Developer tools
github.com
Risk score
61of 100
Read Oct 20, 2026
In short
What you accept
Everyday words for the material promises and rights you give up. Each line includes a quote from the document.
Fineprint cannot see whether you agreed. This page is posted on their site. Open the original if you need to know how they say it applies.
You are agreeing that the company may sell or share your personal data with third parties.
Other companies
“If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).”
You are agreeing to resolve disputes in private arbitration and to give up class actions.
This product
“An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.”
You are agreeing that the company may keep your data for an open-ended period.
This product
“We’ll retain your Personal Data as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements.”
You are agreeing to cross-service tracking or profiling of your activity.
This product
“Our emails to users may contain a pixel tag, which is a small, clear image that can tell us whether or not you have opened an email and what your IP address is.”
You are agreeing to terms that may still collect or retain data about children.
This product
“San Francisco, CA 94107 United States Information for Minors Our Services are not intended for individuals under the age of 13.”
What it can cost you
Quoted clauses that can affect your privacy, money, or right to go to court — including terms that follow you to other products.
Highest-cost clauses first
You are agreeing that the company may sell or share your personal data with third parties.
“If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).”
What that means: Your activity and identifiers can be used by companies you did not choose.
The document describes selling or commercially sharing personal data with third parties.
You are agreeing to resolve disputes in private arbitration and to give up class actions.
“An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.”
What that means: You may not be able to sue in court or join a class action if something goes wrong.
Disputes are steered into arbitration and collective lawsuits are waived.
You are agreeing to cross-service tracking or profiling of your activity.
“Our emails to users may contain a pixel tag, which is a small, clear image that can tell us whether or not you have opened an email and what your IP address is.”
What that means: Your browsing and device signals can be stitched into a longer profile.
The document allows tracking or profiling beyond a single site session.
You are agreeing that the company may keep your data for an open-ended period.
“We’ll retain your Personal Data as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements.”
What that means: Old account data can linger long after you expected it to be gone.
Retention is open-ended or justified with vague business interests.
You are agreeing to terms that may still collect or retain data about children.
“San Francisco, CA 94107 United States Information for Minors Our Services are not intended for individuals under the age of 13.”
What that means: A child’s account or device can still generate a data trail.
The document addresses children but may still collect or retain youth data.
Keep this list. Fineprint cannot undo or cancel something you already agreed to at the company.
We cannot see Agree on their site. With Premium, tap “I accepted these terms” if you already agreed to what GitHub asks.
First readings and wording changes we could quote — the same items that appear on News.
Updated · Privacy policy
We quoted 6 wording changes below. The current grade is C.
Wording we could quote
Changed
Tracking you across apps
Was
“We and/or our partners also share the information we collect or infer with third parties for these purposes. ... track your interaction with the Services, develop inferences... across Services for various purposes, including targeted advertising.”
Now
“Our analytics and advertising partners may use these technologies in our Services to collect personal information... related to your online activities over time and across Services for various purposes, including targeted advertising.”
Changed
Data sold or shared with third parties
Was
“We 'shared' the following categories of personal information... We shared each category to or with advertising networks, data analytics providers, and social networks. ... The business or commercial purpose of sharing personal information is to assist us with marketing, advertising, and audience measurement.”
Now
“We shared each category to or with advertising networks, data analytics providers, and social networks.”
Changed
Location or sensitive-data over-collection
Was
“Geolocation Information: Depending on the Service's functionality, we collect regional geolocation data. ... Demographic information: In some cases, you provide us with ethnicity, gender, or similar demographic details.”
Now
“Depending on the Service's functionality, we collect regional geolocation data.”
No longer quoted
Broad license to user content
“User Content and Files: When you use our Services, we collect Personal Data included as part of the information you provide such as code, inputs, AI outputs, text, documents, images, or feedback. ... This includes improving features, developing new offerings, enhancing safety and security capabilities, and training models.”
No longer quoted
Cookie consent that favors Accept
“If you disable the non-essential cookies on the Enterprise Marketing Pages, the ads, content, and marketing you see may be less relevant. ... If you enable a browser extension designed to block tracking... non-essential cookies... may be disabled.”
No longer quoted
Terms follow you to parks, stores, and other products
“Our Services may contain links or buttons that lead to third-party services like Twitter or LinkedIn. Use of these features may result in data collection. Engaging with these buttons, tools, or content may automatically send certain browser information to these companies.”
Oct 6, 2026 · C
Updated · Privacy policy
We quoted 8 wording changes below. The grade moved from D to C.
Wording we could quote
Changed
Data sold or shared with third parties
Was
“If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).”
Now
“We 'shared' the following categories of personal information... We shared each category to or with advertising networks, data analytics providers, and social networks. ... The business or commercial purpose of sharing personal information is to assist us with marketing, advertising, and audience measurement.”
No longer quoted
Forced arbitration or class-action waiver
“An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.”
Changed
Tracking you across apps
Was
“Our emails to users may contain a pixel tag, which is a small, clear image that can tell us whether or not you have opened an email and what your IP address is.”
Now
“We and/or our partners also share the information we collect or infer with third parties for these purposes. ... track your interaction with the Services, develop inferences... across Services for various purposes, including targeted advertising.”
No longer quoted
Children’s data
“San Francisco, CA 94107 United States ## [Information for Minors](#information-for-minors) Our Services are not intended for individuals under the age of 13.”
Appeared
Location or sensitive-data over-collection
“Geolocation Information: Depending on the Service's functionality, we collect regional geolocation data. ... Demographic information: In some cases, you provide us with ethnicity, gender, or similar demographic details.”
Appeared
Broad license to user content
“User Content and Files: When you use our Services, we collect Personal Data included as part of the information you provide such as code, inputs, AI outputs, text, documents, images, or feedback. ... This includes improving features, developing new offerings, enhancing safety and security capabilities, and training models.”
Appeared
Cookie consent that favors Accept
“If you disable the non-essential cookies on the Enterprise Marketing Pages, the ads, content, and marketing you see may be less relevant. ... If you enable a browser extension designed to block tracking... non-essential cookies... may be disabled.”
Appeared
Terms follow you to parks, stores, and other products
“Our Services may contain links or buttons that lead to third-party services like Twitter or LinkedIn. Use of these features may result in data collection. Engaging with these buttons, tools, or content may automatically send certain browser information to these companies.”
Sep 16, 2026 · C
First reading · Privacy policy
Fineprint found 5 quoted privacy clauses that match the consumer rubric. This is a reading aid, not legal advice.
Sep 2, 2026 · D
