GitHub Copilot Privacy Policy Review 2026 | Privacy Score 45/100 (Grade C-)

✅ What Should I Do? Action Plan

The exposure depends on whose code and whose data sit in your editor. Pick the column that matches you. Settings paths reflect the github.com Copilot settings as of July 8, 2026; GitHub relabels these screens periodically, so confirm the exact wording in your own account.

👤 Individual developer

Copilot Free, Pro, Pro+, or Max on a personal account

Review the training toggle first: Profile picture Copilot settings, then the Allow GitHub to use my data for AI model training control. GitHub's docs state that from April 24, 2026 interactions on the individual plans, including inputs, outputs, and code snippets, may be used to train and improve AI models unless you opt out.
Set Suggestions matching public code to Block; per the docs it checks suggestions of about 150 characters, with surrounding code, against public code on GitHub.
Keep secrets and personal data out of the editor context: keys, tokens, .env files, and customer records in fixtures can all travel inside a prompt.
Remember the account behind Copilot: the Privacy Statement's collection list covers the whole GitHub account (code, inputs, AI outputs, usage data), not just the assistant.
To exercise access, correction, deletion, or portability rights, use GitHub's privacy contact (the statement directs requests to its privacy email) and keep the confirmation.

💼 Business / professional user

Client code, employer code, regulated data

Do not run client or employer code through a personal Copilot plan. The individual tiers carry the April 24, 2026 training default; the docs indicate Business and Enterprise sit outside that policy.
Get the data terms in writing: GitHub publishes a data protection agreement for organization customers; confirm what applies to your plan before sensitive code flows.
Map the affiliate chain: the Privacy Statement says personal data may be shared with GitHub affiliates, including Microsoft, for purposes that include AI training and improvement. If that matters to your compliance posture, address it contractually.
Enforce the public-code filter and secret scanning org-wide, and write down which repositories may use AI assistance at all.
If you carry GDPR or CCPA duties, note GitHub's stated transfer mechanisms (EU standard contractual clauses, Data Privacy Framework) and its 90-day post-termination deletion window when you build your records of processing.

⚠ Already affected

Data exposed, account terminated, or rights request ignored

Document everything now: what data, which repositories, which dates, and every GitHub email or support thread. You cannot demand what you cannot describe.
Send a written access or deletion request to GitHub's privacy contact and keep the confirmation; that starts the statutory clock under many privacy laws.
Know the retention baseline: profile and repository content are described as deleted within 90 days of termination, barring legal requirements, with some data persisting in encrypted backups.
If your training-eligible interactions concern you, opt out now; the documents describe the opt-out as prospective, not as recalling data already used.
If a rights request is ignored or data was exposed, a written demand letter citing the applicable statute is often the next lever; California residents have CCPA/CPRA access, deletion, and breach rights.

ℹ

The most reliable control is what never enters the editor. Settings and policies change on GitHub's schedule, not yours; the April 24, 2026 training change is the proof. Code and data that never sit in an open buffer cannot be prompted, trained on, retained, or shared. The secrets checklist below is the cheapest privacy tool on this page.

⚠ Key Privacy Concerns

Three verified points drive this score. GitHub's Copilot documentation states that from April 24, 2026, interactions on Copilot Free, Pro, Pro+, and Max plans, including inputs, outputs, and code snippets, may be used to train and improve AI models unless the user opts out. The Privacy Statement (effective April 27, 2026) states personal data may be shared with GitHub affiliates, including Microsoft, for purposes that include training and improving artificial intelligence and machine learning technologies. And the collection list expressly reaches code, inputs, and AI outputs. On the favorable side, prompts for code completions are described as encrypted in transit and deleted once suggestions are generated, subject to listed exceptions. Automated assessment, as of July 8, 2026; verify the current sources.

Data They Collect

What GitHub's published documents describe collecting from your development environment and account. Automated assessment, as of July 8, 2026.

📊 Data Collection Scope (25%) 32/100

What the Privacy Statement lists: account data (handle, name, email, payment and transaction information); user content and files, described as "code, inputs, AI outputs, text, documents, images, or feedback"; profile information; demographic details you provide; feedback and support data; and automatically collected service usage information including IP address, device information, and session details. For Copilot itself, prompts include the code and supporting context your editor sends.

👥 Third-Party Sharing (20%) 35/100

Who the policy says can get your data: GitHub affiliates, including Microsoft, for purposes the statement lists as including product development and improvement (with AI training named), marketing, billing, support, and legal compliance; subprocessors and service providers (hosting, marketing, analytics, support, payment, security); and competent authorities on lawful requests.

🕐 Retention & Deletion (20%) 38/100

How long: as long as the account is active, plus what is needed for legal obligations, disputes, and enforcement. After termination, the Terms of Service describe deleting the full profile and repository content within 90 days, barring legal requirements, with some information remaining in encrypted backups. Copilot completion prompts are described as deleted once suggestions are generated, except for listed retention cases.

☑ User Control & Consent (15%) 40/100

Your controls: an "Allow GitHub to use my data for AI model training" toggle (the documented default from April 24, 2026 is that individual-plan interactions may be used unless you opt out), the "Suggestions matching public code" Allow/Block filter, and access, correction, deletion, and portability rights exercised through GitHub's privacy contact. The training default lands on, which is what caps this category.

🔒 Security & Breach (10%) 45/100

Security posture per the documents: the Privacy Statement describes appropriate administrative, technical, and physical controls; the Copilot terms describe prompts as encrypted in transit and not stored at rest without permission; and international transfers rely on EU standard contractual clauses and the Data Privacy Framework. This sub-score moved up from 38 in this refresh to reflect those verified statements.

🔍 Transparency & Access (10%) 32/100

Clarity: the operative rules sit across at least four documents (the Privacy Statement, the Terms of Service, the Copilot Product Specific Terms, and the Copilot settings documentation), and the April 24, 2026 training change lives in a docs page rather than the Privacy Statement itself. Individually the documents are readable; assembled, the data picture takes real work, which is what this category measures.

Compare With Other AI Services

⚠ Red Flags

Automated assessment, as of July 8, 2026. Each flag below is an opinion drawn from the published GitHub General Privacy Statement (effective April 27, 2026), the GitHub Terms of Service (effective April 27, 2026), the Copilot Product Specific Terms (October 2024), and GitHub's Copilot policy documentation, with the operative language quoted. Verify the current sources before relying on this.

AI training on individual-plan interactions, on by default

High Risk

From April 24, 2026, GitHub's documentation describes using interactions on the individual Copilot plans, inputs, outputs, code snippets, and context included, to train and improve AI models unless the subscriber opts out in Copilot settings. The docs indicate Business and Enterprise sit outside this policy, which reserves the stronger default for paying organizations.

“Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services, including inputs, outputs, code snippets, and associated context, to train and improve AI models.” GitHub Docs, Managing Copilot policies as an individual subscriber (Model training and improvements) · docs.github.com

Affiliate sharing with Microsoft, AI training included

High Risk

The sharing section does not stop at hosting: it names Microsoft as an affiliate recipient and lists product development and improvement, expressly including training and improving AI and machine learning technologies, among the purposes, with further use governed by the affiliates' own privacy statements rather than this one.

“Affiliates: Personal Data may be shared with GitHub affiliates, including Microsoft, to facilitate customer service, marketing and advertising, order fulfillment, billing, technical support, legal and compliance obligations, product development and improvement (including training and improving artificial intelligence and machine learning technologies), and for other purposes described in their respective privacy statements.” GitHub General Privacy Statement, Sharing of Personal Data, effective April 27, 2026 · docs.github.com

Personal data feeds model training under the statement itself

High Risk

Beyond the Copilot-specific policy, the Privacy Statement's processing-purposes section claims the right to use personal data to develop and improve products and technologies, naming AI, machine learning, and training models, with de-identification applied "where feasible" rather than always.

“Product Development and Improvement: We use Personal Data to develop and improve our products, services, and technologies, including artificial intelligence and machine learning technologies. This includes improving features, developing new offerings, enhancing safety and security capabilities, and training models. We apply appropriate technical safeguards, including aggregation and de-identification techniques where feasible, to protect your privacy while enabling these improvements.” GitHub General Privacy Statement, Processing Purposes, effective April 27, 2026 · docs.github.com

The collection list reaches your code and AI outputs

High Risk

The statement's collection categories are written for a developer platform, which means they reach further than a typical consumer app: the user-content category expressly covers code, inputs, and AI outputs, and the automatic category sweeps in device, session, and repository-interaction data.

“User Content and Files: When you use our Services, we collect Personal Data included as part of the information you provide such as code, inputs, AI outputs, text, documents, images, or feedback.” GitHub General Privacy Statement, Personal Data We Collect (From You), effective April 27, 2026 · docs.github.com

Retention is open-ended while the account lives

Medium Risk

There is no fixed retention schedule for an active account: the statement keeps data as long as the account is active plus whatever legal obligations, disputes, and enforcement require. The concrete number only appears at the exit: a 90-day post-termination deletion window, with encrypted backups persisting.

“We'll retain your Personal Data as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements. The retention duration depends on the purpose of data collection and any legal obligations.” GitHub General Privacy Statement, Security and Retention, effective April 27, 2026 · docs.github.com

Usage telemetry is collected automatically

Medium Risk

Interaction data flows without any action on your part: the automatic-collection category covers your IP address, device and session details, feature performance, and your contribution activity. For a tool that lives inside your editor and repositories, that is a detailed behavioral picture.

“Service Usage Information: We collect data about your interactions with the Services, such as IP address, device information, session details, date and time of requests, device type and ID, operating system and application version, information related to your contributions to repositories, and performance of specific features or Services.” GitHub General Privacy Statement, Personal Data We Collect (Automatically), effective April 27, 2026 · docs.github.com

Prompt deletion has carve-outs

Medium Risk

The favorable headline, prompts deleted once suggestions are generated, is qualified by its own opening words: "except as detailed below." The terms go on to list cases where prompts are retained, and the April 24, 2026 training policy adds a separate, larger data-use lever on individual plans.

“GitHub Copilot sends an encrypted Prompt from you to GitHub to provide Suggestions to you. Except as detailed below, Prompts are transmitted only to generate Suggestions in real-time, are deleted once Suggestions are generated, and are not used for any other purpose. Prompts are encrypted during transit and are not stored at rest without your permission.” GitHub Copilot Product Specific Terms, Section 6.A (Data), October 2024 · github.com/customer-terms

Deletion at exit is 90 days, minus backups

Medium Risk

The post-termination commitment is genuinely concrete by industry standards, but read the parenthetical: encrypted backups may hold data past the window, and legal requirements can extend retention indefinitely. Treat 90 days as the design goal, not a hard erasure guarantee.

“We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups).” GitHub Terms of Service, Section M (Cancellation and Termination), effective April 27, 2026 · docs.github.com

Go Deeper

The detail behind the score, folded so the page stays readable: the exact settings, the tier gap, which coding scenarios carry real exposure, how Copilot compares with the other AI services, the cross-border mechanics, and what should never sit in an open buffer. Open what matters to you.

🔒 Exact opt-out and filter paths (step by step)

Both of the controls that matter on an individual account live in the same place:

github.com › Profile picture › Copilot settings

1. The AI-training toggle. GitHub's documentation describes a control labeled "Allow GitHub to use my data for AI model training" with a dropdown that can be set to Disabled, and states the default posture in one sentence:

“You can opt-out from allowing your data to be used for training in your personal settings for GitHub Copilot.”GitHub Docs, Managing Copilot policies as an individual subscriber (Model training and improvements) · docs.github.com

2. The public-code matching filter. A separate dropdown controls whether Copilot will show suggestions that match public code:

“To the right of Suggestions matching public code, select the dropdown menu, then click Allow to allow suggestions matching public code, or Block to block suggestions matching public code.”GitHub Docs, Enabling or disabling suggestions matching public code · docs.github.com

⚠

Opting out is prospective. The documents describe the opt-out as stopping future use; nothing in the fetched text describes recalling interactions already used for training. If the default matters to you, flip the toggle before the next session. Automated assessment, as of July 8, 2026.

✓

What is genuinely decent here: the completion-prompt handling. The Copilot terms describe prompts as encrypted in transit, not stored at rest without permission, and deleted once suggestions are generated, subject to the listed exceptions. That is a better completions baseline than most consumer AI tools publish.

🏢 Individual vs Business vs Enterprise: the privacy gap

The pattern the methodology flags across the AI industry repeats here: the stronger data defaults attach to the organization tiers. On an automated read of GitHub's published documents, the differences that matter are these; confirm the current wording and your own agreement before relying on any row.

Dimension	Copilot Free / Pro / Pro+ / Max (individual)	Copilot Business / Enterprise (organization)
AI-training default on interactions (per docs, from April 24, 2026)	May be used unless you opt out	Listed outside the policy per the docs note
Who controls the public-code filter	Each user, in personal settings	Organization policy can enforce it
Data protection agreement	Standard terms only	Organization customers can put a DPA in place
Opt-out enforceable across a team	No, per-account only	Yes, via org policy
Fit for client / employer / regulated code	Generally no	Possibly, with the right agreement and settings

If you owe anyone a duty of confidentiality over the code in your editor, the individual plans are usually the wrong wrapper no matter how disciplined your prompting is. That conclusion is about the documents' defaults, not about GitHub's engineering. Automated assessment, as of July 8, 2026; verify the current sources.

🎯 Use-case risk matrix: what is in your editor?

Copilot's privacy exposure tracks what sits in the buffer when the assistant is active. Here is how the methodology ranks common situations:

Lower risk

Public open-source code

Code that is already public carries little confidentiality exposure. The residual issues are licensing ones, covered in the ToS review.

Moderate

Personal side projects, private repos

Private but low-stakes. Set the training toggle and filter deliberately, keep secrets in a vault, and the residual exposure is modest.

Moderate

Proprietary business logic

Trade-secret value in the code itself argues for an organization tier, where the training policy does not reach and a DPA can be added.

High risk

Employer or client code on a personal plan

Your confidentiality duties plus the individual-plan training default is the worst published combination on this page. Get authorization and the right tier.

High risk

Credentials and customer PII in fixtures

Keys, tokens, and real customer records in test data can travel inside prompts. This is the most common self-inflicted leak in AI-assisted coding.

Critical

Regulated data in code or test data (health, financial)

HIPAA, GLBA, or similar duties over data embedded in a codebase need a compliance-reviewed enterprise setup, not a personal subscription.

⚠

Regulated data is its own question. A lower cell here means lower platform exposure under these documents, not that a statute is satisfied. Where HIPAA, GLBA, GDPR, or the CCPA/CPRA applies to what is in your repositories, the plan tier is a floor, not the answer.

⚖ GitHub Copilot vs OpenAI vs Anthropic on privacy

Same scoring method across services. The Privacy Watchdog scores, which reflect the methodology's opinion-based read: Anthropic 65 (B-), OpenAI 48 (C), GitHub Copilot 45 (C-). For wider context: Perplexity 52 (C), Gemini 42 (C-), Midjourney 38 (D), Character.AI 38 (D+). Each rating is an evaluative read of published documents, not a statement of objective fact.

Dimension	GitHub Copilot	OpenAI (ChatGPT)	Anthropic (Claude)
Privacy score	45 / C-	48 / C	65 / B-
Individual/consumer training default (per published docs)	On for individual plans from April 24, 2026, opt-out available	On unless you opt out	Reads as no consumer-chat training by default
What the collection reaches	Code, inputs, AI outputs, repo activity	Prompts, outputs, usage data	Prompts, outputs, usage data
Named corporate affiliate in the sharing chain	Yes: Microsoft, with AI training among listed purposes	Categories of vendors, none named	Categories of vendors
Concrete deletion window	90 days post-termination (backups persist)	30 days, with carve-outs	Stated windows, with carve-outs

Scores reflect an automated read of each company's published documents at the time of review. Companies revise these documents, so treat the comparison as a snapshot. See the full Anthropic privacy review, OpenAI privacy review, and Gemini privacy review for the detail behind each grade.

🌎 International transfers, security, and your formal rights

For EU, UK, and Swiss users, and for anyone building GDPR compliance records, the statement describes two transfer mechanisms:

“When we engage in such transfers, we generally rely on the standard contractual clauses published by the European Commission under Commission Implementing Decision 2021/914, to help protect your rights and enable these protections to travel with your data.”GitHub General Privacy Statement, International data transfers, effective April 27, 2026 · docs.github.com

“GitHub also complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.”GitHub General Privacy Statement, Data Privacy Framework, effective April 27, 2026 · docs.github.com

On security, the statement's operative sentence is short: “GitHub uses appropriate administrative, technical, and physical security controls to protect your Personal Data.” The Copilot terms add transport encryption for prompts. On formal rights, the statement lists access, rectification, erasure or restriction, and portability, with US state-law deletion rights called out separately, and directs requests to GitHub's privacy email contact. Requests are free to send and start statutory clocks under many laws, so use writing, not the support chat. Automated assessment, as of July 8, 2026; verify the current sources.

🚫 What should never sit in an open buffer: the secrets list

A Copilot prompt is the code and supporting context your editor sends, including chat input. The collection categories above reach code, inputs, and AI outputs. So the cheapest privacy control is keeping sensitive material out of the files Copilot can see:

API keys, OAuth tokens, and personal access tokens hardcoded in source
Database connection strings and passwords in config files
.env files with production credentials open in the editor
Private keys, signing certificates, and secrets committed to the repo
Real customer or user records in fixtures, seeds, and test data
Health, financial, or other regulated data embedded in code or samples
Client code held under NDA opened in a personally-subscribed editor
Internal infrastructure details (hostnames, network maps) in comments

✓

A habit that works: secrets in a vault with environment injection, synthetic test data only, secret-scanning in CI, and a repo-level decision about where AI assistance is allowed. Every item on that list also hardens you against non-AI leaks.

🔒

"The bottom line under this methodology: 45 (C-), just under OpenAI and well under Anthropic. Copilot's completions pipeline has a genuinely decent published baseline, encrypted prompts deleted after each suggestion, but the documents around it pull the other way: collection that expressly reaches code, inputs, and AI outputs, affiliate sharing with Microsoft that names AI training among its purposes, open-ended retention while the account is active, and, since April 24, 2026, a training default on individual-plan interactions that the user must find and disable. The strongest defaults are reserved for the organization tiers, which the methodology reads as a design choice. Practically: flip the training toggle, block the public-code filter, keep secrets and client data out of the buffer, and put professional work behind Business or Enterprise with a data protection agreement."

Automated assessment by Terms.Law Watchdog methodology, as of July 8, 2026.

This page is an automated, opinion-based methodology assessment of GitHub's published privacy documents, not legal advice, and it does not create an attorney-client relationship. Policies change; verify the current language in your own account and GitHub's published documents before relying on anything here. For a question specific to your situation, you can email the facts and any documents to owner@terms.law.

Frequently Asked Questions

Automated methodology assessment of GitHub's published privacy documents, as of July 8, 2026. Each answer is an opinion drawn from the published sources; the quoted clause carries the weight. Verify the current sources before relying on this. This is general legal information, not legal advice.

ℹ

Individual vs Business / Enterprise: the training default is the dividing line. GitHub's docs describe the April 24, 2026 AI-training policy as covering Copilot Free, Pro, Pro+, and Max, with an opt-out in personal settings, and indicate Business and Enterprise sit outside it. If the code in your editor belongs to an employer or client, that one difference should decide your tier before any feature comparison does. Automated assessment, as of July 8, 2026; verify the current sources.

⚖

"Prompts are deleted" and "interactions may train models" are both true. The Copilot terms describe completion prompts as deleted once suggestions are generated, and the Copilot docs describe individual-plan interactions as usable for model training from April 24, 2026 unless you opt out. They govern different pipelines under different documents. Read them together, not against each other, and set the toggle rather than relying on the deletion sentence alone. Automated assessment, as of July 8, 2026; verify the current sources.

Does GitHub train AI models on my Copilot prompts and code?

On the individual plans, the documented default since April 24, 2026 is that it may: GitHub's Copilot policy page states interactions, including inputs, outputs, and code snippets, may be used to train and improve AI models, with an opt-out in personal Copilot settings, and indicates Business and Enterprise are outside the policy. The Privacy Statement separately claims product-development use of personal data that includes training models. The completion-prompt pipeline itself is described more protectively: encrypted in transit and deleted after each suggestion, with listed exceptions. Automated methodology assessment, opinion based on the published documents as of 2026-07-08; verify the current sources.

“Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services, including inputs, outputs, code snippets, and associated context, to train and improve AI models.”GitHub Docs, Managing Copilot policies as an individual subscriber (Model training and improvements) · docs.github.com

“Product Development and Improvement: We use Personal Data to develop and improve our products, services, and technologies, including artificial intelligence and machine learning technologies. This includes improving features, developing new offerings, enhancing safety and security capabilities, and training models.”GitHub General Privacy Statement, Processing Purposes, effective April 27, 2026 · docs.github.com

What personal data does GitHub collect when I use Copilot?

The Privacy Statement's categories are broad because they cover the whole platform: account data, user content and files, profile and payment information, demographic details you provide, feedback and support data, plus automatically collected service usage information (IP address, device, sessions, repository interactions). The category that matters most for Copilot is user content, which is defined to include code, inputs, and AI outputs. On top of that, the Copilot prompt itself packages the code and context around your cursor and your chat input. Automated methodology assessment, opinion based on the published documents as of 2026-07-08; verify the current sources.

“User Content and Files: When you use our Services, we collect Personal Data included as part of the information you provide such as code, inputs, AI outputs, text, documents, images, or feedback.”GitHub General Privacy Statement, Personal Data We Collect, effective April 27, 2026 · docs.github.com

“Service Usage Information: We collect data about your interactions with the Services, such as IP address, device information, session details, date and time of requests, device type and ID, operating system and application version, information related to your contributions to repositories, and performance of specific features or Services.”GitHub General Privacy Statement, Personal Data We Collect (Automatically), effective April 27, 2026 · docs.github.com

Does GitHub share my data with Microsoft?

Yes, by the policy's own words. Microsoft is not an inference here; the sharing section names it as an affiliate recipient, and the listed purposes go beyond running the service to include marketing, billing, support, compliance, and product development and improvement, with AI training expressly included. Once shared, further use is governed by the affiliates' own privacy statements. The statement also lists subprocessors and service providers, and competent authorities on lawful request. Automated methodology assessment, opinion based on the published policy as of 2026-07-08; verify the current sources.

“Affiliates: Personal Data may be shared with GitHub affiliates, including Microsoft, to facilitate customer service, marketing and advertising, order fulfillment, billing, technical support, legal and compliance obligations, product development and improvement (including training and improving artificial intelligence and machine learning technologies), and for other purposes described in their respective privacy statements.”GitHub General Privacy Statement, Sharing of Personal Data, effective April 27, 2026 · docs.github.com

How long does GitHub keep my data, and what happens when I leave?

While the account is active, retention is purpose-based with no fixed schedule: as long as needed for the contract, legal obligations, disputes, and enforcement. The concrete number appears at exit: the Terms of Service describe deleting the full profile and repository content within 90 days of cancellation or termination, barring legal requirements, with some information persisting in encrypted backups. Formal access, correction, erasure, and portability requests go to GitHub's privacy email contact; keep the confirmation, because it starts statutory clocks under many privacy laws. Automated methodology assessment, opinion based on the published documents as of 2026-07-08; verify the current sources.

“We'll retain your Personal Data as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements.”GitHub General Privacy Statement, Security and Retention, effective April 27, 2026 · docs.github.com

“...barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups).”GitHub Terms of Service, Section M (Cancellation and Termination), effective April 27, 2026 · docs.github.com

Should I trust GitHub Copilot with my code and data?

Under the published Watchdog methodology these documents score 45/100 (Grade C-). Pulling down: the April 24, 2026 training default on individual-plan interactions, Microsoft affiliate sharing with AI training among the purposes, collection reaching code, inputs, and AI outputs, and open-ended retention while the account is active. Helping: encrypted, deleted-after-use completion prompts (with listed exceptions), the 90-day post-termination deletion commitment, SCC and Data Privacy Framework transfer mechanics, and specific, contactable privacy rights. The trust decision reduces to two questions: whose code is in your editor, and which tier wraps it. For personal projects with the toggles set, the exposure is manageable; for anyone else's code, use an organization tier. Automated methodology assessment, opinion based on the published documents as of 2026-07-08; verify the current sources.

“GitHub Copilot sends an encrypted Prompt from you to GitHub to provide Suggestions to you. Except as detailed below, Prompts are transmitted only to generate Suggestions in real-time, are deleted once Suggestions are generated, and are not used for any other purpose.”GitHub Copilot Product Specific Terms, Section 6.A (Data), October 2024 · github.com/customer-terms

⚖

Have an actual GitHub data dispute, or building on AI-assisted code? This is an automated assessment, not legal advice. If you have a dispute with GitHub (a data deletion or access request, an account termination with data at stake) or you are building an AI product and need your own privacy policy, you can start a request here:

GitHub Copilot Privacy Policy Review

✅ What Should I Do? Action Plan

👤 Individual developer

💼 Business / professional user

⚠ Already affected

⚠ Key Privacy Concerns

Data They Collect

Compare With Other AI Services

🐕 Concerned About Your Code?

⚠ Red Flags

AI training on individual-plan interactions, on by default

Affiliate sharing with Microsoft, AI training included

Personal data feeds model training under the statement itself

The collection list reaches your code and AI outputs

Retention is open-ended while the account lives

Usage telemetry is collected automatically

Prompt deletion has carve-outs

Deletion at exit is 90 days, minus backups

Go Deeper

Public open-source code

Personal side projects, private repos

Proprietary business logic

Employer or client code on a personal plan

Credentials and customer PII in fixtures

Regulated data in code or test data (health, financial)

Who They Share With

Your Rights

Analysis

Frequently Asked Questions

What the Published Documents Say Now

The April 24, 2026 change is the headline

GitHub General Privacy Statement (effective April 27, 2026)

Copilot Product Specific Terms (October 2024), Section 6

Copilot Trust Center

Litigation and News Tracker

Doe v. GitHub, Inc. (the Copilot class action)

Litigation can freeze data you expected to age out

Need Help With Your Privacy Rights?

Try an AI governance contract workroom

GitHub Copilot Privacy Policy Review

✅ What Should I Do? Action Plan

👤 Individual developer

💼 Business / professional user

⚠ Already affected

⚠ Key Privacy Concerns

Data They Collect

Compare With Other AI Services

🐕 Concerned About Your Code?

Related Resources

⚠ Red Flags

AI training on individual-plan interactions, on by default

Affiliate sharing with Microsoft, AI training included

Personal data feeds model training under the statement itself

The collection list reaches your code and AI outputs

Retention is open-ended while the account lives

Usage telemetry is collected automatically

Prompt deletion has carve-outs

Deletion at exit is 90 days, minus backups

Go Deeper

Public open-source code

Personal side projects, private repos

Proprietary business logic

Employer or client code on a personal plan

Credentials and customer PII in fixtures

Regulated data in code or test data (health, financial)

Who They Share With

Your Rights

Analysis

Frequently Asked Questions

What the Published Documents Say Now

The April 24, 2026 change is the headline

GitHub General Privacy Statement (effective April 27, 2026)

Copilot Product Specific Terms (October 2024), Section 6

Copilot Trust Center

Litigation and News Tracker

Doe v. GitHub, Inc. (the Copilot class action)

Litigation can freeze data you expected to age out

Need Help With Your Privacy Rights?

Try an AI governance contract workroom

Related Resources