Skip to content

GitHub

Owned by Microsoft. The host behind a GitHub repo.

Short version: Fine for almost everything you'd share here. GitHub doesn't mine your private repos to train AI — except code it sees while you're actively using its Copilot assistant, and that has a one-click off switch. The main thing to know: as of 2026-04-24 that switch is on by default on free/individual Copilot plans, so flip it off if you care. Business/Enterprise plans never train on your code at all.

Last verified: 2026-06-07.

Does it train AI on what you upload?

Two separate things, often confused:

  • Your repos sitting there: no. GitHub staff don't read private repos at rest, and the contents aren't fed to AI training. The Terms list narrow exceptions — security, malware scanning, a support request you opened, legal duty — not model training. [confirmed]
  • Code Copilot sees while you work: yes, by default, on free/individual plans — but switchable. If you use the Copilot assistant, what you type and the snippets it reads (including from a private repo you have open) count as "interaction data," and since 2026-04-24 GitHub may train on that unless you opt out. [confirmed]

If you never use Copilot, the second point doesn't apply to you.

Turn the training off

One toggle, ~30 sec:

  1. Profile picture (top-right) → Copilot settings.
  2. Find "Allow GitHub to use my data for AI model training."
  3. Set it to Disabled.

That's the whole job. [confirmed]

Keeping and deleting your data

  • While your account is live, GitHub keeps your data — that's the point of a host. [confirmed]
  • Delete a repo or your account and GitHub says it's gone and can't be restored by them. [confirmed] A short window may exist where support can recover an accident, but the docs don't promise one — assume deletion is final and keep your own copy. [unclear] (only community-forum chatter gives a "90-day" figure — unofficial, GitHub community discussion, seen 2026-06-07)
  • Anything someone already copied is theirs to keep — deletion on GitHub's side doesn't reach down to clones already on other people's machines. [estimate]

What a paid/Enterprise plan changes

If your data is regulated (health, personal, anything under a grant's data terms), Business/Enterprise is the tier that earns the guarantees:

  • No training, ever. Copilot Business and Enterprise are contractually exempt from the AI-training use above. [confirmed]
  • A real data agreement (DPA) plus admin controls — org-wide policies, audit logs, the paperwork a compliance review wants. [confirmed]
  • Pick where your data lives (next section). [confirmed]

For an individual sharing a study tool or a public toolkit, free is genuinely fine — the enterprise extras are for teams handling regulated data.

Where your data is stored (EU / UK / US)

  • Free and individual accounts: US. GitHub stores and processes data across regions including the US, with no region choice on these plans. Under GDPR that's a US transfer — usually fine, but name it if your grant or DPA restricts where data may sit. [confirmed]
  • Choosing the EU is an Enterprise-only feature. GitHub Enterprise Cloud with data residency lets an org pin its code and data to a chosen region — EU (now including Norway and Switzerland), US, Australia, or Japan. It runs on Microsoft Azure and is sold through a GitHub/Microsoft account rep, not self-serve. [confirmed]
  • No UK-specific region as of 2026-06; the EU region is the closest option. [confirmed]

Sources