GitHub is a code-hosting and developer-collaboration platform (repositories, pull requests, Codespaces, Copilot) operated by GitHub, Inc. and GitHub B.V. as a wholly owned subsidiary of Microsoft Corporation, disclosed in Microsoft's own SEC 10-K as part of its Intelligent Cloud segment. GitHub's privacy statement discloses account, content, and optional demographic data collection, states it does not sell personal data, but also discloses sharing with Microsoft affiliates for marketing/advertising and third-party partners/resellers; GitHub's own cookie disclosure lists live Microsoft ad-tech trackers (Clarity, Bing MUID/UET) on its properties. Track record includes an affirmative artifact (a published transparency report with request counts) and a real, remediated 2022 incident in which attacker-stolen OAuth tokens issued to third-party integrators Heroku and Travis-CI were used to access data from GitHub-hosted organizations including npm.
TIMELINE
NO ENTRIES ON FILE YET.
ULTIMATE PARENT
TOOLS WE RECOMMEND
PLUS
RECEIPTS
14 ON FILE
[2020-06-24] · COLLECTION
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes, but for critical data only.
GitHub's privacy statement discloses that it collects account data (handle, name, email, password, payment and transaction information) directly from users when they open an account, in addition to user content/code and optional demographic and feedback data collected elsewhere on the page.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
GitHub's privacy statement names the operating legal entities directly: GitHub, Inc. or GitHub B.V. act as the Data Controller for personal data processed through GitHub's services.
Microsoft Corporation's FY2026 Form 10-K, filed with the SEC, identifies GitHub cloud services as part of Microsoft's Server products and cloud services offerings within its Intelligent Cloud segment, confirming GitHub's status as a Microsoft-operated cloud product line.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — No.
GitHub's privacy statement states that Personal Data may be shared with GitHub affiliates, including parent company Microsoft, for purposes that explicitly include marketing and advertising, in addition to product development and support.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy require users to be notified in case of a data breach? — Yes, eventually.
GitHub's own security blog disclosed a 2022 incident in which an attacker used stolen OAuth tokens issued to third-party integrators Heroku and Travis-CI to access and download data from dozens of GitHub-hosted organizations, including npm; GitHub revoked the affected tokens and notified impacted organizations as part of its response.
GitHub publishes an annual transparency report with concrete counts of government and legal requests for user data, including a stated policy of notifying affected users unless legally prohibited; the 2022 report states 432 requests were processed that year, up from 335 in 2021.
GitHub's own cookie disclosure lists Microsoft-domain tracking cookies set on GitHub properties, including a cookie that stores Bing's visitor ID and is used for advertising and analytics purposes, with lifetimes of up to 13 months.