Is GitHub Copilot safe with your data?
GitHub Copilot
GitHub (Microsoft)
Partial disclosure · medium confidence
Partly. GitHub Copilot earns a C (66/100) for what it discloses about your data: the statement uses Personal Data, including code, inputs, and AI outputs, to develop and improve artificial intelligence and machine learning technologies, including training models, under legitimate interests.
Dealbreaker flag
- The governing GitHub General Privacy Statement processes user content, including code, inputs, and AI outputs, to train AI and machine-learning models under legitimate interests, applying de-identification only where feasible, with no named consumer training opt-out in the captured text.
#32
of 69 apps ranked
66
score · Coding avg 54
+12
vs category average
GitHub Copilot runs under a detailed Microsoft and GitHub privacy statement that meets GDPR standards. It gives users the full set of data-subject rights, names standard contractual clauses and Data Privacy Framework safeguards for international transfers, and states data categories and legal bases clearly. The same statement says it uses user content, including code, inputs, and AI outputs, to train AI and machine learning models under legitimate interests. De-identification applies only where feasible, the captured text names no consumer training opt-out, and retention is described only in vague terms with no day count or deletion timeline.
What GitHub Copilot's privacy policy says about your data
Trains on user content, opt-out not named
The statement uses Personal Data, including code, inputs, and AI outputs, to develop and improve artificial intelligence and machine learning technologies, including training models, under legitimate interests. Aggregation and de-identification apply only where feasible, and no consumer mechanism is named to exclude inputs from training.
Full set of data-subject rights
Users can access, rectify, erase, restrict, object, withdraw consent, and request portability in a machine-readable format by emailing privacy at github. The statement names a DPO and a right to complain to a Data Protection Authority.
Strong international transfer safeguards
Transfers from the EU, UK, and Switzerland rely on the European Commission standard contractual clauses under Decision 2021/914, and GitHub certifies to the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework under FTC enforcement.
Retention stays vague
Data is kept as long as the account is active and as needed for contractual, legal, and dispute purposes. US-state text mentions brief retention terms by design, and the governing statement gives no day count or deletion timeline.
What the policy is silent or vague on
- Doesn't clearly: keeps user inputs out of model training, or makes training opt-in
- Doesn't clearly: names a way to opt out of or into training
- Doesn't clearly: says whether training use differs by plan or tier
- Doesn't clearly: states a deletion timeline after closure or request
GitHub Copilot privacy rating
Details
- Category
- Coding
- Modalities
- text
- Processes biometrics
- No
- Policy last updated
- 2026-04-27
- Region scored
- Global / US-default
- Assessed
- 2026-06-20
Other coding apps
Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.