What Does GitHub Collect? Key Privacy Facts Users Should Know

Quick Summary

What They Collect: Account, repo content, device/browser data, billing, support files, and inferred attributes (profiling) (25 words max)
How They Use & Share It: Service delivery, security, analytics, personalization, marketing; shared with affiliates, subprocessors, ad/analytics partners, and legal authorities (25 words max)
Your Rights: Access, correct, delete, object, portability, withdraw consent, and state-specific opt-outs and complaint routes (25 words max)

Why You Should Care About GitHub's Privacy Practices

GitHub collects high-risk data like repository contents and private files that could include secrets, credentials, or proprietary code — protect confidential code and IP.
Profiling and targeted marketing use behavioral and inferred data; this could surface developer preferences or activity for ads or analytics-driven decisions.
Global data transfers and many subprocessors increase exposure risk for your data; private repo access is possible for security, legal, or compliance reasons.
While you have rights (access, deletion, portability), some retention and sharing exceptions exist for legal compliance, security, and dispute resolution.

Privacy Highlights

What They Collect

Account information
User content and files
Demographic information
Feedback data
Payment information

How They Share Data

Business affiliates (including Microsoft)
Service providers and subprocessors (hosting, analytics, payment processors)
Third-party partners and resellers
Advertising partners and ad networks

Data Retention

GitHub retains Personal Data while your account is active and as needed to fulfill contractual or legal obligations, to resolve disputes, comply with law, and for security — retention period varies by purpose and jurisdiction (short retention terms are stated 'by design', but some categories are kept for legal/compliance reasons) .

Your Rights

Access data
Rectify data
Erase or limit processing
Object to processing

Detailed Analysis

Concerning Practices

Shares data with advertising, analytics and social networks for marketing and audience measurement
Collects a broad set of personal data including content of repositories and private-support files
Performs inference/profiling to generate user characteristics and personalization
Transfers Personal Data internationally (including to the U.S.) using SCCs / DPF mechanisms
Allows subprocessors and many third-party integrations which increase sharing risk
Private repository access by staff is permitted in certain security or legal circumstances

Personal Data Types

Account informationUser content and filesDemographic informationFeedback dataPayment informationProfile informationSales and marketing dataSupport dataBrowser informationGeolocation informationService usage informationWebsite usage dataInformation from other usersPublicly available information

Tracking Methods

Essential cookiesAnalytics cookiesAdvertising cookiesSocial media cookiesPixel tagsWeb beaconsLocal storage (including flash cookies / LSOs)

Third Parties

Business affiliates (including Microsoft)Service providers and subprocessors (hosting, analytics, payment processors)Third-party partners and resellersAdvertising partners and ad networksSocial networksGovernment authorities and law enforcement (when required)Corporate transaction recipients (e.g., acquirers)

User Controls

Access dataRectify dataErase or limit processingObject to processingData portabilityWithdraw consentOpt-out of marketingDelete account

GitHub Privacy Summary