Privacy policy
GitHub General Privacy Statement
Risk score
61of 100
In short
What you accept
Everyday words for the material promises and rights you give up. Each line includes a quote from the document.
Fineprint cannot see whether you agreed. This page is posted on their site. Open the original if you need to know how they say it applies.
You are agreeing that the company may sell or share your personal data with third parties.
Other companies
“If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).”
You are agreeing to resolve disputes in private arbitration and to give up class actions.
This product
“An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.”
You are agreeing that the company may keep your data for an open-ended period.
This product
“We’ll retain your Personal Data as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements.”
You are agreeing to cross-service tracking or profiling of your activity.
This product
“Our emails to users may contain a pixel tag, which is a small, clear image that can tell us whether or not you have opened an email and what your IP address is.”
You are agreeing to terms that may still collect or retain data about children.
This product
“San Francisco, CA 94107 United States ## [Information for Minors](#information-for-minors) Our Services are not intended for individuals under the age of 13.”
What it can cost you
Quoted clauses that can affect your privacy, money, or right to go to court — including terms that follow you to other products.
Highest-cost clauses first
You are agreeing that the company may sell or share your personal data with third parties.
“If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).”
What that means: Your activity and identifiers can be used by companies you did not choose.
The document describes selling or commercially sharing personal data with third parties.
You are agreeing to resolve disputes in private arbitration and to give up class actions.
“An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.”
What that means: You may not be able to sue in court or join a class action if something goes wrong.
Disputes are steered into arbitration and collective lawsuits are waived.
You are agreeing to cross-service tracking or profiling of your activity.
“Our emails to users may contain a pixel tag, which is a small, clear image that can tell us whether or not you have opened an email and what your IP address is.”
What that means: Your browsing and device signals can be stitched into a longer profile.
The document allows tracking or profiling beyond a single site session.
You are agreeing that the company may keep your data for an open-ended period.
“We’ll retain your Personal Data as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements.”
What that means: Old account data can linger long after you expected it to be gone.
Retention is open-ended or justified with vague business interests.
You are agreeing to terms that may still collect or retain data about children.
“San Francisco, CA 94107 United States ## [Information for Minors](#information-for-minors) Our Services are not intended for individuals under the age of 13.”
What that means: A child’s account or device can still generate a data trail.
The document addresses children but may still collect or retain youth data.
Keep this list. Fineprint cannot undo or cancel something you already agreed to at the company.
We cannot see Agree on their site. With Premium, tap “I accepted these terms” if you already agreed to what GitHub asks.
