal Rights & Agreement Rules · User right or choice

Under certain conditions you can invoke binding arbitration for DPF complaints not resolved elsewhere

The Statement says an individual has the possibility, under certain conditions, to invoke binding arbitration for complaints about DPF compliance that were not resolved by any of the other DPF mechanisms. It points to a linked Data Privacy Framework page for further information; the conditions are not stated in the Statement.

Supporting quotations

An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.

Qualifications & exceptions

• Only under certain conditions, and for complaints not resolved by other DPF mechanisms.

Not stated here

• The conditions for binding arbitration are on a linked page that is not supplied.

Legal Rights & Agreement Rules · Context

GitHub says it is subject to Federal Trade Commission enforcement of its DPF commitments

GitHub states it is subject to the investigatory and enforcement powers of the Federal Trade Commission. Under Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), failing to abide by commitments to implement the DPF Principles may be challenged as deceptive by the FTC, which can prohibit such misrepresentations through administrative orders or by seeking court orders. This describes the FTC's stated powers; the Act itself is not supplied.

Supporting quotations

GitHub is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC). Under Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), an organization's failure to abide by commitments to implement the DPF Principles may be challenged as deceptive by the FTC. The FTC has the power to prohibit such misrepresentations through administrative orders or by seeking court orders.

Not stated here

• The text of the cited Federal Trade Commission Act provision is not part of this source.

Security & Safeguards · Company commitment

GitHub says it uses administrative, technical and physical security controls, where appropriate

GitHub says it uses administrative, technical and physical security controls to protect your Personal Data. The security section repeats this and adds "where appropriate". The Statement does not name specific controls or standards.

Supporting quotations

GitHub uses appropriate administrative, technical, and physical security controls to protect your Personal Data.

GitHub uses administrative, technical, and physical security controls where appropriate to protect your Personal Data.

Qualifications & exceptions

• The security section says controls are used "where appropriate".

Not stated here

• No specific security controls, certifications or standards are named.

Retention & Deletion · Company practice

GitHub keeps Personal Data while your account is active and as needed for contracts, law, disputes and enforcement

GitHub says it retains your Personal Data as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes and enforce agreements. It says the retention duration depends on the purpose of the data collection and any legal obligations. No specific retention periods are given.

Supporting quotations

We’ll retain your Personal Data as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements. The retention duration depends on the purpose of data collection and any legal obligations.

Qualifications & exceptions

• Duration depends on the purpose of collection and legal obligations.

Not stated here

• No specific retention periods are stated; what happens to data after account closure beyond these needs is not detailed.

Account & Service Control · Procedure

You can contact GitHub by contact form or by emailing the Data Protection Officer; two postal addresses are given

The Statement says to contact GitHub via its contact form or by emailing the Data Protection Officer at dpo[at]github[dot]com. Two addresses are listed: GitHub B.V. in Amsterdam, The Netherlands, and GitHub, Inc. in San Francisco, California, United States.

Supporting quotations

Contact us via our contact form or by emailing our Data Protection Officer at dpo[at]github[dot]com. Our addresses are:

GitHub B.V. Prins Bernhardplein 200, Amsterdam 1097JB The Netherlands

GitHub, Inc. 88 Colin P. Kelly Jr. St. San Francisco, CA 94107 United States

Data Access & Collection · Company practice

The Services are not intended for under-13s, and GitHub says it does not intentionally gather their Personal Data

GitHub says its Services are not intended for individuals under the age of 13 and that it does not intentionally gather Personal Data from them. If you become aware that a minor has provided Personal Data, you can notify GitHub through a linked contact page.

Supporting quotations

Our Services are not intended for individuals under the age of 13. We do not intentionally gather Personal Data from such individuals. If you become aware that a minor has provided us with Personal Data, please

notify us

Qualifications & exceptions

• Stated for individuals under 13; GitHub says it does not "intentionally" gather their data.

Not stated here

• The linked contact page for notifying GitHub is not supplied here, so how a report is handled is unknown.
• The Statement does not say what GitHub does if it learns it has collected a child's data.

Legal Rights & Agreement Rules · Company commitment

GitHub may revise the Statement and gives at least 30 days' notice of material changes by website update or email

GitHub may periodically revise the Privacy Statement. If there are material changes, it says it will provide at least 30 days' prior notice by updating its website or by sending an email to the primary email address associated with your GitHub account. Notice by website update does not itself say how you would be alerted.

Supporting quotations

GitHub may periodically revise this Privacy Statement. If there are material changes to the statement, we will provide at least 30 days prior notice by updating our website or sending an email to your primary email address associated with your GitHub account.

Qualifications & exceptions

• The 30-day notice applies to material changes only, and the notice may be given by website update or by email.

Legal Rights & Agreement Rules · Restriction or exception

English controls if a translation conflicts with it; a French PDF and other translations are linked

Translations of the Statement are provided in other languages. In the event of any conflict, uncertainty or apparent inconsistency between a translation and the English version, the English version controls. A French version is available as a PDF, and other languages can be reached from the GitHub documentation site via a language drop-down.

Supporting quotations

Below are translations of this document into other languages. In the event of any conflict, uncertainty, or apparent inconsistency between any of those versions and the English version, this English version is the controlling version.

Cliquez ici pour obtenir la version française

For translations of this statement into other languages, please visit

Qualifications & exceptions

• English controls over any translation.

Not stated here

• The translated versions are not part of this source.

Data Access & Collection · Company practice

GitHub uses cookies to provide, secure and improve the Service: login, preferences, fraud prevention and statistics

GitHub says it uses cookies to provide, secure and improve its Service or to develop new features. Its examples are to keep you logged in, remember your preferences, identify your device for security and fraud purposes (including as needed to maintain the integrity of the Service), compile statistical reports, and provide information and insight for future development of GitHub. A linked page on cookies on GitHub describes the cookies it sets, why, and their expiration; that page is not supplied here.

Supporting quotations

GitHub uses cookies to provide, secure and improve our Service or to develop new features and functionality of our Service. For example, we use them to (i) keep you logged in, (ii) remember your preferences, (iii) identify your device for security and fraud purposes, including as needed to maintain the integrity of our Service, (iv) compile statistical reports, and (v) provide information and insight for future development of GitHub.

Qualifications & exceptions

• The five uses are introduced as examples ("for example").

Not stated here

• The linked "cookies on GitHub" page, which lists the specific cookies and their expiration, is not part of this source.

Data Access & Collection · Company practice

On Enterprise Marketing Pages, GitHub may use non-essential cookies to personalize and to serve and measure ads

For Enterprise Marketing Pages, GitHub says it may use non-essential cookies to gather information about enterprise users' interests and online activities, to personalize their experiences (including making ads, content, recommendations and marketing more relevant), and to serve and measure the effectiveness of targeted advertising and other marketing. Examples of such pages include resources.github.com, where additional cookies such as advertising IDs may be used for sales and marketing purposes, and the cookies section states GitHub will place non-essential cookies on pages where it markets to enterprise customers. If you disable the non-essential cookies on those pages, the ads, content and marketing you see may be less relevant.

Supporting quotations

For Enterprise Marketing Pages, we may also use non-essential cookies to (i) gather information about enterprise users’ interests and online activities to personalize their experiences, including by making the ads, content, recommendations, and marketing seen or received more relevant and (ii) serve and measure the effectiveness of targeted advertising and other marketing efforts. If you disable the non-essential cookies on the Enterprise Marketing Pages, the ads, content, and marketing you see may be less relevant.

When visiting Enterprise Marketing Pages, like resources.github.com, these and additional cookies, like advertising IDs, may be used for sales and marketing purposes.

GitHub will place non-essential cookies on pages where we market products and services to enterprise customers, for example, on resources.github.com.

Qualifications & exceptions

• Applies to Enterprise Marketing Pages, described as pages where GitHub markets products and services to enterprise customers, such as resources.github.com.
• Disabling non-essential cookies there makes the ads and marketing you see less relevant; it is not stated to stop all data collection.

Not stated here

• The source does not list every page counted as an Enterprise Marketing Page.

Cross-references

• contrast (model-proposed): If your browser sends Do Not Track, GitHub says it will not set non-essential cookies or load resources that do — The Do Not Track card says GitHub will not set non-essential cookies if your browser sends a DNT signal, listed among controls for all websites. The enterprise marketing card says GitHub will place non-essential cookies on pages where it markets to enterprise customers. The source does not say whether the DNT commitment applies on those pages, so the two pull in different directions without a stated resolution.

Data Access & Collection · Company practice

GitHub emails may contain a pixel tag that tells GitHub whether you opened the email and your IP address

GitHub's emails to users may contain a pixel tag, a small clear image that can tell GitHub whether you have opened an email and what your IP address is. GitHub says it uses the tag to make its email communications more effective and to make sure it is not sending you unwanted email.

Supporting quotations

Our emails to users may contain a pixel tag, which is a small, clear image that can tell us whether or not you have opened an email and what your IP address is. We use this pixel tag to make our email communications more effective and to make sure we are not sending you unwanted email.

Qualifications & exceptions

• Applies to emails that contain a pixel tag ("may contain").

Retention & Deletion · Company practice

Session cookies last until you stop browsing; persistent cookies last until they expire or you delete them

The time a cookie stays on your browser or device depends on whether it is a session or persistent cookie. Session cookies stay only until you stop browsing. Persistent cookies stay until they expire or are deleted, and their expiration or retention period depends on the purpose of the cookie collection and the tool used. You may be able to delete cookie data. The source does not state specific durations here.

Supporting quotations

The length of time a cookie will stay on your browser or device depends on whether it is a “persistent” or “session” cookie. Session cookies will only stay on your device until you stop browsing. Persistent cookies stay until they expire or are deleted. The expiration time or retention period applicable to persistent cookies depends on the purpose of the cookie collection and tool used. You may be able to delete cookie data.

Qualifications & exceptions

• Persistent cookie lifetimes depend on the cookie's purpose and the tool used.

Not stated here

• No specific cookie lifetimes are given in this passage.

Data Access & Collection · Company practice

GitHub uses web beacons, local storage and mobile analytics along with cookies to operate and provide the Services

GitHub says it uses cookies and similar technologies, such as web beacons, local storage and mobile analytics, to operate and provide the Services. The Statement then defines cookies, web beacons, mobile identifiers and flash cookies.

Supporting quotations

We use cookies and similar technologies, such as web beacons, local storage, and mobile analytics, to operate and provide our Services.

Data Access & Collection · Context

A cookie is a small text file that can uniquely identify your browser and lets a web server recognize it over time

The Statement defines cookies as small text files stored by your browser on your device. A cookie can be read when your browser connects to a web server in the domain that placed it. The text may contain a string of numbers and letters that may uniquely identify your device, and can contain other information, which lets the server recognize your browser over time.

Supporting quotations

Cookies are small text files stored by your browser on your device. A cookie can later be read when your browser connects to a web server in the same domain that placed the cookie. The text in a cookie contains a string of numbers and letters that may uniquely identify your device and can contain other information as well. This allows the web server to recognize your browser over time, each time it connects to that web server.

Sharing & Disclosure · Company practice

Web beacons and third-party content such as embedded videos or ads make your browser connect to third-party servers

Web beacons are electronic images ("single-pixel" or "clear GIFs") within a website or email. When your browser opens a page or email containing one, it connects to the web server that hosts the image, typically operated by a third party, which can log information about your device and set and read its own cookies. The Statement says third-party content on its websites (such as embedded videos, plug-ins or ads) likewise causes your browser to connect to the third party's server.

Supporting quotations

Web beacons are electronic images (also called “single-pixel” or “clear GIFs”) that are contained within a website or email. When your browser opens a webpage or email that contains a web beacon, it automatically connects to the web server that hosts the image (typically operated by a third party). This allows that web server to log information about your device and to set and read its own cookies. In the same way, third-party content on our websites (such as embedded videos, plug-ins, or ads) results in your browser connecting to the third-party web server that hosts that content.

Qualifications & exceptions

• The hosting server is "typically" operated by a third party.

Data Access & Collection · Company practice

Mobile identifiers work like cookies; on Enterprise Marketing pages they may support sales and marketing collection

Mobile identifiers for analytics can be accessed and used by apps on mobile devices much as websites use cookies. When you visit Enterprise Marketing pages such as resources.github.com on a mobile device, these may allow GitHub and its third-party analytics and advertising partners to collect data for sales and marketing purposes.

Supporting quotations

Mobile identifiers for analytics can be accessed and used by apps on mobile devices in much the same way that websites access and use cookies. When visiting Enterprise Marketing pages, like resources.github.com, on a mobile device these may allow us and our third-party analytics and advertising partners to collect data for sales and marketing purposes.

Qualifications & exceptions

• The sales and marketing collection is described for visits to Enterprise Marketing pages on a mobile device ("may allow").

Data Access & Collection · Company practice

GitHub may also use flash cookies (Local Shared Objects) to store information about your use of the Services

GitHub says it may also use so-called "flash cookies", also known as Local Shared Objects, to collect and store information about your use of the Services. It notes that flash cookies are commonly used for advertisements and videos.

Supporting quotations

We may also use so-called “flash cookies” (also known as “Local Shared Objects” or “LSOs”) to collect and store information about your use of our Services. Flash cookies are commonly used for advertisements and videos.

Qualifications & exceptions

• Stated as "may also use".

Sharing & Disclosure · Company practice

Analytics and advertising partners may use cookies in the Services to track your activity over time for targeted ads

GitHub says its Services use cookies and similar technologies to store preferences and settings, enable sign-in, analyze performance, track your interaction with the Services, develop inferences, combat fraud and fulfill other legitimate purposes. Some may be provided by third parties, including service providers and advertising partners. For example, analytics and advertising partners may use these technologies in the Services to collect personal information (such as pages visited, links clicked, and similar usage information, identifiers and device information) about your online activities over time and across Services, including for targeted advertising. The Statement adds that a table below gives more detail on cookie types.

Supporting quotations

The GitHub Services use cookies and similar technologies for a variety of purposes, including to store your preferences and settings, enable you to sign-in, analyze how our Services perform, track your interaction with the Services, develop inferences, combat fraud, and fulfill other legitimate purposes. Some of these cookies and technologies may be provided by third parties, including service providers and advertising partners.

our analytics and advertising partners may use these technologies in our Services to collect personal information (such as the pages you visit, the links you click on, and similar usage information, identifiers, and device information) related to your online activities over time and across Services for various purposes, including targeted advertising.

The table below provides additional information about how we use different types of cookies:

Purpose Description

Qualifications & exceptions

• Collection by partners is described as occurring over time and across Services.

Not stated here

• The source does not name the analytics and advertising partners.

Sharing & Disclosure · Company practice

GitHub and its partners also share the information they collect or infer with third parties "for these purposes"

The Statement says GitHub and/or its partners also share the information they collect or infer with third parties "for these purposes". It does not say which purposes this refers to (the preceding paragraph lists several, including targeted advertising) or who the third parties are.

Supporting quotations

We and/or our partners also share the information we collect or infer with third parties for these purposes.

Not stated here

• "These purposes" is not defined in the sentence, and the recipients are not named.

Data Access & Collection · Company practice

Required cookies cover login, language, shopping cart, performance, page load times and audience measurement

In the cookie table, "Required Cookies" are described as used to perform essential website functions and provide the services. Examples given are logging you in, saving language preferences, providing a shopping cart experience, improving performance, routing traffic between web servers, detecting screen size, determining page load times, improving user experience and audience measurement. GitHub says these cookies are necessary for its websites to work. Note that "audience measurement" is listed among the uses of required cookies.

Supporting quotations

Required Cookies GitHub uses required cookies to perform essential website functions and to provide the services. For example, cookies are used to log you in, save your language preferences, provide a shopping cart experience, improve performance, route traffic between web servers, detect the size of your screen, determine page load times, improve user experience, and for audience measurement. These cookies are necessary for our websites to work.

Qualifications & exceptions

• The uses are introduced as examples ("for example").

Data Access & Collection · Company practice

Third parties may use analytics cookies on GitHub websites, and some analytics cookies also personalize ads

In the cookie table, "Analytics" cookies are used by third parties GitHub allows, to understand how you use its websites (for example, which pages you visit and how many clicks you need to accomplish a task). GitHub adds that it also uses some analytics cookies to provide personalized advertising.

Supporting quotations

Analytics We allow third parties to use analytics cookies to understand how you use our websites so we can make them better. For example, cookies are used to gather information about the pages you visit and how many clicks you need to accomplish a task. We also use some analytics cookies to provide personalized advertising.

Qualifications & exceptions

• Some, not all, analytics cookies are also used for personalized advertising.

Sharing & Disclosure · Company practice

Social media cookies show ads based on your social media profiles and activity, and help third parties develop products

In the cookie table, GitHub and third parties use "Social Media" cookies to show you ads and content based on your social media profiles and activity on GitHub's websites, so that the ads and content you see on GitHub and on social media better reflect your interests. The row also says this enables third parties to develop and improve their products, which they may use on websites not owned or operated by GitHub.

Supporting quotations

Social Media GitHub and third parties use social media cookies to show you ads and content based on your social media profiles and activity on GitHub’s websites. This ensures that the ads and content you see on our websites and on social media will better reflect your interests. This also enables third parties to develop and improve their products, which they may use on websites that are not owned or operated by GitHub.

Qualifications & exceptions

• Third parties may use what they learn to improve products used on websites GitHub does not own or operate.

Data Access & Collection · Company practice

Advertising cookies track ad clicks and purchases after clicks and show ads based on prior ads, interests and browsing

In the cookie table, GitHub and third parties use "Advertising" cookies to show you new ads based on ads you have already seen. The cookies also track which ads you click or purchases you make after clicking an ad. The row says this is done both for payment purposes and to show ads more relevant to you, and gives examples: detecting when you click an ad and showing ads based on your social media interests and website browsing history.

Supporting quotations

Advertising In addition, GitHub and third parties use advertising cookies to show you new ads based on ads you've already seen. Cookies also track which ads you click or purchases you make after clicking an ad. This is done both for payment purposes and to show you ads that are more relevant to you. For example, cookies are used to detect when you click an ad and to show you ads based on your social media interests and website browsing history.

Qualifications & exceptions

• Tracking of purchases applies to purchases made after clicking an ad.

Data Access & Collection · User right or choice

Pages that serve non-essential cookies have a footer link to cookie settings that you can use at any time

The Statement lists several ways to disable non-essential cookies. Under the sub-heading about GitHub Enterprise Marketing Pages, it says any GitHub page that serves non-essential cookies will have a link in the footer to cookie settings, where you can express your preferences at any time by updating your settings. The sub-heading mentions Enterprise Marketing Pages while the sentence says "any GitHub page", so the source does not make clear whether the link appears only on Enterprise Marketing Pages.

Supporting quotations

You have several options to disable non-essential cookies:

Specifically on GitHub Enterprise Marketing Pages

Any GitHub page that serves non-essential cookies will have a link in the page’s footer to cookie settings. You can express your preferences at any time by clicking on that link and updating your settings.

Qualifications & exceptions

• Appears on pages that serve non-essential cookies.
• Listed under the sub-heading "Specifically on GitHub Enterprise Marketing Pages".

Not stated here

• The source does not say whether the footer link is limited to Enterprise Marketing Pages or appears on every GitHub page that serves non-essential cookies.

Data Access & Collection · User right or choice

Some users can also manage non-essential cookies through a consent banner to accept, manage or reject all

The Statement says some users will also be able to manage non-essential cookies via a cookie consent banner, with options to accept, manage and reject all non-essential cookies. It does not say which users see the banner.

Supporting quotations

Some users will also be able to manage non-essential cookies via a cookie consent banner, including the options to accept, manage, and reject all non-essential cookies.

Qualifications & exceptions

• Only "some users".

Not stated here

• The source does not say which users are offered the banner.

Data Access & Collection · Company commitment

If your browser sends Do Not Track, GitHub says it will not set non-essential cookies or load resources that do

Under general controls "for all websites", the Statement says that if your browser sends a Do Not Track (DNT) signal, GitHub will not set non-essential cookies and will not load third-party resources which set non-essential cookies. The source does not say whether this applies on Enterprise Marketing Pages, where the cookies section separately says GitHub will place non-essential cookies on pages where it markets to enterprise customers.

Supporting quotations

Generally for all websites

If your browser sends a Do Not Track (DNT) signal, GitHub will not set non-essential cookies and will not load third party resources which set non-essential cookies.

Qualifications & exceptions

• Listed among general controls under "Generally for all websites".

Not stated here

• The source does not reconcile this DNT commitment with its statement that non-essential cookies are placed on enterprise marketing pages.

Cross-references

• contrast (model-proposed): On Enterprise Marketing Pages, GitHub may use non-essential cookies to personalize and to serve and measure ads — The Do Not Track card says GitHub will not set non-essential cookies if your browser sends a DNT signal, listed among controls for all websites. The enterprise marketing card says GitHub will place non-essential cookies on pages where it markets to enterprise customers. The source does not say whether the DNT commitment applies on those pages, so the two pull in different directions without a stated resolution.

Data Access & Collection · User right or choice

Browser cookie settings and tracking or content blockers can limit non-essential cookies

The Statement lists other controls: many browsers provide cookie controls that may limit the types of cookies you encounter; a browser extension designed to block tracking, such as Privacy Badger, may disable non-essential cookies set by a website or third parties; and a browser extension that blocks unwanted content, such as uBlock Origin, will disable non-essential cookies to the extent that content that sets them is blocked. These are tools you set up yourself rather than GitHub commitments.

Supporting quotations

Many browsers provide cookie controls which may limit the types of cookies you encounter online.

non-essential cookies set by a website or third parties may be disabled.

non-essential cookies will be disabled to the extent that content that sets non-essential cookies will be blocked.

Qualifications & exceptions

• Effect depends on the browser or extension and what it blocks ("may", "to the extent").

Sharing & Disclosure · Company commitment

If GitHub detects a Global Privacy Control signal from your device, it says it will not share your data

The Statement says you may use the Global Privacy Control (GPC) to communicate your privacy preferences. If GitHub detects the GPC signal from your device, it says GitHub will not share your data, and adds in parentheses that it does not sell your data. The source does not say what "share" covers in this sentence beyond that parenthetical; the US state section describes opt-out of "sharing" separately.

Supporting quotations

You may use the Global Privacy Control (GPC) to communicate your privacy preferences. If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).

Qualifications & exceptions

• Applies when GitHub detects the GPC signal from your device.

Not stated here

• The source does not define "share" here; the US state section describes "sharing" for particular categories.

Sharing & Disclosure · User right or choice

Advertising partners may take part in opt-out programs run by US, Canadian and European advertising associations

GitHub says its advertising partners may participate in associations that provide simple ways to opt out of ad targeting. The Statement points to the NAI and DAA for the United States, the Digital Advertising Alliance of Canada, and the European Digital Advertising Alliance. These are external opt-out sites; the Statement does not say which partners participate.

Supporting quotations

Advertising controls. Our advertising partners may participate in associations that provide simple ways to opt out of ad targeting, which you can access at:

United States:

Canada:

Europe:

Qualifications & exceptions

• Participation is stated as "may participate".

Not stated here

• The linked opt-out sites are not supplied, and the source does not name which partners take part.

Data Access & Collection · Procedure

Cookie choices are specific to the browser you use, so repeat them on other devices and browsers

The Statement says these choices are specific to the browser you are using. If you access the Services from other devices or browsers, take the same actions there so your choices apply to the data collected through them.

Supporting quotations

These choices are specific to the browser you are using. If you access our Services from other devices or browsers, take these actions from those systems to ensure your choices apply to the data collected when you use those systems.

Qualifications & exceptions

• Choices apply only to the browser where you make them.

Legal Rights & Agreement Rules · Context

The US state section gives extra information for residents of certain states with distinct privacy laws

This section provides extra information specifically for residents of certain US states that have distinct data privacy laws and regulations. The Statement says these laws may grant specific rights to residents of those states when the laws come into effect. In this section, "personal information" has the same meaning as "Personal Data". The section does not list the states in this introduction.

Supporting quotations

This section provides extra information specifically for residents of certain US states that have distinct data privacy laws and regulations. These laws may grant specific rights to residents of these states when the laws come into effect. This section uses the term “personal information” as an equivalent to the term “Personal Data.”

Qualifications & exceptions

• Applies to residents of certain US states with distinct privacy laws; rights depend on when those laws come into effect.

Not stated here

• The introduction does not list which states are covered; later subsections name California, Colorado, Connecticut, Virginia and Nevada.

Account & Service Control · User right or choice

US state residents can request details of the personal information collected and ask for corrections

The Statement lists rights common to US state privacy laws. One is knowledge and correction: you may request details on the specific personal information GitHub has collected about you and ask it to correct inaccurate information, by contacting GitHub. You can also access and edit basic account information in your settings.

Supporting quotations

These rights are common to the US State privacy laws:

Right to Knowledge and Correction: You have the right to request details on the specific personal information we’ve collected about you and the right to correct inaccurate information. You can exercise this right by contacting us. You can also access and edit basic account information in your settings.

Qualifications & exceptions

• Described as rights "common to the US State privacy laws"; whether a specific state grants each right is not stated.

Sharing & Disclosure · User right or choice

US state section: GitHub says it shares information with service providers for operations such as storage and hosting

Under "Right to Know Data Recipients", GitHub says it shares your information with service providers for legitimate business operations, such as data storage and hosting. It directs you to "Sharing Your Information" below for more details. That title does not appear as a heading in the supplied text; the sharing section is headed "Sharing of Personal Data", and this card does not assume the two are the same.

Supporting quotations

Right to Know Data Recipients: We share your information with service providers for legitimate business operations, such as data storage and hosting. For more details, please see “Sharing Your Information” below.

Qualifications & exceptions

• The example given is service providers for data storage and hosting; the Statement's full list of recipients is in its sharing section.

Not stated here

• The cross-reference "Sharing Your Information" does not match a heading in the supplied text.

Retention & Deletion · User right or choice

US state residents can request deletion, with exceptions; GitHub says it tells service providers to delete too

You can request deletion of your data, apart from a few exceptions. The exceptions given include circumstances where GitHub must retain data to comply with legal obligations, detect fraudulent activity, investigate reports of abuse or other violations of its Terms of Service, or rectify security issues. On receiving your verified request, GitHub says it will promptly delete your personal information unless an exception applies, and instruct its service providers to do the same. It adds that it employs brief retention terms by design.

Supporting quotations

Right to request Deletion: You reserve the right to request the deletion of your data, barring a few exceptions. Such exceptions include circumstances where we are required to retain data to comply with legal obligations, detect fraudulent activity, investigate reports of abuse or other violations of our Terms of Service, or rectify security issues. Upon receiving your verified request, we will promptly delete your personal information (unless an exception applies), and instruct our service providers to do the same. We employ brief retention terms by design.

Qualifications & exceptions

• Deletion follows a verified request.
• Exceptions: legal obligations, detecting fraud, investigating abuse or Terms of Service violations, and rectifying security issues.

Not stated here

• "Brief retention terms" is not defined, and the exceptions are introduced as examples ("such exceptions include").

Account & Service Control · User right or choice

Two free requests in any 12-month period; GitHub commits to respond within 45 days, extendable by 45 more

Under "Right to a Timely Response", GitHub says you are allowed two free requests in any 12-month period and commits to respond to a request within 45 days. In complex cases it may extend its response time by an additional 45 days. The Statement does not say what happens with requests beyond two in a 12-month period.

Supporting quotations

Right to a Timely Response: You are allowed to make two free requests in any 12-month period. We commit to responding to your request within 45 days. In complex cases, we may extend our response time by an additional 45 days.

Qualifications & exceptions

• Two free requests in any 12-month period.
• Response in 45 days, extendable by an additional 45 days in complex cases.

Not stated here

• The source does not say whether additional requests are refused or charged.

Account & Service Control · Company commitment

GitHub says it will not hold it against you when you exercise your privacy rights

Under "Non-Discrimination", GitHub says it will not hold it against you when you exercise any of your rights, and encourages you to review your privacy settings and contact it with questions. The source does not describe what treatment this covers beyond that statement.

Supporting quotations

Non-Discrimination: We will not hold it against you when you exercise any of your rights.

Data Access & Collection · Company practice

GitHub may collect identifiers, demographic, payment, commercial, internet activity and geolocation data and inferences

In its notice of collection, GitHub says it may collect various categories of personal information about website visitors and users of its Services (which include its applications, software, products or services): identifiers and contact information, demographic information, payment information, commercial information, internet or electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from such information.

Supporting quotations

We may collect various categories of personal information about our website visitors and users of "Services" which includes GitHub applications, software, products, or services. That information includes identifiers/contact information, demographic information, payment information, commercial information, internet or electronic network activity information, geolocation data, audio, electronic, visual, or similar information, and inferences drawn from such information.

Qualifications & exceptions

• Stated as "may collect" for website visitors and users of the Services.

Use & Processing · Company practice

GitHub says it collects this information to provide services, run its business, improve products and promote safety

GitHub says it collects this information for various purposes: identifying accessibility gaps and offering targeted support, fostering diversity and representation, providing services, troubleshooting, conducting business operations such as billing and security, improving products and supporting research, communicating important information, ensuring personalized experiences, and promoting safety and security.

Supporting quotations

We collect this information for various purposes. This includes identifying accessibility gaps and offering targeted support, fostering diversity and representation, providing services, troubleshooting, conducting business operations such as billing and security, improving products and supporting research, communicating important information, ensuring personalized experiences, and promoting safety and security.

Account & Service Control · Procedure

US state requests go to privacy[at]github[dot]com; GitHub may verify identity; agents need signed permission

To make an access, deletion, correction or opt-out request, you send an email to privacy[at]github[dot]com and follow the instructions provided. GitHub may need to verify your identity before processing your request. If you use an authorized agent, GitHub asks that they have your signed permission or power of attorney as required.

Supporting quotations

Exercising your Privacy Rights

To make an access, deletion, correction, or opt-out request, please send an email to privacy[at]github[dot]com and follow the instructions provided. We may need to verify your identity before processing your request. If you choose to use an authorized agent to submit a request on your behalf, please ensure they have your signed permission or power of attorney as required.

Qualifications & exceptions

• GitHub may verify your identity first.
• An authorized agent needs your signed permission or power of attorney "as required".

Sharing & Disclosure · User right or choice

Opt out of the sharing of your personal information with the "Do Not Share My Personal Information" footer link or GPC

To opt out of the sharing of your personal information, you can click the "Do Not Share My Personal Information" link in the footer of GitHub's Websites or use the Global Privacy Control (GPC) if available. Authorized agents can also submit opt-out requests on your behalf.

Supporting quotations

To opt out of the sharing of your personal information, you can click on the "Do Not Share My Personal Information" link on the footer of our Websites or use the Global Privacy Control ("GPC") if available. Authorized agents can also submit opt-out requests on your behalf.

Qualifications & exceptions

• The GPC option applies "if available".

Data Access & Collection · Company practice

California disclosures: categories collected in the last 12 months, their sources and the purposes

For California privacy law compliance, GitHub says that in the last 12 months it collected these categories of personal information: identifiers and contact information, demographic information (such as gender), payment card information associated with you, commercial information, internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above. The sources are directly from you, automatically, or from third parties. The business or commercial purposes are those summarized above and in the Statement under Processing Purposes.

Supporting quotations

We also make the following disclosures for purposes of compliance with California privacy law:

We collected the following categories of personal information in the last 12 months: identifiers/contact information, demographic information (such as gender), payment card information associated with you, commercial information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above.

The sources of personal information from whom we collected are: directly from you, automatically or from third parties.

The business or commercial purposes of collecting personal information are as summarized above and in our Privacy Statement under Processing Purposes.

Qualifications & exceptions

• Covers the last 12 months and is made for compliance with California privacy law.

Cross-references

• refers to (model-proposed): GitHub lists the ways it may process your Personal Data, which vary with your interface, features and access tools — The California disclosures say the business or commercial purposes of collecting personal information are as summarized in the Statement under Processing Purposes, which is the section the purposes cards describe.

Sharing & Disclosure · Company practice

California disclosures: categories disclosed for a business purpose in the last 12 months, and to whom

GitHub says that in the last 12 months it disclosed these categories of personal information for a business purpose: identifiers and contact information, demographic information (such as gender and rough geographic location), payment information, commercial information, internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above. It says it disclosed each category to third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third parties as described in the Sharing of Personal Data section.

Supporting quotations

We disclosed the following categories of personal information for a business purpose in the last 12 months: identifiers/contact information, demographic information (such as gender and rough geographic location), payment information, commercial information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above. We disclosed each category to third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third parties as described in the Sharing of Personal Data section of our Privacy Statement.

Qualifications & exceptions

• Covers the last 12 months and each listed category; recipients are stated for "each category".

Cross-references

• refers to (model-proposed): GitHub may share Personal Data with the listed categories of recipients — The California disclosure of categories disclosed for a business purpose refers to recipients "as described in the Sharing of Personal Data section" of the Statement, which the sharing cards describe.

Sharing & Disclosure · Company practice

California: identifiers, internet activity and inferences were "shared" with ad, analytics and social networks

GitHub says that, as defined by applicable law, it "shared" these categories of personal information in the last 12 months: identifiers and contact information, internet or other electronic network activity information, and inferences drawn from the above. It says it shared each category to or with advertising networks, data analytics providers and social networks. The stated business or commercial purpose is to assist with marketing, advertising and audience measurement.

Supporting quotations

As defined by applicable law, we “shared” the following categories of personal information in the last 12 months: identifiers/contact information, Internet or other electronic network activity information, and inferences drawn from the above. We shared each category to or with advertising networks, data analytics providers, and social networks.

The business or commercial purpose of sharing personal information is to assist us with marketing, advertising, and audience measurement.

Qualifications & exceptions

• "Shared" is used as defined by applicable law.
• Covers the last 12 months.

Sharing & Disclosure · Company commitment

GitHub says it does not "sell" or "share" the personal information of known minors under 16

Among its California disclosures, GitHub says it does not "sell" or "share" the personal information of known minors under 16 years of age. The statement is limited to minors GitHub knows to be under 16.

Supporting quotations

We do not “sell” or “share” the personal information of known minors under 16 years of age.

Qualifications & exceptions

• Limited to known minors under 16.
• Listed in the California disclosures.

Not stated here

• The source does not say how GitHub identifies known minors.

Sharing & Disclosure · User right or choice

California residents can ask whether GitHub disclosed their data for others' direct marketing; GitHub says it does not

Under California's "Shine the Light" law, California residents who have provided personal information to a business with which they have a business relationship for personal, family or household purposes ("California Customers") may request information on whether the business disclosed personal information to third parties for those third parties' direct marketing. GitHub says it does not disclose personal information to any third parties for their direct marketing purposes as defined by the law. California Customers can request further information about compliance by emailing privacy[at]github[dot]com. The Statement notes that businesses must respond to one request per California Customer each year and may not have to respond to requests made by other means than the designated email address.

Supporting quotations

Under California Civil Code section 1798.83, also known as the “Shine the Light” law, California residents who have provided personal information to a business with which the individual has established a business relationship for personal, family, or household purposes (“California Customers”) may request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marketing purposes.

Please be aware that we do not disclose personal information to any third parties for their direct marketing purposes as defined by this law.

California Customers may request further information about our compliance with this law by emailing (privacy[at]github[dot]com). Please note that businesses are required to respond to one request per California Customer each year and may not be required to respond to requests made by means other than through the designated email address.

Qualifications & exceptions

• Applies to California Customers: California residents who provided personal information for personal, family or household purposes to a business they have a relationship with.
• One request per California Customer each year; requests by means other than the designated email may not be answered.

Not stated here

• The text of California Civil Code section 1798.83 is not supplied; the Statement describes the law only as summarized here.

Content & IP Rights · User right or choice

California residents under 18 who are registered users can ask to remove content they posted publicly; not guaranteed

California residents under 18 who are registered users of online sites, services or applications have a right under California Business and Professions Code Section 22581 to remove, or request and obtain removal of, content or information they publicly posted. To do so GitHub directs you to submit a Private Information Removal request or to send GitHub support a detailed description of the content. GitHub warns that a request does not guarantee complete or comprehensive removal of content posted online and that the law may not permit or require removal in certain circumstances.

Supporting quotations

California residents under the age of 18 who are registered users of online sites, services, or applications have a right under California Business and Professions Code Section 22581 to remove, or request and obtain removal of, content or information they have publicly posted.

To remove content or information you have publicly posted, please submit a

Please be aware that your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

Qualifications & exceptions

• Applies to California residents under 18 who are registered users.
• Covers content or information they publicly posted; removal is not guaranteed and the law may not permit or require it in certain circumstances.

Not stated here

• The linked request forms are not supplied here, and the text of the cited Business and Professions Code section is not part of this source.

Account & Service Control · Procedure

Questions about privacy practices for California residents, and general concerns, can be emailed to GitHub

For questions about its privacy practices with respect to California residents, the Statement says to email privacy[at]github[dot]com. For any questions or concerns about its privacy practices, you can also email the Data Protection Officer at dpo[at]github[dot]com.

Supporting quotations

If you have any questions about our privacy practices with respect to California residents, please send an email to privacy[at]github[dot]com.

If you have any questions or concerns about our privacy practices, please email our Data Protection Officer at dpo[at]github[dot]com.

Account & Service Control · User right or choice

Colorado, Connecticut and Virginia residents can appeal if GitHub denies a rights request

If you live in Colorado, Connecticut or Virginia, the Statement says you have additional rights. One is the right to appeal if GitHub denies your rights request; GitHub says it will provide the information needed to submit an appeal at that time.

Supporting quotations

If you live in Colorado, Connecticut, or Virginia you have some additional rights:

If we deny your rights request, you have the right to appeal that decision. We will provide you with the necessary information to submit an appeal at that time.

Qualifications & exceptions

• Applies to residents of Colorado, Connecticut and Virginia.

Not stated here

• The appeal process itself is not described; the Statement says the information is provided when a request is denied.

Use & Processing · User right or choice

CO, CT and VA residents may opt out of certain profiling; GitHub says it does not engage in it under Colorado law

Residents of Colorado, Connecticut and Virginia have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. GitHub says it does not engage in such profiling as defined by Colorado law, so there is no need to opt out. The source refers only to the Colorado definition; it does not say how Connecticut or Virginia law define profiling.

Supporting quotations

If you live in Colorado, Connecticut, or Virginia you have some additional rights:

You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. GitHub does not engage in such profiling as defined by Colorado law, so there’s no need to opt out.

Qualifications & exceptions

• The statement that GitHub does not engage in such profiling refers to the definition in Colorado law.

Not stated here

• The source does not say whether GitHub's profiling status is the same under Connecticut or Virginia law.

Sharing & Disclosure · Company commitment

GitHub says it does not sell Nevada covered information, as defined in Nevada Revised Statutes Chapter 603A

In the Nevada subsection, GitHub says it does not sell your covered information, as defined under Chapter 603A of the Nevada Revised Statutes. For questions about covered information or anything else in the Statement, you can email privacy[at]github[dot]com. The text of Chapter 603A is not supplied.

Supporting quotations

Nevada

We do not sell your covered information, as defined under Chapter 603A of the Nevada Revised Statutes. If you still have questions about your covered information or anything else in our Privacy Statement, please send an email to privacy[at]github[dot]com.

Qualifications & exceptions

• Covers "covered information" as defined in Nevada law.

Not stated here

• The Nevada statute's definition of covered information is not supplied.