Developer / Coding · github.comGitHub Copilot
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“If you provide your private repository content as Input to AI Features, we may use that Input to provide, develop, train, and improve the Service, including AI Features. Your ability to opt out under Section J.3 applies to this use of private repository content. We will not otherwise use your private repository contents to develop or improve the Service.”
Watch: governing law disputes
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
Permits GitHub to freely assign or delegate the Terms and privacy statement at any time without consent, while restricting users from assigning or delegating any rights or obligations without GitHub's prior written consent, voiding any unauthorized assignment.
Mandatory California/federal law and exclusive San Francisco venue provisions may disadvantage international users or those in other US states who would face significant cost and inconvenience to litigate disputes. The carve-out for injunctive relief in any jurisdiction benefits GitHub more than users.
Plain-language summary stating GitHub will not be liable for damages or losses arising from use of or inability to use the service, flagging the operative limitations that follow.
How to read this page: Overall risk rates what GitHub Copilot's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredBased on 475 verified, verbatim-cited findings below — read the citations.
Based on 483 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Terms of ServiceVerified - read in full - 185 citationsstaticLast captured 2026-07-20
- Privacy PolicyVerified - read in full - 232 citationspdf textLast captured 2026-08-14
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
This clause establishes that GitHub will immediately bill the user upon upgrading from a free plan to a paid plan, setting out the billing timing obligation triggered by a plan upgrade.
" We will immediately bill you when you upgrade from the free plan to any paying plan."
Subjects all API use to both the Terms of Service and the GitHub Privacy Statement, incorporating those documents as binding on API users.
" All use of the GitHub API is subject to these Terms of Service and the GitHub Privacy Statement ."
Using Personal Data to evaluate advertising effectiveness goes beyond core service delivery and may implicate additional data processing activities including profiling.
"Personalization: We use Personal Data to customize the Service to your preferences, to evaluate the effectiveness of enterprise business ads and promotional communications, and to ensure a seamless and consistent user experience."
Imposes minimum age requirement of 13, states compliance with U.S. law obligations, prohibits users under 13, and mandates immediate account termination upon discovery of underage users, constituting an enforcement obligation and restriction.
" One person or legal entity may maintain no more than one free Account (if you choose to control a machine account as well, that's fine, but it can only be used for running a machine)."
This clause imposes an obligation on users to pay all fees including taxes associated with service use, to provide valid payment information for paid accounts, and to contact GitHub Support to dispute charges, allocating full financial responsibility for service usage to the user.
" You are responsible for all fees, including taxes, associated with your use of the Service. By using the Service, you agree to pay GitHub any charge incurred in connection with your use of the Service. If you dispute the matter, contact us..."
This clause permits users to change their service level at any time but imposes a restriction by warning that downgrading may result in loss of access to Content, features, or account capacity, and cross-references the Cancellation section for content recovery options.
" You may change your level of service at any time by choosing a plan option or going into your Billing settings . If you choose to downgrade your Account, you may lose access to Content, features, or capacity of your Account. Please see our..."
This segment grants GitHub permission to use non-essential cookies on Enterprise Marketing Pages for interest-based personalization and targeted advertising measurement, and discloses the effect of disabling those cookies on user experience.
" For Enterprise Marketing Pages, we may also use non-essential cookies to (i) gather information about enterprise users’ interests and online activities to personalize their experiences, including by making the ads, content, recommendations..."
This segment defines 'Profile Information' as a category of Personal Data collected to create a user profile, enumerating possible elements such as photo, email addresses, job title, and biography.
" Payment Information: For paid subscriptions, we collect details like name, billing address, and payment specifics."
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
" You may change your level of service at any time by choosing a plan option or going into your Billing settings . If you choose to downgrade your Account, you may lose access to Content, features, or capacity of your Account. Please see our section on Cancellation for information on getting a copy of that Content."
This clause permits users to change their service level at any time but imposes a restriction by warning that downgrading may result in loss of access to Content, features, or account capacity, and cross-references the Cancellation section for content recovery options.
AI-generated interpretation, not legal advice.
" This section applies to all AI Features unless a specific feature has additional terms that expressly modify them. The training and data-use provisions in Section J.3 apply only to individual licenses. If your use of the Service is governed by a GitHub Customer Agreement or volume licensing agreement, those agreements govern the use of your data in connection with AI Features and Section J.3 does not apply to you."
Defines the applicability of Section J's AI training and data-use provisions, creating an exception for enterprise users governed by a GitHub Customer Agreement or volume licensing agreement, under which Section J.3 does not apply and those agreements control data use.
AI-generated interpretation, not legal advice.
" One person or legal entity may maintain no more than one free Account (if you choose to control a machine account as well, that's fine, but it can only be used for running a machine)."
Restricts individuals and legal entities to no more than one free Account, with a limited exception for a machine account used only for running automated tasks; establishes a per-entity account limit tied to free tier.
AI-generated interpretation, not legal advice.
" Your login may only be used by one person — i.e., a single login may not be shared by multiple people. A paid Organization may only provide access to as many Personal Accounts as your subscription allows."
Restricts a login to use by a single individual and limits paid Organizations to providing access only to the number of Personal Accounts permitted by the subscription, creating a tier-linked access restriction.
AI-generated interpretation, not legal advice.
" Payment Based on Plan For monthly or yearly payment plans, the Service is billed in advance on a monthly or yearly basis respectively and is non-refundable. There will be no refunds or credits for partial months of service, downgrade refunds, or refunds for months unused with an open Account; however, the service will remain active for the length of the paid billing period. In order to treat everyone equally, no exceptions will be made."
Establishes that monthly and yearly plans are billed in advance and are non-refundable, explicitly prohibiting refunds or credits for partial months, downgrades, or unused months, with no exceptions.
AI-generated interpretation, not legal advice.
"Personalization: We use Personal Data to customize the Service to your preferences, to evaluate the effectiveness of enterprise business ads and promotional communications, and to ensure a seamless and consistent user experience."
Using Personal Data to evaluate advertising effectiveness goes beyond core service delivery and may implicate additional data processing activities including profiling.
AI-generated interpretation, not legal advice.
"Inference: We generate new information from other data we collect to derive likely preferences or other characteristics. For instance, we infer your general geographic location based on your IP address."
Derived/inferred data can constitute Personal Data under GDPR and similar frameworks. The broad framing ('likely preferences or other characteristics') allows significant profiling beyond the illustrative geographic example.
AI-generated interpretation, not legal advice.
" You retain all moral rights to Your Content that you upload, publish, or submit to any part of the Service, including the rights of integrity and attribution. However, you waive these rights and agree not to assert them against us or our Affiliates, to enable GitHub and our Affiliates to reasonably exercise the rights granted in Section D.4, but not otherwise."
Provides a fallback permission grant to GitHub to use content without attribution and to make reasonable adaptations where the moral rights waiver in Section D.7 is unenforceable under applicable law, ensuring the license remains operative regardless of jurisdiction.
AI-generated interpretation, not legal advice.
"Some of these cookies and technologies may be provided by third parties, including service providers and advertising partners. For example, our analytics and advertising partners may use these technologies in our Services to collect personal information (such as the pages you visit, the links you click on, and similar usage information, identifiers, and device information) related to your online activities over time and across Services for various purposes, including targeted advertising."
Allowing third-party advertising partners to collect personal information via the platform's own services constitutes direct third-party data collection, which may constitute a 'sale' or 'share' under CCPA and similar laws, and raises GDPR consent and data controller concerns.
AI-generated interpretation, not legal advice.
" GitHub may assign or delegate these Terms of Service and/or the GitHub Privacy Statement , in whole or in part, to any person or entity at any time with or without your consent, including the license grant in Section D.4. You may not assign or delegate any rights or obligations under the Terms of Service or Privacy Statement without our prior written consent, and any unauthorized assignment and delegation by you is void."
Permits GitHub to freely assign or delegate the Terms and privacy statement at any time without consent, while restricting users from assigning or delegating any rights or obligations without GitHub's prior written consent, voiding any unauthorized assignment.
AI-generated interpretation, not legal advice.
" Short version: We will not be liable for damages or losses arising from your use or inability to use the service or otherwise arising under this agreement. Please read this section carefully; it limits our obligations to you. "
Plain-language summary stating GitHub will not be liable for damages or losses arising from use of or inability to use the service, flagging the operative limitations that follow.
AI-generated interpretation, not legal advice.
"Except to the extent applicable law provides otherwise, this Agreement between you and GitHub and any access to or use of the Website or the Service are governed by the federal laws of the United States of America and the laws of the State of California, without regard to conflict of law provisions. You and GitHub agree to submit to the exclusive jurisdiction and venue of the courts located in the City and County of San Francisco, California. However, any claim for injunctive relief with respect to a violation of section D.9 may be brought in any jurisdiction."
Mandatory California/federal law and exclusive San Francisco venue provisions may disadvantage international users or those in other US states who would face significant cost and inconvenience to litigate disputes. The carve-out for injunctive relief in any jurisdiction benefits GitHub more than users.
AI-generated interpretation, not legal advice.
"We use cookies and similar technologies, such as web beacons, local storage, and mobile analytics, to operate and provide our Services. When visiting Enterprise Marketing Pages, like resources.github.com, these and additional cookies, like advertising IDs, may be used for sales and marketing purposes."
The use of advertising IDs for sales and marketing purposes on enterprise marketing pages goes beyond core service delivery and raises questions about data minimization obligations under GDPR and similar frameworks.
AI-generated interpretation, not legal advice.
"GitHub provides the Website and the Service “as is” and “as available,” without warranty of any kind. Without limiting this, we expressly disclaim all warranties, whether express, implied or statutory, regarding the Website and the Service including without limitation any warranty of merchantability, fitness for a particular purpose, title, security, accuracy and non-infringement."
A blanket disclaimer of all warranties, including implied warranties of merchantability, fitness, and non-infringement, is the broadest possible liability exclusion. This is especially significant for enterprise or commercial users who may have relied on platform stability or IP safety.
AI-generated interpretation, not legal advice.
"Unless you opt out, GitHub's Affiliates may use your Inputs and Outputs under this license in accordance with their applicable privacy and contractual obligations. This license does not, however, permit GitHub or its Affiliates to share your Inputs or Outputs with third-party AI model providers for their own independent model training purposes."
Default sharing of user inputs/outputs with GitHub affiliates (without user action) is a notable privacy risk. While third-party AI providers are excluded from independent training use, affiliate sharing is governed only by those affiliates' own 'applicable privacy and contractual obligations,' which are not defined in this document.
AI-generated interpretation, not legal advice.
" Our liability is limited whether or not we have been informed of the possibility of such damages, and even if a remedy set forth in this Agreement is found to have failed of its essential purpose. We will have no liability for any failure or delay due to matters beyond our reasonable control."
States that liability is capped regardless of notice of possible damages and even if a contractual remedy fails its essential purpose, and further excludes liability for failures or delays beyond GitHub's reasonable control.
AI-generated interpretation, not legal advice.
"Depending on your account settings, we may share Personal Data with other users of the Services and the public. You control what information is made public. To adjust your settings, visit User Settings in your profile. Please be aware that any information you share in a collaborative context may become publicly accessible."
GitHub reserves the right to share personal data with other users and the public depending on account settings, placing the burden on users to proactively restrict sharing.
AI-generated interpretation, not legal advice.
"Upon your instruction, we may share Personal Data with third-party applications available on our Marketplace. You are responsible for the data you instruct us to share with these applications."
GitHub shifts liability for data shared with Marketplace third parties entirely to the user. This limits GitHub's accountability and may expose users to unknown data practices by those apps.
AI-generated interpretation, not legal advice.
Common questions about GitHub Copilot's policies
- Does GitHub Copilot train its AI models on your data?
- Training possible — conditions or opt-outs apply — based on 7 verified findings from GitHub Copilot's published policy. Informational only, not legal advice.
- Who owns the content you create with GitHub Copilot?
- You own your outputs — based on 7 verified findings from GitHub Copilot's published policy. Informational only, not legal advice.
- Can you use GitHub Copilot's output commercially?
- Commercial use allowed — based on 10 verified findings from GitHub Copilot's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from GitHub Copilot's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
47 verified clausesClauses in GitHub Copilot's policies that work in your favour — commitments the platform made to you.
- Audit rights, DPA & residency
“GitHub also complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. GitHub has certified to the U.S. Depart…”
States GitHub's certification and adherence to the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF Principles with the U.S. Department of Commerce, constituting a formal legal commitment governing cross-border data transfe…
📍 Privacy Policy › “Data Privacy Framework (DPF)”Jump to exact text → - Subprocessors & data sharingsale/sharing of personal data
“Under California Civil Code section 1798.83, also known as the “Shine the Light” law, California residents who have provided personal information to a business with which the individual has established a business relationship for personal, family, or household…”
Restricts the platform from disclosing personal information to third parties for their direct marketing purposes under the California Shine the Light Act, and provides a disclosure that no such sharing occurs.
📍 Privacy Policy › “Shine the Light Act”Jump to exact text → - Privacy & data usechildren's data
“California residents under the age of 18 who are registered users of online sites, services, or applications have a right under California Business and Professions Code Section 22581 to remove, or request and obtain removal of, content or information they have…”
Grants California residents under 18 the right to remove or request removal of publicly posted content under California Business and Professions Code Section 22581, and establishes the procedure for submitting such remov…
- Designated security contact: privacy[at]github[dot]com
📍 Privacy Policy › “Removal of Content”Jump to exact text → - Audit rights, DPA & residency
“GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations. We transfer Personal Data from the European U…”
Discloses that GitHub stores and processes Personal Data across multiple jurisdictions including the US and other countries, and states the legal mechanism (EU Commission Standard Contractual Clauses under Decision 2021/…
📍 Privacy Policy › “International data transfers”Jump to exact text → - Moderation & enforcementterms can change anytime
“We reserve the right, at our sole discretion, to amend these Terms of Service at any time and will update these Terms of Service in the event of any such amendments. We will notify our Users of material changes to this Agreement, such as price increases, at le…”
Reserves GitHub's right to amend the Terms at its sole discretion, requires 30-day advance notice of material changes via website posting or email, and deems continued use after 30 days as acceptance of revisions.
- Terms changes: advance notice promised
📍 § R (Changes to These Terms)Jump to exact text → - Confidentiality
“Exceptions. Confidential Information will not include information that is: (a) or becomes publicly available without breach of this Agreement through no act or inaction on your part (such as when a private Beta Preview becomes a public Beta Preview); (b) known…”
This clause defines the exceptions to what qualifies as Confidential Information, carving out publicly available information, previously known information, independently developed information, and permissively disclosed…
📍 § 2 (Confidentiality)Jump to exact text →
+ 41 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
14 verified clausesWhat GitHub Copilot requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
- Commercial useconduct restrictions
“By using automated means to access, collect, or otherwise use (“Access”) any publicly accessible Content from the Service for the purpose of developing or training any commercially available artificial intelligence model, machine learning system, or similar te…”
Carves out exceptions to the access reciprocity waiver obligation for purely academic research purposes or for operators whose products have fewer than 700 million monthly active users, and provides an affiliate-inclusiv…
📍 § 9 (Access Reciprocity)Jump to exact text → - Prompt ownership
“GitHub and our licensors, vendors, agents, and/or our content providers retain ownership of all intellectual property rights of any kind related to the Website and Service. We reserve all rights that are not expressly granted to you under this Agreement or by…”
Affirms GitHub and licensors retain all IP rights in the Website and Service, reserves all rights not expressly granted, and restricts users from duplicating or reusing HTML/CSS, JavaScript, or visual design elements wit…
📍 § 1 (GitHub's Rights to Content)Jump to exact text → - Moderation & enforcement
“A machine account is an Account set up by an individual human who accepts the Terms on behalf of the Account, provides a valid email address, and is responsible for its actions. A machine account is used exclusively for performing automated tasks. Multiple use…”
Restricts each person or legal entity to no more than one free Account, with a limited exception for machine accounts used solely for automated tasks, creating a quantitative account-tier limitation.
📍 § 3 (Account Requirements)Jump to exact text → - Commercial useconduct restrictions
“This Section D.9 does not apply to Access solely for the purpose of academic research or if, on the date you Access the Content, the number of monthly active users of the products or services made available by you is less than 700 million in the preceding cale…”
Section header introducing the private repositories section, followed by a short-version summary establishing the confidentiality treatment of private repository content and enumerating the limited circumstances under wh…
📍 § 9 (Access Reciprocity)Jump to exact text → - Moderation & enforcement
“You are responsible for keeping your Account secure while you use our Service. We offer tools such as two-factor authentication to help you maintain your Account's security, but the content of your Account and its security are up to you.”
Assigns responsibility to the user for maintaining Account and password security and expressly disclaims GitHub's liability for any loss or damage resulting from the user's failure to comply with that security obligation…
📍 § 4 (Account Security)Jump to exact text →
+ 9 more verified clauses of this kind on this platform, cited in full in the report.
What the policies actually cover
18 topics- Product telemetry & usage tracking1 protective18 clauses
- Advertising & tracking3 protective22 clauses
- Sale or sharing of personal data6 protective6 clauses
- Sensitive data (biometric, location, health)1 clause
- Children's data2 protective5 clauses
- Government & law-enforcement disclosure5 clauses
- Data shared with other AI providers1 clause
- Does not train on your content1 clause
- Trains by default, opt-out available2 clauses
- Arbitration & class-action waiver1 protective1 clause
- Damages & liability cap10 clauses
- Indemnity direction3 clauses
- Terms can change at any time3 protective7 clauses
- Deletion rights & post-termination survival2 protective4 clauses
- License survival after account deletion1 clause
- Auto-renewal & cancel window4 clauses
- Human review of your content1 clause
- Conduct restrictions4 obligations4 clauses
321 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the Privacy Policy, Privacy Policy › “Security and Retention” addresses how long content is retained, and the Terms of Service, § 3 (Access) addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
The Terms of Service, § 6 (Contributions Under Repository License) describes rights the platform takes in user content, and the Privacy Policy, Privacy Policy › “[Sharing of Personal Data](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement\#sharing-of-personal-data)” describes disclosure of data to third parties or subprocessors. Both clauses are in force at the same time — read them together.
The Terms of Service, § 3 (Access) describes a way to decline model training, and the Terms of Service, § 2 (Upgrades, Downgrades, and Changes) states that terms differ by plan or tier. Whether the opt-out applies on every tier is determined by those clauses together — read both before relying on the opt-out.
Verified retention clauses point in different directions: the Privacy Policy, Privacy Policy › “Security and Retention” describes broad or open-ended retention, while the Privacy Policy, Privacy Policy › “[Cookies and tracking technologies](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement\#cookies-and-tracking-technologies)” describes deletion or erasure. Which clause controls in a given situation is not resolved by the documents' text alone — this is surfaced as an ambiguity, treated as Caution.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause provides a deletion or time-bounded retention path.
“We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups). This information cannot be recovered once your Account is canceled.”Open source citation
The clause provides a deletion or time-bounded retention path.
“We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups). This information cannot be recovered once your Account is canceled.”Open source citation
The clause provides a deletion or time-bounded retention path.
“We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups). This information cannot be recovered once your Account is canceled.”Open source citation
The clause provides a deletion or time-bounded retention path.
“We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups). This information cannot be recovered once your Account is canceled.”Open source citation
The clause provides a deletion or time-bounded retention path.
“We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups). This information cannot be recovered once your Account is canceled.”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | commercial use | conditional | MEDIUM | 1 |
| All applicable tiers | data retention | improves | LOW | 9 |
| All applicable tiers | governing law disputes | conditional | MEDIUM | 6 |
| All applicable tiers | indemnity liability | worsens | HIGH | 1 |
| All applicable tiers | moderation enforcement | improves | LOW | 1 |
| All applicable tiers | output ownership | conditional | MEDIUM | 11 |
| All applicable tiers | prompt ownership | worsens | HIGH | 3 |
| All applicable tiers | training use | improves | LOW | 2 |
| Free | commercial use | worsens | HIGH | 4 |
| Free | output ownership | worsens | HIGH | 2 |
| Free | prompt ownership | worsens | HIGH | 6 |
| Government | governing law disputes | conditional | MEDIUM | 4 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
content license improved from high/sublicensable or transferable to medium/broad license.
“We’re always trying to improve our products and services, and your feedback as a Beta Preview user will help us do that. If you choose to give us any ideas, know-how, algorithms, code contributions, suggestions, enhancement requests, recommendations or any other feedback for our products or services (collectively, “Feedback”), you acknowledge and agree that GitHub will have a royalty-free, fully paid-up, worldwide, transferable, sub-licensable, irrevocable and perpetual license to implement, use, modify, commercially exploit and/or incorporate the Feedback into our products, services, and documentation.”Before citation
“By making a repository public, you grant other Users a nonexclusive, worldwide license to use, display, perform and reproduce (by forking) Your Content through the Service as permitted by GitHub's functionality. You may grant additional rights by adopting a license . If you post Content you did not create or own, you are responsible for ensuring it is licensed under terms that permit these uses.”After citation
content ownership worsened from low/user retains rights to high/platform claims or reserves rights.
“Users. Subject to these Terms, you retain ultimate administrative control over your Personal Account and the Content within it.”Before citation
“GitHub and our licensors, vendors, agents, and/or our content providers retain ownership of all intellectual property rights of any kind related to the Website and Service. We reserve all rights that are not expressly granted to you under this Agreement or by law. The look and feel of the Website and Service is copyright © GitHub, Inc. All rights reserved. You may not duplicate, copy, or reuse any portion of the HTML/CSS, JavaScript, or visual design elements or concepts without express written permission from GitHub.”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“You may use the Global Privacy Control (GPC) to communicate your privacy preferences. If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data). To learn more, visit Global Privacy Control — Take Control Of Your Privacy”Before citation
“Vendors, Partners, and Affiliates: We may receive information about you from third parties, like vendors, resellers, partners, or affiliates for the purposes outlined in this statement.”After citation
data sharing worsened from medium/third party or vendor sharing to high/sale or sell.
“Exceptions. Confidential Information will not include information that is: (a) or becomes publicly available without breach of this Agreement through no act or inaction on your part (such as when a private Beta Preview becomes a public Beta Preview); (b) known to you before we disclose it to you; (c) independently developed by you without breach of any confidentiality obligation to us or any third party; or (d) disclosed with permission from GitHub. You will not violate the terms of this Agreement if you are required to disclose Confidential Information pursuant to operation of law, provided GitHub has been given reasonable advance written notice to object, unless prohibited by law.”Before citation
“You may use the Global Privacy Control (GPC) to communicate your privacy preferences. If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data). To learn more, visit Global Privacy Control — Take Control Of Your Privacy”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“We do not sell your covered information, as defined under Chapter 603A of the Nevada Revised Statutes. If you still have questions about your covered information or anything else in our Privacy Statement, please send an email to privacy[at]github[dot]com.”Before citation
“Exceptions. Confidential Information will not include information that is: (a) or becomes publicly available without breach of this Agreement through no act or inaction on your part (such as when a private Beta Preview becomes a public Beta Preview); (b) known to you before we disclose it to you; (c) independently developed by you without breach of any confidentiality obligation to us or any third party; or (d) disclosed with permission from GitHub. You will not violate the terms of this Agreement if you are required to disclose Confidential Information pursuant to operation of law, provided GitHub has been given reasonable advance written notice to object, unless prohibited by law.”After citation
content ownership improved from high/platform claims or reserves rights to low/user retains rights.
“GitHub and our licensors, vendors, agents, and/or our content providers retain ownership of all intellectual property rights of any kind related to the Website and Service. We reserve all rights that are not expressly granted to you under this Agreement or by law. The look and feel of the Website and Service is copyright © GitHub, Inc. All rights reserved. You may not duplicate, copy, or reuse any portion of the HTML/CSS, JavaScript, or visual design elements or concepts without express written permission from GitHub.”Before citation
“You own Your Content. If you post Content you did not create, you are responsible for ensuring you have the right to post it and for complying with any applicable licenses.”After citation
Latest stance: sale or sell on privacy data use
“- We do not “sell” or “share” the personal information of known minors under 16 years of age.”Open timeline citation
Latest stance: training permitted on training use
“- Product Development and Improvement: We use Personal Data to develop and improve our products, services, and technologies, including artificial intelligence and machine learning technologies. This includes improving features, developing new offerings, enhancing safety and security capabilities, and training models. We apply appropriate technical safeguards, including aggregation and de-identification techniques where feasible, to protect your privacy while enabling these improvements.”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“We and/or our partners also share the information we collect or infer with third parties for these purposes.”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“Under California Civil Code section 1798.83, also known as the “Shine the Light” law, California residents who have provided personal information to a business with which the individual has established a business relationship for personal, family, or household purposes (“California Customers”) may request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marketing purposes. Please be aware that we do not disclose personal information to any third parties for their direct marketing purposes as defined by this law. California Customers may request further information about our compliance with this law by emailing (privacy\[at\]github\[dot\]com). Please note that businesses are required to respond to one request per California Customer each year and may not be required to respond to requests made by means other than through the designated email address.”Open timeline citation
Capture recency
- Terms of Service:Last captured 2026-07-20· verified 2026-07-20
- Privacy Policy:Last captured 2026-08-14· verified 2026-08-14
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↓ 78 fewer findings this quarter vs last (461 vs 539). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of GitHub Copilot's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from GitHub Copilot's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.