What GitHub's terms say about your data

Who owns the data the customer puts in?

The customer · covers all customer content

1. Headline Every plan covers all customer content

   The customer

   You own Your Content.

   GitHub Terms of Service (terms), read 2026-10-22 · link to this fact

   ToS section D.3. Section J.2 adds: 'GitHub does not claim ownership of your Input or Output.' The Customer Agreement General Terms (Team/Enterprise) could not be curl-checked; per WebFetch they define Customer Content as Content the Customer 'creates, owns, or to which Customer holds the rights' without a separate ownership clause.

Does the vendor train AI on it?

1. Headline Free, Pro covers AI feature inputs and outputs, private code included

   Opt-out: on unless the customer turns it off

   You also grant GitHub and its Affiliates a license to collect and use your Inputs and Outputs to develop, train and improve artificial intelligence and machine learning models and technologies including those that power AI Features, unless (a) you opt out through your account settings

   GitHub Terms of Service (terms), read 2026-10-22 · link to this fact

   ToS J.3 (effective 2026-04-27), for individual licenses: Copilot/AI-feature Inputs and Outputs, including private repo content sent as Input (E.3), are used for training unless the user opts out. Private repo content NOT sent to an AI feature is not used: E.3 'We will not otherwise use your private repository contents to develop or improve the Service.' Quote is slightly over 40 words to keep the opt-out clause.

2. Detail Free, Pro covers public content

   Yes, no opt-out

   You grant GitHub and our Affiliates the right to store, host, archive, parse, display, and make copies of Your Content as necessary to provide, develop, and improve the Service, including by training AI Features

   GitHub Terms of Service (terms), read 2026-10-22 · link to this fact

   ToS D.4 license; J.3 says the opt-out 'does not apply to the license granted in Sections D.4-D.8 or to any Content that does not constitute Input or Output (including Content stored in public repositories)'. In practice this covers public content with no opt-out; private repos are limited by E.3. Scope: content in public repositories, issues, comments.

3. Headline Team, Enterprise Cloud covers AI feature data

   No

   GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models.

   Managing GitHub Copilot policies as an individual subscriber (ai policy), read 2026-10-22 · link to this fact

   Same note continues: 'Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization.' ToS J.1/J.3 also exclude customers on a GitHub Customer Agreement from the training license. Statement is about Copilot customer data; DPA itself could not be curl-checked. Assumes Team and Enterprise Cloud are bought under the Customer Agreement (see gaps).

4. Supporting Free, Pro covers AI interaction data

   Opt-out: on unless the customer turns it off

   Copilot Business and Copilot Enterprise users are not affected by this update.

   Updates to GitHub Copilot interaction data usage policy (GitHub Blog) (ai policy), read 2026-10-22 · link to this fact

   Blog 2026-03-25: from April 24, 2026 Copilot Free, Pro and Pro+ interaction data is used for training unless users opt out; the program does not use 'Content from your issues, discussions, or private repositories at rest.' Corroborates the ToS facts.

Does the vendor keep a right to use it aggregated, de-identified or as usage data?

Reserved · covers usage data

1. Headline Every plan covers usage data

   Reserved

   This includes creating aggregated statistical data for internal reporting, financial reporting, revenue planning, capacity planning, and forecast modeling (including product strategy).

   GitHub General Privacy Statement (privacy policy), read 2026-10-22 · link to this fact

   Privacy Statement, Business Operations use of Personal Data. Per WebFetch the DPA section 3.C lists the same 'creating aggregated statistical data for internal reporting, financial reporting' purpose for Customer Personal Data (not curl-verified).

What can the customer export, and who can run it?

Everything by any member through a self-serve screen · covers repository code and full git history

1. Headline Every plan covers repository code and full git history

   Everything by any member through a self-serve screen

   If you want the entire history, you can clone the repository.

   Downloading source code archives (help article), read 2026-10-22 · link to this fact

   Anyone with read access to the repo can clone it with full Git history. Covers Git data only, not issues/PRs.

2. Detail Every plan covers one snapshot of code, no history

   Part of it by any member through a self-serve screen

   These snapshots are generated by the git archive command in one of two formats: tarball or zipball.

   Downloading source code archives (help article), read 2026-10-22 · link to this fact

   Snapshot of one branch, tag or commit; 'Snapshots don't contain the entire repository history.'

3. Detail Free, Team, Enterprise Cloud covers organization repos with issues, pull requests and other metadata

   Part of it by the owner through the API

   These endpoints are only available to authenticated organization owners.

   REST API endpoints for organization migrations (help article), read 2026-10-22 · link to this fact

   Organization migration archive (repos plus selected metadata). Partial: backup doc warns 'Migration archives do not include all data related to a repository. For example, Git Large File Storage objects, discussions, or packages are not included.' tar.gz format inferred from the account-archive doc, not stated on this page.

4. Detail Free, Pro covers personal account metadata

   Part of it by the owner through an admin screen or the API

   You can export your personal account's data through your account settings on GitHub or with the User Migration API.

   Requesting an archive of your personal account's data (help article), read 2026-10-22 · link to this fact

   Repository and profile metadata of a personal account; 'GitHub packages your personal data in a tar.gz file'; download link expires after seven days by default.

How much history does the plan keep?

Not read yet

1. Detail Every plan covers Actions logs and artifacts

   90 days, older data deleted

   By default, checks, workflow runs, commit statuses, and the artifacts and log files generated by workflows are retained for 90 days before they are automatically deleted.

   Configuring the retention period for checks, workflow runs, commit statuses, artifacts, and logs in your organization (help article), read 2026-10-22 · link to this fact

   GitHub Actions default, all plans. Configurable: public repos 1 to 90 days, private repos 1 to 400 days (next fact). Repository content itself has no stated time limit (see gaps).

2. Detail Every plan covers Actions logs and artifacts, private repos

   400 days, older data deleted

   For private repositories: you can change this retention period to anywhere between 1 day or 400 days.

   Configuring the retention period for checks, workflow runs, commit statuses, artifacts, and logs in your organization (help article), read 2026-10-22 · link to this fact

   Maximum configurable Actions artifact/log retention for private repos; public repos max 90 days. Not plan-specific on this page.

3. Detail Free, Team, Enterprise Cloud covers organization audit log

   180 days, older data deleted

   The audit log lists events triggered by activities that affect your organization within the last 180 days.

   Reviewing the audit log for your organization (help article), read 2026-10-22 · link to this fact

   Organization audit log; 'Only owners can access an organization's audit log.'

How long is data kept after the account ends, and can it still be exported?

90 days to export · covers all customer content

1. Headline Free, Pro covers all customer content

   90 days to export

   You must make this request within 90 days of cancellation, termination, or downgrade.

   GitHub Terms of Service (terms), read 2026-10-22 · link to this fact

   ToS M.2: GitHub will 'delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups)', and 'Upon request, we will make a reasonable effort to provide an Account owner with a copy' of account contents. Export after cancellation is a support request on a reasonable-effort basis. Self-deleting an organization differs: the help page says 'After you delete an organization, GitHub cannot restore your content.'

2. Headline Team, Enterprise Cloud covers repository data

   90 days to export

   Customer may migrate or request migration of the data in its repositories for up to ninety (90) days.

   GitHub Customer Agreement: General Terms (terms), read 2026-10-22 · couldn't be reached · quote not yet checked against the live page · link to this fact

   Customer Agreement General Terms section 9.5, per WebFetch. github.com/customer-terms is blocked by this session's proxy (it routes github.com/<owner>/<repo> paths through repo access control, HTTP 403); passage located with WebFetch only, so the wording may be paraphrased. The DPA (per WebFetch, section 8) says GitHub will delete or return Customer Personal Data at the customer's choice, with no day count.

What the read couldn't settle

• GitHub Customer Agreement General Terms, Data Protection Agreement and Copilot Product Specific Terms (github.com/customer-terms/*) return HTTP 403 through this session's proxy, which treats github.com/<owner>/<repo> paths as repositories; web.archive.org was also unreachable. Read with WebFetch only (versions March 2025, October 2025, October 2024 as reported by WebFetch, unverified). The one fact from them is verified:false; recheck from an unrestricted network.
• Plan mapping: ToS J.1 says customers on a GitHub Customer Agreement are outside the J.3 training license. We assumed Team and Enterprise Cloud are on the Customer Agreement and Free/Pro (and free orgs) on the ToS. Some Team accounts may still be on the ToS; the docs don't settle this.
• Copilot plans (Free/Pro/Pro+ vs Business/Enterprise) don't map 1:1 onto GitHub plans. The no-training statement covers Copilot Business/Enterprise customer data; for Team/Enterprise orgs without Copilot Business it rests on the ToS J.1 exclusion plus the DPA (not curl-verified).
• Retention of repository content itself: no page found that says GitHub keeps repos indefinitely, so no 'keeps: all' fact was recorded. Retention facts cover Actions artifacts/logs/checks and the org audit log only.
• Exact contents and format of org migration archives (tar.gz) are inferred; the 'About migrations between GitHub products' page was not fetched.

Documents

15 of 15 read. Each fact above names the one it comes from.

1. GitHub Terms of Service Terms · version 2026-04-27 · read 2026-10-22
2. GitHub Customer Agreement: General Terms Terms · version 2025-03 · read 2026-10-22 · couldn't be reached
3. GitHub Data Protection Agreement Data processing addendum · version 2025-10 · read 2026-10-22 · couldn't be reached
4. GitHub Copilot Product Specific Terms Terms · version 2024-10 · read 2026-10-22 · couldn't be reached
5. GitHub General Privacy Statement Privacy policy · version 2026-04-27 · read 2026-10-22
6. Managing GitHub Copilot policies as an individual subscriber AI policy · read 2026-10-22
7. Updates to GitHub Copilot interaction data usage policy (GitHub Blog) AI policy · version 2026-03-25 · read 2026-10-22
8. Downloading source code archives Help article · read 2026-10-22
9. Backing up a repository Help article · read 2026-10-22
10. REST API endpoints for organization migrations Help article · read 2026-10-22
11. Requesting an archive of your personal account's data Help article · read 2026-10-22
12. Configuring the retention period for checks, workflow runs, commit statuses, artifacts, and logs in your organization Help article · read 2026-10-22
13. Reviewing the audit log for your organization Help article · read 2026-10-22
14. Deleting an organization account Help article · read 2026-10-22
15. GitHub's plans Plans page · read 2026-10-22