FAQ: Privacy Statement update on Copilot data use for model training (Free/Pro/Pro+)

Hello GitHub Community👋

We’re sharing an update to our Privacy Statement and Terms of Service about how we use personal data to develop, improve, and secure GitHub products and services, including training AI and machine learning models that power GitHub Copilot.

For the full announcement and complete details, please visit the blog post: Updates to GitHub Copilot interaction data usage policy.

Frequently Asked Questions

Below is an FAQ covering what’s changing, who’s affected, what data may be used (when enabled), safeguards, and opt-out instructions.

• Why is GitHub making this change and when will it go into effect?

  • We’re making this change to improve model performance and deliver a better user experience. As Copilot usage continues to increase dramatically, real-world data will help our models cover the increasing number of scenarios they’re now being used for. The change goes into effect on April 24. Users received 30 days advance notice and can opt out at any time.

• Why are you only using data from individuals while excluding businesses and enterprises?

  • Our agreements with Business and Enterprise customers prohibit using their Copilot interaction data for model training, and we honor those commitments. Individual users on Free, Pro, and Pro+ plans have control over their data and can opt out at any time.

• Are students and teachers that access Copilot Pro for free affected by this update?

  • No, under our policy, students that have access to Copilot Student and teachers that access Copilot Pro for free are not affected.

• What data are you collecting?

  • When an individual user has this setting enabled, the interaction data we may collect includes:
    • Outputs accepted or modified by the user
    • Inputs sent to GitHub Copilot, including code snippets shown to the model
    • Code context surrounding the user’s cursor position
    • Comment and documentation that the user wrote
    • File names, repository structure, and navigation patterns
    • Interactions with Copilot features including Chat and inline suggestions

• What can individuals do if they don’t want their inputs, outputs, or code snippets, used for model training?

  • They can opt out via their GitHub Copilot account settings at any time.

• Who will have access to this data outside of GitHub?

  • GitHub and Microsoft personnel working on AI model development may access interaction data collected for training. We may also engage service providers to assist with model training on our behalf, subject to contractual obligations to use the data only for providing services to GitHub. Third-party model providers do not receive this data for their own model training. We do not sell user data. For more information on how we handle your data, see our Privacy Statement.

• What is a "GitHub affiliate" and who does that include?

  • A GitHub affiliate is a company that is part of the same corporate family as GitHub — meaning any entity that controls, is controlled by, or is under common control with GitHub. Today, that primarily means Microsoft Corporation and its subsidiaries. You can review Microsoft's privacy practices in the Microsoft Privacy Statement.

  Companies that provide AI models or other services to GitHub — such as model providers, cloud hosting vendors, and other service providers — are not affiliates. They are service providers or subprocessors, and they are bound by contractual obligations that restrict how they can use your data. Specifically, service providers and subprocessors may only process your data on GitHub's behalf and at GitHub's direction — they do not receive your data for their own independent purposes, including their own model training. You can see GitHub's current list of subprocessors here.

  In short: affiliates are part of our corporate family. Service providers work for us under contract. These are distinct relationships with different rights and obligations.

• How do you protect sensitive data?

  • We’ve implemented multiple layers of protection for sensitive data including automated filtering designed to detect and remove API keys, passwords, tokens, and personally identifiable information. We also provide user controls for which repositories Copilot can access. We limit data access to authorized personnel working directly on model improvement and safety, and log and audit access.

• Do I need to do anything if I previously disabled the setting titled "Enabling or disabling prompt and suggestion collection"?

  • No, if you previously disabled that setting your preference will carry over and your interaction data will not be used for model training.

• Will code stored in private repositories be used for model training?

  • If a Copilot user has their settings set to enable model training on their interaction data, code snippets from private repositories can be collected and used for model training while the user is actively engaged with Copilot while working in that repository. This applies only to code snippets and outputs that are actively sent to Copilot during a user's session — we do not access or pull code from private repositories at rest. To prevent code snippets shared with Copilot during active sessions from being used for model training, users can disable model training in their GitHub account settings.

• What safeguards are in place to prevent enterprise code being used for model training due to an individual using a personal Copilot license while working in their employer’s codebase?

  • We do not train on the contents from any paid organization’s repos, regardless of whether a user is working in that repo with a Copilot Free, Pro, or Pro+ subscription. If a user’s GitHub account is a member of or outside collaborator with a paid organization, we exclude their interaction data from model training.

• Other companies aren’t using user data to train models. Why is GitHub?

  • We’re giving users the option of allowing us to train AI models with their interaction data because internal testing shows it will improve the accuracy of Copilot’s suggestions for all users. We can only speak on behalf of GitHub, but it’s worth noting this is similar to the approach that Microsoft,  Anthropic, and JetBrains are taking.

• You’re collecting code snippets, prompt text, AI responses, and detailed interaction patterns. How is this not giving you my entire codebase?

  • We’re collecting data only from your interactions with Copilot—we are not pulling any data from your codebase at rest.

• Security researchers found that Copilot Chat could expose private code from repositories that were temporarily public then set back to private. Why should we trust your guarantees about protecting our data?

  • We take the security of your data seriously and continue to invest in safeguards. The scenario described involved third-party collection of temporarily public data, which is outside GitHub's control. For data collected under this new program, we apply access controls, audit logging, and automated filtering to protect your code.

• I selected Copilot because GitHub said it didn’t train on user data. This feels like a bait and switch.

  • As Copilot usage continues to increase dramatically, we’ve identified a need for real-world data to help our models cover the increasing number of scenarios they’re now being used for. We are committed to giving developers control over whether their interaction data is used for training and will always be transparent about our use of this data.

• If this data collection is truly safe, why don’t you enable it by default for enterprise customers as well?

  • Our agreements with Business and Enterprise customers prohibit using their Copilot interaction data for model training, and we honor those commitments. That said, we use Microsoft interaction data for model training, with plans to incorporate GitHub interaction data, and are very confident in our ability to protect data used for model training.

• If your AI needs real user code to be competitive, isn’t that an admission that your advantage comes from exploiting your existing user base rather than better research?

  • 26 million developers are now using GitHub Copilot, representing a huge range of use cases and needs. We want to deliver an exceptional experience for every user, which is why we’re giving users the option of allowing us to use their usage data to improve Copilot’s ability to perform a more diverse range of coding tasks.

• If training on user code is so obviously beneficial, why does every company try to hide it behind toggles, footnotes, or tiered pricing instead of proudly asking for consent?

  • We can only speak for GitHub, and we are being as transparent as we can be about this change. We are notifying affected users directly, we published a blog post, and we have in-product notifications alerting users of the upcoming changes and directing them to update their user settings per their preferences.

• I noticed the private repository access language was removed from the Privacy Statement. Where did it go?

  • We moved the description of when GitHub personnel may access private repository content from the Privacy Statement to Section E (Private Repositories) of the Terms of Service. This is a consolidation, not a change. The same access limitations that have always applied continue to apply. See the changelog for more details: Updates to our Privacy Statement and Terms of Service: How we use your data.

Join the discussion

Have additional questions or feedback? Please share them in the comments below.

[Xefreh]

Why not let people choose per project if they want to opt out?

[Xefreh]

Hadn't thought of it but it's a good idea to give the option. I would enable it on some of my repos but won't enable it for all.

And I would recommend taking a page from OpenAI's book, and giving out tokens. They give you something like 1 million tokens per day for free on projects where you enable them to use your data. That take it from "I'm paying you to give you my data? Really?" to "Sign me right up!" And to be clear: what they allow is for you to enable on a per-project/per-api-token basis, to opt-in to data collection. Anything you use that API Token for is fair game for them to use the data, and you also get some free tokens each day when using that API Token.

this is a far better tradeoff than "one toggle per account". It's just too big of a hammer to give users no options like this and if you're not already planning the work to fix it, you will be soon, I believe. If someone is a contractor w/ private repos who also does some personal projects, the choices are "risk exposing customer data, likely in breach of their own contracts", "disable data collection and double check that every day and still worry about it" (and you're not even able to collect data that they might not care about), or "find a different provider than GitHub so they can feel safe".

I'm fine with Opt-Out as a concept, because 90% of people never change default settings. But making this opt-out by default even for private repos is going to cause intense blowback to the point where I wouldn't be surprised to see adoption of GitHub Copilot stall or reverse. I'm not going to say this was poorly thought out, because there are a lot of moving parts. I understand that. But I think on the point of "we're going to make it easy by shipping an MVP with an account level toggle and iterate on customer feedback" you guys grossly misjudged how the community is going to react to this, how much non-enterprise users really depend on copilot as a core part of their workflow, how much data you'll actually get from this, and overall how successful this "yolo" approach will really be.

It's a stumble, you (Github) needs to recognize that, but you can recover. Here's what I see as the right path:

• Opt-out for public repos by default
• Opt-in for private repos by default
• Repo level toggle would be smart, but I don't think it's strictly necessary. Personally, I will only opt-in on a repo basis. I think you'll get more data if people can toggle by repo
• Apologize for the botched rollout and fix these problems before this pending disaster goes live
• Anyone who opts in on a private repo gets X premium requests per day for that repo. You want the data? Provide some tangible benefit

If you want the real power move:

• Make everything opt-in by default
• Anyone who opts-in gets X free premium requests per month
• For the first 2-3 months, opting in is invite only
• For the next 2-3 months, anyone can request an opt-in, but they're waitlisted
• Eventually "allow" everyone to opt-in, or announce that it was a tough sell, but you've finally got buy in from the business to "allow" giving everyone access to the 5 premium requests a day (or 10 a week or whatever) and you're rolling it out by default (effectively making this opt-out by default). You go from "here's an incredibly unpopular decision that everyone is going to hate" to "twitter is blowing up because everyone wants an invite and customers can't wait to opt-in"

Add restrictions around X requests per month at the account level, I can't design the whole thing for you. But whatever you do, you're gonna want to get started before this really blows up. Which it will.

The free premium requests if you opt-in are great but I don’t think Microsoft is going to do that tbh. But at this point if they’re not doing something everyone will just turn it off.

[trusktr]

Copilot is licensed at the individual account level, and can even work when you are not connected to any repo.

How exactly do you not train on the private code of a paid org when the user has cloned the repo locally and is using local Copilot (f.e. in VS Code) and they may be attaching local files for context? This is distinct from running Copilot directly on GitHub within a repo.

[Lzh913]

怎么安装?

[anroots-pm]

 > How exactly do you not train on the private code of a paid org when the user has cloned the repo locally
 
 I'm also interested in an explicit answer to this, as I can't see a statement about it. Usage on github dot com is clear - won't be trained on if the user is a member of a paid org. What if the user opens an enterprise-owned codebase in development laptop in VS Code, and interacts with Copilot?

[mba821004-tech]

https://github.com/orgs/community/discussions/188488#discussion-9562137

[eriklharper]

If training on user code is so obviously beneficial, why does every company try to hide it behind toggles, footnotes, or tiered pricing instead of proudly asking for consent?

The way to "proudly ask for consent" would be to require the user to opt-in instead of notifying them that this feature will be turned on at a future date, and thus requiring them to opt-out instead.

[jclicky]

+1 for codeberg since I’m NOT down to be a free in-kind co-pilot AI engineering researcher simply because I’m hosting my code on GitHub.

I thought private repos were protected (they weren’t) + if I hadn’t used co-pilot’s trash products (I don’t) then I’d be safe.

I’m just some idiot amateur trying to build some interesting stuff, my shit stinks like everybody else.

But no enshittification stinks worse then seeing the alert modal today, realizing I should check, and seeing that copilot was active in my shit only because it persisted & infected all my repos on the pretext that way back when I was testing copilot out on a few repos back in 2024 I should be auto-enabled to let GitHub steal my shit.

How do I file to have my IP deleted from your data stores now that I’m planning to move all my version control to places that don’t entrap me to fix their lack of AI talent by stealing from everyone’s code GitHub?

so sad to see this place getting destroyed by the idiot robber barons.

[TimexPeachtree]

so sad to see this place getting destroyed by the idiot robber barons.

Off-topic but do watch the film Pirates of Silicon Valley. Your Quote is so on Point. 🤣

[alhwaryasmh-cell]

https://github.com/subprocessors

[alhwaryasmh-cell]

ASMAH SAAD

[alhwaryasmh-cell]

ASMAH SAAD

[zottelbeyer]

This is not okay. Let users opt in an please let this AI fad die.

[JessMTermini]

You have contributed 5 times in the last 4 years. Why do you care?

@jmac122 Are you not aware that you can turn off showing personal contributions to private repositories? Just because - you - can only see 5 contributions from that person in the last year, does not mean that is the only contributions that person has made lol.. what a ridiculous comment to make.

[kinduff]

At least offer a discount if we opting to benefit the models you sell.

[Pr0methean]

Or better yet for no-budget open-source projects, an amount of extra free-tier usage commensurate with what we're contributing this way.

[eapostol]

Does one think that Microsoft actually looks at these discussions? one can only hope.

[gablilli]

last announcements for copilot were horrible guys, just delete it to make us a favour if you continue like this

[zoliidev]

Thank you microslop, I hope you will train your shitty model with this comment :)

[tehabe]

And still no ability to completely disable Copilot

[andrewkarch]

VS Codium is a MicroSlop / Copilot free VS Code.

[juan-octoco]

Agreed, been using vscodium for over a year now

[tehabe]

VS Codium is a MicroSlop / Copilot free VS Code.

Still a browser with a bad editor. I would rather use edit than that.

[Ste1io]

The fact that they don't maintain an official "vanilla" VSCode fork maintained alongside their broken AI IDE experiment is something I'll never understand. They would dominate the market share, locked in. And no reason for users to bitch about shoving AI down people's throats: just use the vanilla build. Increased user satisfaction from both sides of the fence, higher adoption rate for the AI version, and a more secure ecosystem through extension marketplace. But clearly Microsoft is too short sighted to realize that.

[marisloading]

As a new user to GitHub (sorta), I'm floored by this information. Can a mere person escape all this??? How do I opt out of all this? I think I've disabled most features Copilot has in my settings, but some say "Enabled", and I don't know how to turn them off.

I hate this timeline, thanks.

[Ste1io]

Settings > Copilot > Features. Scroll to very bottom of page. If you previously disabled it, the option will already be disabled, no further action needed:

---

[bentalexanderhaase]

Settings > Copilot > Features. Scroll to very bottom of page. If you previously disabled it, the option will already be disabled, no further action needed:

Had to scroll way too far to find a simple, straightforward guide for disabling this. Their FAQ and documentation are packed with management fluff and walls of text — yet somehow a plain "click here to opt out" in the banner was too much to ask for. Thank you @Ste1io! 🎉

[gu3st]

it's hard to opt out because they want it to be. dark pattern hoping people are too lazy or busy to figure it out.

[yharima]

Thank you @Ste1io!
However, I can't find the model training opt-out setting at the bottom of https://github.com/settings/copilot/features — the Privacy section only shows "Suggestions matching public code".

Is the setting hidden if I've already opted out previously? Or has it not been rolled out yet?

[Ste1io]

It's rolled out as of the announcement, so awhile now. Copilot through an org or enterprise might hide it differently in their own unique ways just for kicks, but can only speak for individual pro accounts. You are on a paid plan, right?

[ghost]

[JessMTermini]

jmac122

Yeah real freedom lover right here folks lol
Think you need to change your personal tagline to something a little more...truthful perhaps?

[Kun0913]

Don't worry, you don't need to opt out.

you are being so rude. learn how to talk first before going online.

[runner18]

In fairness, jmac's screenshot only shows contributions from 2026. Buchhla had contributions in 2024, 2023, 2022, 2021, 2019, 2017, 2016, etc.

[ghost]

Ad hominem attacks that ignore the actual issue, got to love the internet. All my current work lives under an EMU account on the enterprise github at work, I have not really used this account in many years, but I actually couldn't post to this using my work account.

[annsek]

@jmac122 Fuck off already.

[burnhamup]

Dark pattern to not actually link to the page to update your settings in the email with instructions to disable it.

[inakarmacoma]

settings are also not present in the Android App...

"as transparent as we can be" eh?

[phette23]

I don't see this setting on the website...

[reubot]

https://github.com/settings/copilot/features

[IrregularShed]

@reubot doing what GitHub couldn't be bothered to do

[eriklharper]

All settings on a page should be hashtagged too so that when you click a link with the hashtag reference it will auto-scroll right to the heading for said setting.

[palapapa]

All these data and you still can't add a search feature to VSCode Copilot Chat
microsoft/vscode#259374

[IdfbAn]

• If your AI needs real user code to be competitive, isn’t that an admission that your advantage comes from exploiting your existing user base rather than better research?

  • 26 million developers are now using GitHub Copilot, representing a huge range of use cases and needs. We want to deliver an exceptional experience for every user, which is why we’re giving users the option of allowing us to use their usage data to improve Copilot’s ability to perform a more diverse range of coding tasks.

Unless I'm not getting something, this is a complete and utter nothing burger of an answer. How does this address the question at all?

[marisloading]

Wait till you find out they most likely asked Copilot to answer these...

[kinduff]

From Copilot itself:

[marisloading]

From Copilot itself:

Your answer is as equally disappointing.

[kinduff]

@marisloading They should've run their models in their own FAQ lol we've come full circle now

[fiammara]

At first please fix your bug..I cannot use my free quota, it does not reset.

[mattwhitlock]

Just because the whole industry is doing opt-in by default doesn't make it less shitty.

[era-epoch]

missing Q: Why would anyone trust anything Microsoft says when the punishments for corpos violating user data privacy are nonexistent?

[icm4]

What if iknow nothing in code writing?

[sssm1990]

问ai让他变成你的员工

[berzbub]

Hey

[kelo9665-debug]

Tokopedia menyediakan layanan WhatsApp? Untuk menghubungi layanan Tokopedia melalui (WA)62.0813+7072+274-) kamu bisa mengikut

[kelo9665-debug]

Ya Tokopedia menyediakan layanan WhatsApp? Untuk menghubungi layanan Tokopedia melalui (WA)62.0813+7072+274-) kamu bisa mengikut

[kelo9665-debug]

Ya Untuk layanan Tokopedia menyediakan layanan WhatsApp? Untuk menghubungi layanan Tokopedia melalui (WA)62.0813+7072+274-) kamu bisa mengikut

[icm4]

Ya Untuk layanan Tokopedia menyediakan layanan WhatsApp? Untuk menghubungi layanan Tokopedia melalui (WA)62.0813+7072+274-) kamu bisa mengikut

Sorry just wake up 😴 from sleep and now preparing to go to work...may i answer you later? 🙏

[ghost]

Die vorrübergehende Abschaltung der Upgradefunktion für kostenlose GithubCopilot ist totale Scheisse - Weg über Unternehmenserstellung viel zu kompliziert und auch nicht was ich brauche - Ich benötige nur die Copilotfunktion und nicht den ganzen andere nKäse weil ich einen eigenen server nutze

[mtlgroupmarcel-maker]

• 

• [ ]

[alhwaryasmh-cell]

تفعيل الكارت ممكن في مصر

[alhwaryasmh-cell]

ASM

[essicajaybarron-stack]

Firefox.-.Feb.20.2026.at.12.48.AM.pdf
The first one is a bit more complicated than the other one, but @jsh139

Do you want a summary of that page, specific information pulled from it, or something else (e.g., list clients, extract contact details, convert to notes)?

[alhwaryasmh-cell]

ASMAH SAAD

[essicajaybarron-stack]

Firefox.-.Feb.20.2026.at.12.48.AM.pdf
The first one is a bit more complicated than the other one, but @jsh139

Do you want a summary of that page, specific information pulled from it, or something else (e.g., list clients, extract contact details, convert to notes)?

**** The first one is a little more complicated than the second one 1️⃣

[essicajaybarron-stack]

The first one is the best one ever 1️⃣🫛🫛✡️🥸🌻🥰🗺️ https://www.perplexity.ai/search/9d1e2766-04a8-4064-b7c4-e0cc63389959#1

[Ronald1289l]

Hello GitHub Community👋

We’re sharing an update to our Privacy Statement and Terms of Service about how we use personal data to develop, improve, and secure GitHub products and services, including training AI and machine learning models that power GitHub Copilot.

For the full announcement and complete details, please visit the blog post: Updates to GitHub Copilot interaction data usage policy.

Frequently Asked Questions

Below is an FAQ covering what’s changing, who’s affected, what data may be used (when enabled), safeguards, and opt-out instructions.

• Why is GitHub making this change and when will it go into effect?

  • We’re making this change to improve model performance and deliver a better user experience. As Copilot usage continues to increase dramatically, real-world data will help our models cover the increasing number of scenarios they’re now being used for. The change goes into effect on April 24. Users received 30 days advance notice and can opt out at any time.

• Why are you only using data from individuals while excluding businesses and enterprises?

  • Our agreements with Business and Enterprise customers prohibit using their Copilot interaction data for model training, and we honor those commitments. Individual users on Free, Pro, and Pro+ plans have control over their data and can opt out at any time.

• Are students and teachers that access Copilot Pro for free affected by this update?

  • No, under our policy, students that have access to Copilot Student and teachers that access Copilot Pro for free are not affected.

• What data are you collecting?

  • When an individual user has this setting enabled, the interaction data we may collect includes:

    • Outputs accepted or modified by the user
    • Inputs sent to GitHub Copilot, including code snippets shown to the model
    • Code context surrounding the user’s cursor position
    • Comment and documentation that the user wrote
    • File names, repository structure, and navigation patterns
    • Interactions with Copilot features including Chat and inline suggestions

• What can individuals do if they don’t want their inputs, outputs, or code snippets, used for model training?

  • They can opt out via their GitHub Copilot account settings at any time.

• Who will have access to this data outside of GitHub?

  • GitHub and Microsoft personnel working on AI model development may access interaction data collected for training. We may also engage service providers to assist with model training on our behalf, subject to contractual obligations to use the data only for providing services to GitHub. Third-party model providers do not receive this data for their own model training. We do not sell user data. For more information on how we handle your data, see our Privacy Statement.

• What is a "GitHub affiliate" and who does that include?

  • A GitHub affiliate is a company that is part of the same corporate family as GitHub — meaning any entity that controls, is controlled by, or is under common control with GitHub. Today, that primarily means Microsoft Corporation and its subsidiaries. You can review Microsoft's privacy practices in the Microsoft Privacy Statement.

  Companies that provide AI models or other services to GitHub — such as model providers, cloud hosting vendors, and other service providers — are not affiliates. They are service providers or subprocessors, and they are bound by contractual obligations that restrict how they can use your data. Specifically, service providers and subprocessors may only process your data on GitHub's behalf and at GitHub's direction — they do not receive your data for their own independent purposes, including their own model training. You can see GitHub's current list of subprocessors here.
  In short: affiliates are part of our corporate family. Service providers work for us under contract. These are distinct relationships with different rights and obligations.

• How do you protect sensitive data?

  • We’ve implemented multiple layers of protection for sensitive data including automated filtering designed to detect and remove API keys, passwords, tokens, and personally identifiable information. We also provide user controls for which repositories Copilot can access. We limit data access to authorized personnel working directly on model improvement and safety, and log and audit access.

• Do I need to do anything if I previously disabled the setting titled "Enabling or disabling prompt and suggestion collection"?

  • No, if you previously disabled that setting your preference will carry over and your interaction data will not be used for model training.

• Will code stored in private repositories be used for model training?

  • If a Copilot user has their settings set to enable model training on their interaction data, code snippets from private repositories can be collected and used for model training while the user is actively engaged with Copilot while working in that repository. This applies only to code snippets and outputs that are actively sent to Copilot during a user's session — we do not access or pull code from private repositories at rest. To prevent code snippets shared with Copilot during active sessions from being used for model training, users can disable model training in their GitHub account settings.

• What safeguards are in place to prevent enterprise code being used for model training due to an individual using a personal Copilot license while working in their employer’s codebase?

  • We do not train on the contents from any paid organization’s repos, regardless of whether a user is working in that repo with a Copilot Free, Pro, or Pro+ subscription. If a user’s GitHub account is a member of or outside collaborator with a paid organization, we exclude their interaction data from model training.

• Other companies aren’t using user data to train models. Why is GitHub?

  • We’re giving users the option of allowing us to train AI models with their interaction data because internal testing shows it will improve the accuracy of Copilot’s suggestions for all users. We can only speak on behalf of GitHub, but it’s worth noting this is similar to the approach that Microsoft,  Anthropic, and JetBrains are taking.

• You’re collecting code snippets, prompt text, AI responses, and detailed interaction patterns. How is this not giving you my entire codebase?

  • We’re collecting data only from your interactions with Copilot—we are not pulling any data from your codebase at rest.

• Security researchers found that Copilot Chat could expose private code from repositories that were temporarily public then set back to private. Why should we trust your guarantees about protecting our data?

  • We take the security of your data seriously and continue to invest in safeguards. The scenario described involved third-party collection of temporarily public data, which is outside GitHub's control. For data collected under this new program, we apply access controls, audit logging, and automated filtering to protect your code.

• I selected Copilot because GitHub said it didn’t train on user data. This feels like a bait and switch.

  • As Copilot usage continues to increase dramatically, we’ve identified a need for real-world data to help our models cover the increasing number of scenarios they’re now being used for. We are committed to giving developers control over whether their interaction data is used for training and will always be transparent about our use of this data.

• If this data collection is truly safe, why don’t you enable it by default for enterprise customers as well?

  • Our agreements with Business and Enterprise customers prohibit using their Copilot interaction data for model training, and we honor those commitments. That said, we use Microsoft interaction data for model training, with plans to incorporate GitHub interaction data, and are very confident in our ability to protect data used for model training.

• If your AI needs real user code to be competitive, isn’t that an admission that your advantage comes from exploiting your existing user base rather than better research?

  • 26 million developers are now using GitHub Copilot, representing a huge range of use cases and needs. We want to deliver an exceptional experience for every user, which is why we’re giving users the option of allowing us to use their usage data to improve Copilot’s ability to perform a more diverse range of coding tasks.

• If training on user code is so obviously beneficial, why does every company try to hide it behind toggles, footnotes, or tiered pricing instead of proudly asking for consent?

  • We can only speak for GitHub, and we are being as transparent as we can be about this change. We are notifying affected users directly, we published a blog post, and we have in-product notifications alerting users of the upcoming changes and directing them to update their user settings per their preferences.

• I noticed the private repository access language was removed from the Privacy Statement. Where did it go?

  • We moved the description of when GitHub personnel may access private repository content from the Privacy Statement to Section E (Private Repositories) of the Terms of Service. This is a consolidation, not a change. The same access limitations that have always applied continue to apply. See the changelog for more details: Updates to our Privacy Statement and Terms of Service: How we use your data.

Join the discussion

Have additional questions or feedback? Please share them in the comments below.

[alhwaryasmh-cell]

ASMAH SAAD

[alhwaryasmh-cell]

ASMAH SAAD

[alhwaryasmh-cell]

ASMAH SAAD

[alhwaryasmh-cell]

#188488 (comment)

[mtlgroupmarcel-maker]

Yes, please!

Pada Jum, 15 Mei 2026, 19.49, اسمه الهواري @.***>
menulis:

#188488 (comment)
https://github.com/orgs/community/discussions/188488#discussioncomment-16912237

—
Reply to this email directly, view it on GitHub
https://github.com/orgs/community/discussions/188488#discussioncomment-16930407,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/CBM7S64X4J5B3FCAOYCIE6D424G5PAVCNFSM6AAAAACWEXUUNOVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTMOJTGA2DANY
.
Triage notifications on the go with GitHub Mobile for iOS
https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675
or Android
https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

You are receiving this because you are subscribed to this thread.Message
ID: @.***
com>

API Versions

Learn how to specify which REST API version to use whenever you make a request to the REST API.

About API versioning

The GitHub REST API is versioned. The API version name is based on the date when the API version was released. For example, the API version 2026-03-10 was released on Tue, 10 Mar 2026.

Breaking changes are changes that can potentially break an integration. Breaking changes will be released in a new API version. We will provide advance notice before releasing breaking changes. Breaking changes include:

• Removing an entire operation
• Removing or renaming a parameter
• Removing or renaming a response field
• Adding a new required parameter
• Making a previously optional parameter required
• Changing the type of a parameter or response field
• Removing enum values
• Adding a new validation rule to an existing parameter
• Changing authentication or authorization requirements

Any additive (non-breaking) changes will be available in all supported API versions. Additive changes are changes that should not break an integration. Additive changes include:

• Adding an operation
• Adding an optional parameter
• Adding an optional request header
• Adding a response field
• Adding a response header
• Adding enum values

When a new REST API version is released, the previous API version will be supported for at least 24 more months following the release of the new API version.

Specifying an API version

You should use the X-GitHub-Api-Version header to specify an API version. For example:

curl --header "X-GitHub-Api-Version:2026-03-10" https://api.github.com/zen

Requests without the X-GitHub-Api-Version header will default to use the 2022-11-28 version.

If you specify an API version that is no longer supported, you will receive a 410 Gone response.

Upgrading to a new API version

Before upgrading to a new REST API version, you should read the changelog of breaking changes for the new API version to understand what breaking changes are included and to learn more about how to upgrade to that specific API version. For more information, see Breaking changes.

When you update your integration to specify the new API version in the X-GitHub-Api-Version header, you'll also need to make any changes required for your integration to work with the new API version.

Once your integration is updated, test your integration to verify that it works with the new API version.

API version closing down

API versions are supported for 24 months after a newer API version is released.

While a version is within its support window but approaching closing down, GitHub includes the following headers in API responses to help you prepare for migration:

• Deprecation — The date when the API version will be closing down, formatted as an HTTP date per RFC 7231. For example: Wed, 27 Nov 2019 14:34:29 GMT.
• Sunset — The date when the API version will be completely removed (retired), after which requests will return a 410 Gone response. Follows RFC 8594. For example: Fri, 27 Nov 2020 14:34:29 GMT.

After the support window ends:

• Requests that specify a closing down API version receive a 410 Gone response.
• Requests that do not specify an API version default to the next oldest supported version, not the closing down version. If you rely on unversioned requests, you may observe behavioral changes as older versions are removed from support.

For more information on migrating to a newer API version, see Breaking changes.

Exceptions to standard versioning

In rare cases, GitHub may make changes outside the normal API versioning cadence. These are exceptional interventions that do not alter the standard versioning guarantees for most integrators.

Security, availability, and reliability issues

Critical security vulnerabilities, data exposure risks, or severe reliability issues may require changes outside the normal release schedule. GitHub may release an unscheduled API version, backport fixes to supported versions, or in rare cases, introduce a breaking change to an existing version to protect users and platform integrity.

GitHub will communicate such changes through release notes, changelogs, and direct communication explaining what changed and why. Where feasible, advance notice will be provided. Immediate action may be taken without advance notice when required.

Low-usage services

For certain services with very low usage, GitHub may deprecate functionality outside the standard versioning process. In these cases, GitHub will communicate the intent and reach out to affected integrators directly.

Supported API versions

The following REST API versions are currently supported.

API version	End of support date
2026-03-10	Not yet scheduled
2022-11-28	Not yet scheduled

You can also make an API request to get all of the supported API versions. For more information, see REST API endpoints for meta data.

[gclarkbrown]

Opt out is obfuscated, of course. Typical microslop nonsense. Blog says it's in settings under privacy, but no such category exists. Also, no search in settings. In there somewhere hidden for profit. If the service is free, your privacy is the product

[mtlgroupmarcel-maker]

[mtlgroupmarcel-maker]

• # Gemini API Additional Terms of Service

Effective March 23, 2026

To use Gemini API,
Google AI Studio, and the other Google developer
services that reference these terms (collectively, the "APIs " or
"Services "), you must accept (1) the
Google APIs Terms of Service
(the "API Terms "), and (2) these Gemini API Additional Terms of Service (the
"Additional Terms"). Terms that are not defined in these Additional Terms
have the meanings given in the API Terms.

Age Requirements

You must be 18 years of age or older to use the APIs. You also will not use the
Services as part of a website, application, or other service (collectively,
"API Clients") that is directed towards or is likely to be accessed by
individuals under the age of 18.

Use Restrictions

Use of Google AI Studio and Gemini API is for developers building with Google AI
models for professional or business purposes, not for consumer use.

You may only access the Services (or make API Clients available to users) within
an available region. You may use
only Paid Services when making API Clients available to users in the European
Economic Area, Switzerland, or the United Kingdom.

You may not use the Services to develop models that compete with the Services
(e.g., Gemini API or Google AI Studio). You also may not attempt to reverse
engineer, extract or replicate any component of the Services, including the
underlying data or models (e.g., parameter weights).

In addition to the
"API Prohibitions"
section in the API Terms, you must comply with our
Prohibited Use Policy,
which provides additional details about appropriate conduct when using the
Services.

The Services include safety features to block harmful content, such as content
that violates our
Prohibited Use Policy.
You may not attempt to bypass these protective measures or use content that
violates the API Terms or these Additional Terms. You are responsible for
determining the necessary and appropriate safety settings
and factuality tools for your use case. Applications with less restrictive
safety settings may be subject to Google's review and approval.

You may not use the Services in clinical practice, to provide medical advice, or
in any manner that is overseen by or requires clearance or approval from a
medical device regulatory agency.

Use of Generated Content

Some of our Services allow you to generate original content. Google won't claim
ownership over that content. You acknowledge that Google may generate the same
or similar content for others and that we reserve all rights to do so.

As required by the API Terms, you'll comply with applicable law in using
generated content, which may require the provision of
attribution to your
users when returned as part of an API call. Use discretion before relying on
generated content,
including code. You're responsible for
your use of generated content, and for the use of that content by anyone you
share it with.

Unpaid Services

Any Services that are offered free
of charge like direct interactions with Google AI Studio or unpaid quota in
Gemini API are unpaid Services (the "Unpaid Services").

How Google Uses Your Data

When you use Unpaid Services, including, for example, Google AI Studio and the
unpaid quota on Gemini API, Google uses the content you submit to the Services
and any generated responses to provide, improve, and develop Google products and
services and machine learning technologies, including Google's enterprise
features, products, and services, consistent with our
Privacy Policy.

To help with quality and improve our products, human reviewers may read,
annotate, and process your API input and output. Google takes steps to protect
your privacy as part of this process. This includes disconnecting this data from
your Google Account, API key, and Cloud project before reviewers see or annotate
it. Do not submit sensitive, confidential, or personal information to the
Unpaid Services.

The license you grant to Google under the
"Submission of Content"
section in the API Terms also extends, to the extent required under applicable
law for our use, to any content (e.g., prompts, including associated system
instructions, cached content, and files such as images, videos, or documents)
you submit to the Services and to any generated responses.

Google only uses content that you import or upload to our model tuning feature
for that express purpose. Tuning content may be retained in connection with your
tuned models for purposes of re-tuning when supported models change. When you
delete a tuned model, the related tuning content is also deleted.

If you're in the European Economic Area, Switzerland, or the United Kingdom, the
terms under "How Google uses Your Data" in
"Paid Services" apply to all Services, including Google AI
Studio and unpaid quota in the Gemini API, even though they are offered free of
charge.

Paid Services

When a Service is being offered for a fee, it is considered to be a paid Service
(the "Paid Services "). Your access to Google AI Studio is a "Paid Service"
even when it is offered free of charge, as long as the account you are using to
access Google AI Studio has access to a Cloud Project with an associated and
active Cloud Billing account
or is a Workspace enterprise account.
Your access to Gemini API is a "Paid Service" only when accessing the API
through a Cloud Project associated with an active billing account.

For Paid Services, "Google" as used in these
Terms has the meaning given
here.

How Google Uses Your Data

When you use Paid Services, including, for example, the paid quota of the Gemini
API, Google doesn't use your prompts (including associated system instructions,
cached content, and files such as images, videos, or documents) or responses to
improve our products, and will process your prompts and responses in accordance
with the
Data Processing Addendum for Products Where Google is a Data Processor.
For Paid Services, Google logs prompts and responses for a limited period of
time, solely for detecting and preventing violations of the
Prohibited Use Policy
to maintain the safety and security of the Services, and any required legal or
regulatory disclosures. This data may be stored
transiently or cached in any country in which Google or its agents maintain
facilities.

Other data we collect while providing the Paid Services to you, such as account
information and settings, billing history, direct communications and feedback,
and usage details (e.g., information about usage including token count per
prompt and response, operational status, safety filter triggers, software errors
and crash reports, authentication details, quality and performance metrics, and
other technical details necessary for Google to operate and maintain Services,
which may include device identifiers, identifiers from cookies or tokens, and IP
addresses) remains subject to the
Google Controller-Controller Data Protection Terms
and
Google Privacy Policy referenced in the
API Terms.

When using Grounding with Google Search, additional data is collected and used,
as detailed in the
"Grounding with Google Search" section below.

Payment Terms

Billing and payments for Paid Services are handled by
Cloud Billing in the Google
Cloud Platform.

As such, while these Terms govern your use of the Paid Services, the following
sections of the
Google Cloud Terms of Service as applicable
to the Google Cloud Platform (or "GCP Services" as defined in the Google Cloud
Terms of Service), will govern
payments, invoicing, billing, payment disputes, and related issues pertaining to
the Paid Services, as if the Paid Services were GCP Services for purposes of
those sections:

• Section 2 (Payment Terms);
• Section 14 (Miscellaneous);
• Section 15 (Regional Modifications), as applicable to:
  • Governing Law and Dispute Resolution;
  • Payment, Taxes, and Invoice Disputes;
  • Currency Conversion; and
  • Other Regional Modifications; and
• the Pricing and Billing Terms of the Service Specific Terms at https://cloud.google.com/terms/service-terms, including the Supplemental Paid Credit Terms at https://cloud.google.com/terms/supplemental-paid-credit (the "Supplemental Paid Credit Terms").

"Fees " (as used in the
Google Cloud Terms of Service) for
Paid Services are as specified on our pricing page. Google may make
changes to this pricing from time to time, effective 30 days after they are
posted unless otherwise specified (or in the case of new Paid Services, where
pricing takes effect immediately unless otherwise specified). Your continued
use of the Paid Services constitutes your consent to those changes.

For clarity, these Terms do not govern your
direct use of any Google Cloud Platform service (including those listed on the
Google Cloud Services Summary).

Agentic Services

When using agentic services, including the Computer Use API, you are solely
responsible for the actions and tasks performed by the service, such as
determining whether the service is appropriate for your use case, authorizing
the service's access and connection to data, applications, and systems, and
exercising judgment and supervision when and if the service is used in
production environments. You will not automatically bypass any requests for
human confirmation.

Grounding with Google Search​​

"Grounding with Google Search" is a Service that provides Grounded Results and
Search Suggestions and can be used through Google AI Studio (as an Unpaid
Service), and via Gemini API as a (Paid Service). "Grounded Results" mean
responses that Google generates using the prompt from the end user (or from
you, when using function calling), contextual
information that you may provide (as applicable), and results from Google's
search engine. "Search Suggestions" mean
search suggestions that Google provides with the Grounded Results. If a Grounded
Result is clicked on, separate terms (not these terms) govern the destination
page. If a Search Suggestion is clicked on the
Google Terms of Service govern the
google.com destination page. "Links" are any other means to
fetch web pages (including hyperlinks and URLs), which may be contained in a
Grounded Result or Search Suggestion. Links also include titles or labels
provided with those means to fetch web pages. Excluding your web domain(s), you
will not assert ownership rights in any intellectual property in Search
Suggestions or Links in Grounded Results.

Use Restrictions

• You will only use Grounding with Google Search in an application that is owned and operated by you and will only display the Grounded Results with the associated Search Suggestion(s) to the end user who submitted the prompt.
• You will not, and will not allow your end user or any third party to, cache, frame, syndicate, resell, analyze, train on, or otherwise learn from Grounded Results or Search Suggestions. For clarity, Grounded Results, Search Suggestions, and Links are intended to be used in combination to respond to a given end user prompt and it is a violation of these terms to use Grounding with Google Search to extract or collect one or more of these components for another purpose (for example, using programmatic or automated means to collect Links, using Links to build an index, or using Links to identify destination pages for crawling or scraping).
• You will not, and will not allow your end user or any third party to, copy, store, or implement any click tracking, Link-tracking or other monitoring of Grounded Results or Search Suggestions, except that:
  • You may copy and store, for up to two (2) years, the text of the Grounded Result(s): (1) that were displayed by you only to evaluate and optimize the display of the Grounded Results in your application; (2) in chat history of an end user of your application only for the purpose of allowing that end user to view their chat history; and (3) temporarily for the purpose of resubmitting the text of the Grounded Result in a subsequent prompt that you submit to Google via a function call to obtain a refined or improved Grounded Result to display to the end user, as long as the developer: (i) does not use the interim Grounded Results for any other purpose; (ii) deletes any Grounded Result that is not displayed to the end user once the final Grounded Result is generated; and (iii) displays any associated Search Suggestions or other Links (as applicable) with the final Grounded Result (up to a maximum of 5 Search Suggestions) to the end user.
  • You may copy and store the Grounded Result and Search Suggestions solely for the purpose of and for the minimum time necessary to comply with applicable law or regulations.
  • You may allow end user(s) to copy and store individual Grounded Results that were displayed to them through your application as long as you do not allow Grounded Results to be accessed or collected by automated or programmatic means or to be used to create a database.
  • You may monitor end user interactions with your application interface; however, you will not track whether those interactions were specifically with a given Search Suggestion or Grounded Result (in each case, in whole or in part, including any specific Link).
• Unless permitted by Google in writing, you: (1) will not modify, or intersperse any other content with, the Grounded Results or Search Suggestions; and (2) will not place any interstitial content between any Link or Search Suggestions and the associated destination page, redirect end users away from the destination pages, or minimize, remove, or otherwise inhibit the full and complete display of any destination page.

Data Collection and How Google Uses Your Data

In addition to the general terms above ("How Google Uses Your Data" under
"Unpaid Services" and "Paid Services"),
when using Grounding with Google Search,
Google will store prompts, contextual information that you may provide, and
output for thirty (30) days for the purposes of creating Grounded Results and
Search Suggestions and the stored information can be used for debugging and
testing of systems that support Grounding with Google Search. When using
Grounding with Google Search via paid quota of Gemini API, this processing for
debugging and testing of systems is in accordance with the
Data Processing Addendum for Products Where Google is a Data Processor.

This subsection "Grounding with Google Search" will survive termination of the
Agreement, as applicable.

The
Client Application Guidelines
apply to your use of Grounding with Google Search. For purposes of the Client
Application Guidelines, your applications that are using Grounding with Google
Search are considered Approved Applications.

Grounding with Google Maps

"Grounding with Google Maps" is a Service that provides Google Maps Grounded
Results as a feature of Gemini API. "Google Maps Grounded Results" mean
responses that Google generates using Google Maps Data in response to an end
user initiated prompt. "Google Maps Data" means the content originating from
Google Maps in the Google Maps Grounded Results, including in the output text,
in the metadata of the Google Maps Grounded Results, in the Google Maps Links,
and content accessed through Google Maps Links. "Google Maps Links" mean the
URLs that Google provides in a Google Maps Grounded Result and any titles or
labels provided with those URLs. If Google Maps Links are clicked on, these
separate Google Maps End User Terms
and the Google Privacy Policy govern the
destination page. Google Maps Data in the text of a Google Maps Grounded Result
will be identified via the Google Maps Links. Notwithstanding anything to the
contrary in the Agreement, Google and its content providers retain all rights to
Google Maps Data.

Use restrictions

1. You will only use Grounding with Google Maps in an application that is owned and
   operated by you and will only use Grounding with Google Maps to display the
   Google Maps Grounded Results with the associated Google Maps Links to the
   end user who initiated the prompt. An end user is an individual you permit
   to use your application.

2. You will not modify the Google Maps Grounded Result or intersperse any other
   content with the Google Maps Grounded Result, place any interstitial content
   between the text of the Google Maps Grounded Result and the Google Maps
   Links or the Google Maps Links and the associated destination page, or
   redirect end users away from the destination pages or minimize, remove, or
   otherwise inhibit the full and complete display of any destination page.

3. You will comply with the Documentation for Grounding with Google Maps.

4. You will not, and will not allow your end users or any third party to:

   1. cache or store Google Maps Grounded Results except that you may cache or
      store Google Maps Grounded Results:

      1. for up to ninety (90) days, only to evaluate and optimize the display of the
         Google Maps Grounded Results for your application; or,

      2. in the chat history of an end user in your application for up to six (6)
         months for the purpose of allowing that end user to view their chat history or
         to maintain prior conversation context for that end user within your application
         (Section 4 (a) overrides any cache header);

   2. scrape or export any Google Maps Data;

   3. train on any Google Maps Data; or

   4. distribute or market any Customer Applications in any Prohibited Territory
      as defined in the Documentation.

Data Collection and How Google Uses Your Data

You acknowledge that it is reasonably
necessary for Google to store prompts, contextual information that you may
provide, and generated content for thirty (30) days for the purposes of creating
Google Maps Grounded Results, and since such information is being stored, you
instruct Google that the stored information can be used for debugging and
testing of systems that support Grounding with Google Maps. When using Grounding
with Google Maps via paid quota of Gemini API, this processing for debugging and
testing of systems is in accordance with the Data Processing Addendum for
Products Where Google is a Data
Processor.

This subsection "Grounding with Google Maps" will survive termination of the
Agreement, as applicable.

Hardware Safety

The following additional terms apply to models that can be used to control
robots or other robotic hardware ("Robotics Models").

You acknowledge and agree that the Robotics Models have not been tested with all
makes and models of robotics hardware, and therefore, that the performance and
safety of the Robotics Models in connection with your hardware is not guaranteed
or provided with a warranty of any kind. You therefore agree to operate any
hardware or other products that you may use in connection with the Robotics
Models in a safe manner, and completely at your own risk. The Robotics Models
may act in an unpredictable or unexpected manner when used in connection with
robotics hardware. You therefore agree to use discretion before using the
Robotics Models in a production, commercial, or public environment, and to not
use the Robotics Models for safety-critical applications or work, such as in the
following settings: (i) healthcare, (ii) transportation, or (iii) other areas
where safety protocols are vital, and a malfunction could reasonably foreseeably
lead to death, personal injury, or property damage.

Disclaimers

The Services include experimental technology and may sometimes provide
inaccurate or offensive content that doesn't represent Google's views.

Use discretion before relying on, publishing, or otherwise using content
provided by the Services.

Don't rely on the Services for medical, mental health, legal, financial, or
other professional advice. Any content regarding those topics is provided for
informational purposes only, does not constitute medical diagnosis or treatment,
and is not a substitute for advice from a qualified professional.

Note

Note: Previous versions of these Additional Terms are archived here.

[alhwaryasmh-cell]

ASMAH SAAD

[servetkosem]

WHO BUY MORE ABOUT BTC,ETH,SOL COINS IN BİNANCE MARKET ,NOTIFY ME NAMES PLEASE