Developer / Coding · github.comGPT Pilot
Graded against 811 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“If you provide your private repository content as Input to AI Features, we may use that Input to provide, develop, train, and improve the Service, including AI Features. Your ability to opt out under Section J.3 applies to this use of private repository content. We will not otherwise use your private repository contents to develop or improve the Service.”
Watch: governing law disputes
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
Permits GitHub to freely assign or delegate the Agreement and associated license grants without user consent, while prohibiting user assignment or delegation without prior written consent and voiding any unauthorized transfers.
Excludes liability for damages arising from a user's use of or inability to use the Service, a core component of the limitation of liability provision.
Excludes liability for damages from unauthorized access to or alteration of user transmissions or data, limiting GitHub's responsibility for third-party data breaches affecting user data.
How to read this page: Overall risk rates what GPT Pilot's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredBased on 295 verified, verbatim-cited findings below — read the citations.
Based on 309 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Terms of ServiceVerified - read in full - 169 citationsstaticLast captured 2026-09-21
- Privacy PolicyVerified - read in full - 138 citationsstaticLast captured 2026-07-20
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
Permits GitHub to offer subscription-based API access tiers for high-throughput users or those who would resell the Service, establishing a commercial differentiation right.
" GitHub may offer subscription-based access to our API for those Users who require high-throughput access or access that would result in resale of GitHub's Service."
Permits GitHub to use cookies and similar technologies (web beacons, local storage, mobile analytics, advertising IDs) to operate services and for sales and marketing purposes on Enterprise Marketing Pages, establishing the scope of tracking-based data use.
" We use cookies and similar technologies, such as web beacons, local storage, and mobile analytics, to operate and provide our Services. When visiting Enterprise Marketing Pages, like resources.github.com, these and additional cookies, like..."
This segment grants GitHub permission to use personal data for business operations including billing, accounting, compensation, and internal statistical/financial reporting, establishing lawful processing grounds for these activities.
" Business Operations: We use Personal Data for activities like billing, accounting, and compensation. This includes creating aggregated statistical data for internal reporting, financial reporting, revenue planning, capacity planning, and f..."
Incorporates by reference the business and commercial purposes for collecting personal information as described in the Privacy Statement's Processing Purposes section, cross-referencing the operative disclosure obligations.
" The business or commercial purposes of collecting personal information are as summarized above and in our Privacy Statement under Processing Purposes."
Grants California residents under 18 the right under California Business and Professions Code Section 22581 to remove or request removal of publicly posted content or information, and establishes the procedure for submitting such a removal request.
" California residents under the age of 18 who are registered users of online sites, services, or applications have a right under California Business and Professions Code Section 22581 to remove, or request and obtain removal of, content or ..."
Establishes the procedural framework for exercising data rights requests, specifying a limit of two free requests per 12-month period, a 45-day response commitment, and a permissible 45-day extension for complex cases.
" Right to a Timely Response: You are allowed to make two free requests in any 12-month period. We commit to responding to your request within 45 days. In complex cases, we may extend our response time by an additional 45 days."
Specifies the business and commercial purposes for which personal information is collected, including service delivery, security, billing, research, and communications, creating a disclosed basis for processing that carries legal obligations under applicable privacy law.
" We collect this information for various purposes. This includes identifying accessibility gaps and offering targeted support, fostering diversity and representation, providing services, troubleshooting, conducting business operations such ..."
This segment defines 'Profile Information' as a category of Personal Data collected to create user profiles, enumerating data elements such as photos, email addresses, job title, and biography.
" Payment Information: For paid subscriptions, we collect details like name, billing address, and payment specifics."
Clause A explicitly allows for one free machine account in addition to a free personal account, while Clause B states a user may not have more than one free account in total.
" A machine account is an Account set up by an individual human who accepts the Terms on behalf of the Account, provides a valid email address, and is responsible for its actions. A machine account is used exclusively for performing automated tasks. Multiple users may direct the actions of a machine account, but the owner of the Account is ultimately responsible for the machine's actions. You may maintain no more than one free machine account in addition to your free Personal Account."
" Short version: Personal Accounts and Organizations have different administrative controls; a human must create your Account; you must be 13 or over; you must provide a valid email address; and you may not have more than one free Account. You alone are responsible for your Account and anything that happens while you are signed in to or using your Account. You are responsible for keeping your Account secure. "
Within one document
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
" A machine account is an Account set up by an individual human who accepts the Terms on behalf of the Account, provides a valid email address, and is responsible for its actions. A machine account is used exclusively for performing automated tasks. Multiple users may direct the actions of a machine account, but the owner of the Account is ultimately responsible for the machine's actions. You may maintain no more than one free machine account in addition to your free Personal Account."
Restricts each person or legal entity to no more than one free Account, with the machine account exception limited to running automated tasks only.
AI-generated interpretation, not legal advice.
" any modification, price change, suspension or discontinuance of the Service;"
Excludes liability for damages caused by modification, price change, suspension, or discontinuance of the Service, protecting GitHub from claims related to service changes.
AI-generated interpretation, not legal advice.
" Payment Based on Plan For monthly or yearly payment plans, the Service is billed in advance on a monthly or yearly basis respectively and is non-refundable. There will be no refunds or credits for partial months of service, downgrade refunds, or refunds for months unused with an open Account; however, the service will remain active for the length of the paid billing period. In order to treat everyone equally, no exceptions will be made."
Establishes that subscription payments are non-refundable and billed in advance, prohibits partial-month refunds, downgrade refunds, and credits for unused months, and explicitly bars any exceptions, restricting users' ability to obtain refunds.
AI-generated interpretation, not legal advice.
" your use or inability to use the Service;"
Excludes liability for damages arising from a user's use of or inability to use the Service, a core component of the limitation of liability provision.
AI-generated interpretation, not legal advice.
" unauthorized access to or alterations of your transmissions or data;"
Excludes liability for damages from unauthorized access to or alteration of user transmissions or data, limiting GitHub's responsibility for third-party data breaches affecting user data.
AI-generated interpretation, not legal advice.
" You understand and agree that we will not be liable to you or any third party for any loss of profits, use, goodwill, or data, or for any incidental, indirect, special, consequential or exemplary damages, however arising, that result from"
Core limitation of liability clause excluding GitHub's responsibility for loss of profits, use, goodwill, data, and various indirect or exemplary damages of any kind arising from enumerated causes.
AI-generated interpretation, not legal advice.
" Our liability is limited whether or not we have been informed of the possibility of such damages, and even if a remedy set forth in this Agreement is found to have failed of its essential purpose. We will have no liability for any failure or delay due to matters beyond our reasonable control."
Affirms that liability is limited regardless of prior notice of possible damages and even if a remedy fails its essential purpose; also excludes liability for failures beyond GitHub's reasonable control.
AI-generated interpretation, not legal advice.
" Unless you opt out, GitHub's Affiliates may use your Inputs and Outputs under this license in accordance with their applicable privacy and contractual obligations. This license does not, however, permit GitHub or its Affiliates to share your Inputs or Outputs with third-party AI model providers for their own independent model training purposes."
Permits GitHub Affiliates to use Inputs and Outputs under the granted license subject to their privacy and contractual obligations, but expressly restricts GitHub and Affiliates from sharing Inputs or Outputs with third-party AI model providers for independent model training.
AI-generated interpretation, not legal advice.
" GitHub may assign or delegate these Terms of Service and/or the GitHub Privacy Statement , in whole or in part, to any person or entity at any time with or without your consent, including the license grant in Section D.4. You may not assign or delegate any rights or obligations under the Terms of Service or Privacy Statement without our prior written consent, and any unauthorized assignment and delegation by you is void."
Permits GitHub to freely assign or delegate the Agreement and associated license grants without user consent, while prohibiting user assignment or delegation without prior written consent and voiding any unauthorized transfers.
AI-generated interpretation, not legal advice.
" This section applies to all AI Features unless a specific feature has additional terms that expressly modify them. The training and data-use provisions in Section J.3 apply only to individual licenses. If your use of the Service is governed by a GitHub Customer Agreement or volume licensing agreement, those agreements govern the use of your data in connection with AI Features and Section J.3 does not apply to you."
Defines the scope of application of Section J, specifying that training and data-use provisions apply only to individual licenses and are superseded by GitHub Customer Agreements or volume licensing agreements, carving out enterprise users from Section J.3.
AI-generated interpretation, not legal advice.
" GitHub may offer subscription-based access to our API for those Users who require high-throughput access or access that would result in resale of GitHub's Service."
Permits GitHub to offer subscription-based API access for users requiring high-throughput access or access that would result in resale of the Service, distinguishing a higher-tier access model from standard use.
AI-generated interpretation, not legal advice.
" We will immediately bill you when you upgrade from the free plan to any paying plan."
Obligates GitHub to bill the user for a full year at the next monthly billing date when the user switches from a monthly to a yearly billing plan, defining the billing consequence of that plan-change action.
AI-generated interpretation, not legal advice.
" Payment Based on Plan For monthly or yearly payment plans, the Service is billed in advance on a monthly or yearly basis respectively and is non-refundable. There will be no refunds or credits for partial months of service, downgrade refunds, or refunds for months unused with an open Account; however, the service will remain active for the length of the paid billing period. In order to treat everyone equally, no exceptions will be made."
Establishes that certain features are billed based on actual usage in the preceding month, that a limited quantity may be included in the plan, and that charges for usage beyond the included quantity are billed periodically in arrears, incorporating additional product terms by reference.
AI-generated interpretation, not legal advice.
" Payment Based on Usage Some Service features are billed based on your usage. A limited quantity of these Service features may be included in your plan for a limited term without additional charge. If you choose to use paid Service features beyond the quantity included in your plan, you pay for those Service features based on your actual usage in the preceding month. Monthly payment for these purchases will be charged on a periodic basis in arrears. See GitHub Additional Product Terms for Details ."
Obligates invoiced users to pay fees in full, upfront, in U.S. Dollars within thirty days of invoice, without deduction or setoff; affirms non-refundability; grants GitHub the right to charge interest on overdue amounts at 1.0% per month or the maximum lawful rate, whichever is less, and to recover collection expenses, establishing detailed payment and late-payment obligations.
AI-generated interpretation, not legal advice.
" You may enable various GitHub services or features that require additional rights to Your Content in private repositories. These rights may vary depending on the service or feature, but GitHub will continue to treat your private repository Content as confidential. If those services or features require rights in addition to those we need to provide the GitHub Service, we will provide an explanation of those rights."
This segment grants GitHub permission to use private repository content provided as input to AI Features to provide, develop, train, and improve the Service including AI Features, while referencing the user's opt-out right under Section J.3 and restricting other uses of private repository content for service improvement.
AI-generated interpretation, not legal advice.
" Your Content that you post publicly, including issues, comments, and contributions to other Users' repositories, may be viewed by others. By setting your repositories to be viewed publicly, you agree to allow others to view and "fork" your repositories (this means that others may make their own copies within the Service in repositories they control)."
This segment establishes that publicly posted content may be viewed and forked by other users, granting permission for others to view and copy content in public repositories.
AI-generated interpretation, not legal advice.
" Whenever you add Content to a repository containing notice of a license, you license that Content under the same terms, and you agree that you have the right to license that Content under those terms. If you have a separate agreement to license that Content under different terms, such as a contributor license agreement, that agreement will supersede."
This segment establishes that users who add content to a repository with a license notice automatically license that content under the same terms, creates an obligation to confirm they have the right to do so, and specifies that a separate contributor license agreement will supersede these terms.
AI-generated interpretation, not legal advice.
" You retain all moral rights to Your Content that you upload, publish, or submit to any part of the Service, including the rights of integrity and attribution. However, you waive these rights and agree not to assert them against us or our Affiliates, to enable GitHub and our Affiliates to reasonably exercise the rights granted in Section D.4, but not otherwise."
This segment grants GitHub the right to use content without attribution and to make reasonable adaptations where the waiver of moral rights is not enforceable by applicable law, serving as a fallback permission.
AI-generated interpretation, not legal advice.
Common questions about GPT Pilot's policies
- Does GPT Pilot train its AI models on your data?
- Training possible — conditions or opt-outs apply — based on 8 verified findings from GPT Pilot's published policy. Informational only, not legal advice.
- Who owns the content you create with GPT Pilot?
- You own outputs — with license carve-outs — based on 11 verified findings from GPT Pilot's published policy. Informational only, not legal advice.
- Can you use GPT Pilot's output commercially?
- Commercial use allowed — with conditions — based on 2 verified findings from GPT Pilot's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from GPT Pilot's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
49 verified clausesClauses in GPT Pilot's policies that work in your favour — commitments the platform made to you.
- Audit rights, DPA & residency
“GitHub also complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. GitHub has certified to the U.S. Depart…”
Describes GitHub's certification and compliance obligation under the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF, establishing its adherence to DPF Principles for personal data transferred from the EU, UK, and Switzerl…
📍 Privacy Policy › “Data Privacy Framework (DPF)”Jump to exact text → - Subprocessors & data sharingsale/sharing of personal data
“Under California Civil Code section 1798.83, also known as the “Shine the Light” law, California residents who have provided personal information to a business with which the individual has established a business relationship for personal, family, or household…”
Discloses compliance with the California Shine the Light Act and affirmatively states that the company does not disclose personal information to third parties for their direct marketing purposes, disclaiming any such pra…
📍 Privacy Policy › “Shine the Light Act”Jump to exact text → - Privacy & data usechildren's data
“California residents under the age of 18 who are registered users of online sites, services, or applications have a right under California Business and Professions Code Section 22581 to remove, or request and obtain removal of, content or information they have…”
Grants California residents under 18 the right under California Business and Professions Code Section 22581 to remove or request removal of publicly posted content or information, and establishes the procedure for submit…
📍 Privacy Policy › “Removal of Content”Jump to exact text → - Audit rights, DPA & residency
“GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations. We transfer Personal Data from the European U…”
Discloses that GitHub stores and processes Personal Data in multiple jurisdictions including the US and countries without EU-recognized adequacy decisions, and describes reliance on EU Standard Contractual Clauses (Commi…
📍 Privacy Policy › “International data transfers”Jump to exact text → - Moderation & enforcementterms can change anytime
“We reserve the right, at our sole discretion, to amend these Terms of Service at any time and will update these Terms of Service in the event of any such amendments. We will notify our Users of material changes to this Agreement, such as price increases, at le…”
Establishes GitHub's right to amend the Terms at its sole discretion, requires 30-day advance notice of material changes via website or email, and deems continued use after 30 days as acceptance of revisions.
- Terms changes: advance notice promised
📍 § R (Changes to These Terms)Jump to exact text → - Audit rights, DPA & residency
“Should you access a GitHub Service through an account provided by an organization, such as your employer or school, the organization becomes the Data Controller, and this Privacy Statement's direct applicability to you changes. Even so, GitHub remains dedicate…”
This segment defines GitHub's role as Data Processor when a user accesses services through an organization-provided account, establishes that the organization becomes Data Controller in such cases, notes that GitHub adhe…
📍 Privacy Policy › “End User Notice: Organization-Provided GitHub Accounts”Jump to exact text →
+ 43 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
10 verified clausesWhat GPT Pilot requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
- Prompt ownership
“GitHub and our licensors, vendors, agents, and/or our content providers retain ownership of all intellectual property rights of any kind related to the Website and Service. We reserve all rights that are not expressly granted to you under this Agreement or by…”
Affirms GitHub and its licensors retain ownership of all IP in the Website and Service, reserves all non-expressly-granted rights, and restricts users from duplicating or reusing HTML/CSS, JavaScript, or visual design el…
📍 § 1 (GitHub's Rights to Content)Jump to exact text → - Moderation & enforcement
“A machine account is an Account set up by an individual human who accepts the Terms on behalf of the Account, provides a valid email address, and is responsible for its actions. A machine account is used exclusively for performing automated tasks. Multiple use…”
Restricts individuals and legal entities to no more than one free Account (with a limited exception for machine accounts used exclusively for running machines), creating account-number limits tied to tier.
📍 § 3 (Account Requirements)Jump to exact text → - Moderation & enforcement
“You are responsible for all fees, including taxes, associated with your use of the Service. By using the Service, you agree to pay GitHub any charge incurred in connection with your use of the Service. If you dispute the matter, contact us through the GitHub S…”
Establishes the user's obligation to pay all fees and taxes associated with service use, to provide a valid payment method for paid accounts, and to direct billing disputes through GitHub Support, while exempting free ac…
📍 § 5 (Responsibility for Payment)Jump to exact text → - Moderation & enforcement
“Your use of the Website and Service must not violate any applicable laws, including copyright or trademark laws, export control or sanctions laws, or other laws in your jurisdiction. You are responsible for making sure that your use of the Service is in compli…”
Requires users to agree not to violate GitHub's Acceptable Use Policies or Community Guidelines under any circumstances, incorporating those policies as binding contractual obligations by reference.
📍 Article C (Acceptable Use)Jump to exact text → - Moderation & enforcementconduct restrictions
“You may not use the API to download data or Content from GitHub for spamming purposes, including for the purposes of selling GitHub users' personal information, such as to recruiters, headhunters, and job boards.”
Restricts use of the API to download GitHub data or Content for spamming purposes or for selling users' personal information to third parties such as recruiters or job boards.
📍 § H (API Terms)Jump to exact text →
+ 5 more verified clauses of this kind on this platform, cited in full in the report.
What the policies actually cover
17 topics- Product telemetry & usage tracking1 protective16 clauses
- Advertising & tracking4 protective24 clauses
- Sale or sharing of personal data5 protective6 clauses
- Sensitive data (biometric, location, health)1 clause
- Children's data3 protective4 clauses
- Government & law-enforcement disclosure1 protective7 clauses
- Data shared with other AI providers1 protective2 clauses
- Trains by default, opt-out available2 clauses
- Arbitration & class-action waiver1 clause
- Damages & liability cap5 clauses
- Indemnity direction2 clauses
- Terms can change at any time2 protective4 clauses
- Deletion rights & post-termination survival2 protective4 clauses
- License survival after account deletion2 clauses
- Auto-renewal & cancel window4 clauses
- Breach-notification promises1 protective1 clause
- Conduct restrictions2 obligations2 clauses
220 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the Privacy Policy, Privacy Policy › “Security and Retention” addresses how long content is retained, and the Terms of Service, § 3 (Access) addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
The Terms of Service, § 5 (License Grant to Other Users) describes rights the platform takes in user content, and the Privacy Policy, Privacy Policy › “Sharing of Personal Data” describes disclosure of data to third parties or subprocessors. Both clauses are in force at the same time — read them together.
The Terms of Service, § 3 (Access) describes a way to decline model training, and the Terms of Service, § 2 (Upgrades, Downgrades, and Changes) states that terms differ by plan or tier. Whether the opt-out applies on every tier is determined by those clauses together — read both before relying on the opt-out.
Verified retention clauses point in different directions: the Privacy Policy, Privacy Policy › “Security and Retention” describes broad or open-ended retention, while the Terms of Service, § 2 (Upon Cancellation) describes deletion or erasure. Which clause controls in a given situation is not resolved by the documents' text alone — this is surfaced as an ambiguity, treated as Caution.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause provides a deletion or time-bounded retention path.
“We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups). This information cannot be recovered once your Account is canceled.”Open source citation
The clause provides a deletion or time-bounded retention path.
“We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups). This information cannot be recovered once your Account is canceled.”Open source citation
The clause provides a deletion or time-bounded retention path.
“We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups). This information cannot be recovered once your Account is canceled.”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. For additional information visit https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction .”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. For additional information visit https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction .”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | data retention | improves | LOW | 9 |
| All applicable tiers | governing law disputes | worsens | HIGH | 2 |
| All applicable tiers | indemnity liability | conditional | MEDIUM | 11 |
| All applicable tiers | output ownership | conditional | MEDIUM | 9 |
| All applicable tiers | privacy data use | worsens | HIGH | 2 |
| All applicable tiers | prompt ownership | improves | LOW | 2 |
| All applicable tiers | subprocessors data sharing | worsens | HIGH | 3 |
| All applicable tiers | training use | improves | LOW | 3 |
| Free | commercial use | worsens | HIGH | 4 |
| Free | prompt ownership | worsens | HIGH | 2 |
| Government | governing law disputes | conditional | MEDIUM | 3 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
legal burden changed from medium/liability limited to medium/indemnity.
“GitHub provides the Website and the Service “as is” and “as available,” without warranty of any kind. Without limiting this, we expressly disclaim all warranties, whether express, implied or statutory, regarding the Website and the Service including without limitation any warranty of merchantability, fitness for a particular purpose, title, security, accuracy and non-infringement.”Before citation
“You agree to indemnify us, defend us, and hold us harmless from and against any and all claims, liabilities, and expenses, including attorneys’ fees, arising out of your use of the Website and the Service, including but not limited to your violation of this Agreement, provided that GitHub (1) promptly gives you written notice of the claim, demand, suit or proceeding; (2) gives you sole control of the defense and settlement of the claim, demand, suit or proceeding (provided that you may not settle any claim, demand, suit or proceeding unless the settlement unconditionally releases GitHub of all liability); and (3) provides to you all reasonable assistance, at your expense.”After citation
content ownership improved from high/platform claims or reserves rights to low/user retains rights.
“GitHub and our licensors, vendors, agents, and/or our content providers retain ownership of all intellectual property rights of any kind related to the Website and Service. We reserve all rights that are not expressly granted to you under this Agreement or by law. The look and feel of the Website and Service is copyright © GitHub, Inc. All rights reserved. You may not duplicate, copy, or reuse any portion of the HTML/CSS, JavaScript, or visual design elements or concepts without express written permission from GitHub.”Before citation
“You own Your Content. If you post Content you did not create, you are responsible for ensuring you have the right to post it and for complying with any applicable licenses.”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“You may use the Global Privacy Control (GPC) to communicate your privacy preferences. If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data). To learn more, visit Global Privacy Control — Take Control Of Your Privacy”Before citation
“Vendors, Partners, and Affiliates: We may receive information about you from third parties, like vendors, resellers, partners, or affiliates for the purposes outlined in this statement.”After citation
content ownership worsened from low/user retains rights to high/platform claims or reserves rights.
“You own Your Content. If you post Content you did not create, you are responsible for ensuring you have the right to post it and for complying with any applicable licenses.”Before citation
“GitHub and our licensors, vendors, agents, and/or our content providers retain ownership of all intellectual property rights of any kind related to the Website and Service. We reserve all rights that are not expressly granted to you under this Agreement or by law. The look and feel of the Website and Service is copyright © GitHub, Inc. All rights reserved. You may not duplicate, copy, or reuse any portion of the HTML/CSS, JavaScript, or visual design elements or concepts without express written permission from GitHub.”After citation
data sharing worsened from medium/third party or vendor sharing to high/sale or sell.
“Exceptions. Confidential Information will not include information that is: (a) or becomes publicly available without breach of this Agreement through no act or inaction on your part (such as when a private Beta Preview becomes a public Beta Preview); (b) known to you before we disclose it to you; (c) independently developed by you without breach of any confidentiality obligation to us or any third party; or (d) disclosed with permission from GitHub. You will not violate the terms of this Agreement if you are required to disclose Confidential Information pursuant to operation of law, provided GitHub has been given reasonable advance written notice to object, unless prohibited by law.”Before citation
“You may use the Global Privacy Control (GPC) to communicate your privacy preferences. If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data). To learn more, visit Global Privacy Control — Take Control Of Your Privacy”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“You may use the Global Privacy Control (GPC) to communicate your privacy preferences. If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data). To learn more, visit Global Privacy Control — Take Control Of Your Privacy”Before citation
“Exceptions. Confidential Information will not include information that is: (a) or becomes publicly available without breach of this Agreement through no act or inaction on your part (such as when a private Beta Preview becomes a public Beta Preview); (b) known to you before we disclose it to you; (c) independently developed by you without breach of any confidentiality obligation to us or any third party; or (d) disclosed with permission from GitHub. You will not violate the terms of this Agreement if you are required to disclose Confidential Information pursuant to operation of law, provided GitHub has been given reasonable advance written notice to object, unless prohibited by law.”After citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“Confidentiality Obligations. You agree that any non-public Beta Preview information we give you, such as information about a private Beta Preview, will be considered GitHub’s confidential information (collectively, “Confidential Information”), regardless of whether it is marked or identified as such. You agree to only use such Confidential Information for the express purpose of testing and evaluating the Beta Preview (the “Purpose”), and not for any other purpose. You should use the same degree of care as you would with your own confidential information, but no less than reasonable precautions to prevent any unauthorized use, disclosure, publication, or dissemination of our Confidential Information. You promise not to disclose, publish, or disseminate any Confidential Information to any third party, unless we don’t otherwise prohibit or restrict such disclosure (for example, you might be part of a GitHub-organized group discussion about a private Beta Preview feature).”Open timeline citation
Latest stance: user retains rights on data retention
“You retain all moral rights to Your Content that you upload, publish, or submit to any part of the Service, including the rights of integrity and attribution. However, you waive these rights and agree not to assert them against us or our Affiliates, to enable GitHub and our Affiliates to reasonably exercise the rights granted in Section D.4, but not otherwise.”Open timeline citation
Latest stance: deletion or time bound on data retention
“We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups). This information cannot be recovered once your Account is canceled.”Open timeline citation
Latest stance: rights or controls vary by tier on tier differences
“We will immediately bill you when you upgrade from the free plan to any paying plan.”Open timeline citation
Capture recency
- Terms of Service:Last captured 2026-09-21· verified 2026-09-21
- Privacy Policy:Last captured 2026-07-20· verified 2026-07-20
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↑ 225 more findings this quarter vs last (570 vs 345). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of GPT Pilot's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from GPT Pilot's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.