FAQ: Privacy Statement update on Copilot data use for model training (Free/Pro/Pro+)

Hello GitHub Community👋

We’re sharing an update to our Privacy Statement and Terms of Service about how we use personal data to develop, improve, and secure GitHub products and services, including training AI and machine learning models that power GitHub Copilot.

For the full announcement and complete details, please visit the blog post: Updates to GitHub Copilot interaction data usage policy.

Frequently Asked Questions

Below is an FAQ covering what’s changing, who’s affected, what data may be used (when enabled), safeguards, and opt-out instructions.

• Why is GitHub making this change and when will it go into effect?

  • We’re making this change to improve model performance and deliver a better user experience. As Copilot usage continues to increase dramatically, real-world data will help our models cover the increasing number of scenarios they’re now being used for. The change goes into effect on April 24. Users received 30 days advance notice and can opt out at any time.

• Why are you only using data from individuals while excluding businesses and enterprises?

  • Our agreements with Business and Enterprise customers prohibit using their Copilot interaction data for model training, and we honor those commitments. Individual users on Free, Pro, and Pro+ plans have control over their data and can opt out at any time.

• Are students and teachers that access Copilot Pro for free affected by this update?

  • No, under our policy, students and teachers that access Copilot Pro for free are not affected.

• What data are you collecting?

  • When an individual user has this setting enabled, the interaction data we may collect includes:
    • Outputs accepted or modified by the user
    • Inputs sent to GitHub Copilot, including code snippets shown to the model
    • Code context surrounding the user’s cursor position
    • Comment and documentation that the user wrote
    • File names, repository structure, and navigation patterns
    • Interactions with Copilot features including Chat and inline suggestions

• What can individuals do if they don’t want their inputs, outputs, or code snippets, used for model training?

  • They can opt out via their GitHub Copilot account settings at any time.

• Who will have access to this data outside of GitHub?

  • GitHub and Microsoft personnel working on AI model development may access interaction data collected for training. We may also engage service providers to assist with model training on our behalf, subject to contractual obligations to use the data only for providing services to GitHub. Third-party model providers do not receive this data for their own model training. We do not sell user data. For more information on how we handle your data, see our Privacy Statement.

• What is a "GitHub affiliate" and who does that include?

  • A GitHub affiliate is a company that is part of the same corporate family as GitHub — meaning any entity that controls, is controlled by, or is under common control with GitHub. Today, that primarily means Microsoft Corporation and its subsidiaries. You can review Microsoft's privacy practices in the Microsoft Privacy Statement.

  Companies that provide AI models or other services to GitHub — such as model providers, cloud hosting vendors, and other service providers — are not affiliates. They are service providers or subprocessors, and they are bound by contractual obligations that restrict how they can use your data. Specifically, service providers and subprocessors may only process your data on GitHub's behalf and at GitHub's direction — they do not receive your data for their own independent purposes, including their own model training. You can see GitHub's current list of subprocessors here.

  In short: affiliates are part of our corporate family. Service providers work for us under contract. These are distinct relationships with different rights and obligations.

• How do you protect sensitive data?

  • We’ve implemented multiple layers of protection for sensitive data including automated filtering designed to detect and remove API keys, passwords, tokens, and personally identifiable information. We also provide user controls for which repositories Copilot can access. We limit data access to authorized personnel working directly on model improvement and safety, and log and audit access.

• Do I need to do anything if I previously disabled the setting titled "Enabling or disabling prompt and suggestion collection"?

  • No, if you previously disabled that setting your preference will carry over and your interaction data will not be used for model training.

• Will code stored in private repositories be used for model training?

  • If a Copilot user has their settings set to enable model training on their interaction data, code snippets from private repositories can be collected and used for model training while the user is actively engaged with Copilot while working in that repository. This applies only to code snippets and outputs that are actively sent to Copilot during a user's session — we do not access or pull code from private repositories at rest. To prevent code snippets shared with Copilot during active sessions from being used for model training, users can disable model training in their GitHub account settings.

• What safeguards are in place to prevent enterprise code being used for model training due to an individual using a personal Copilot license while working in their employer’s codebase?

  • We do not train on the contents from any paid organization’s repos, regardless of whether a user is working in that repo with a Copilot Free, Pro, or Pro+ subscription. If a user’s GitHub account is a member of or outside collaborator with a paid organization, we exclude their interaction data from model training.

• Other companies aren’t using user data to train models. Why is GitHub?

  • We’re giving users the option of allowing us to train AI models with their interaction data because internal testing shows it will improve the accuracy of Copilot’s suggestions for all users. We can only speak on behalf of GitHub, but it’s worth noting this is similar to the approach that Microsoft,  Anthropic, and JetBrains are taking.

• You’re collecting code snippets, prompt text, AI responses, and detailed interaction patterns. How is this not giving you my entire codebase?

  • We’re collecting data only from your interactions with Copilot—we are not pulling any data from your codebase at rest.

• Security researchers found that Copilot Chat could expose private code from repositories that were temporarily public then set back to private. Why should we trust your guarantees about protecting our data?

  • We take the security of your data seriously and continue to invest in safeguards. The scenario described involved third-party collection of temporarily public data, which is outside GitHub's control. For data collected under this new program, we apply access controls, audit logging, and automated filtering to protect your code.

• I selected Copilot because GitHub said it didn’t train on user data. This feels like a bait and switch.

  • As Copilot usage continues to increase dramatically, we’ve identified a need for real-world data to help our models cover the increasing number of scenarios they’re now being used for. We are committed to giving developers control over whether their interaction data is used for training and will always be transparent about our use of this data.

• If this data collection is truly safe, why don’t you enable it by default for enterprise customers as well?

  • Our agreements with Business and Enterprise customers prohibit using their Copilot interaction data for model training, and we honor those commitments. That said, we use Microsoft interaction data for model training, with plans to incorporate GitHub interaction data, and are very confident in our ability to protect data used for model training.

• If your AI needs real user code to be competitive, isn’t that an admission that your advantage comes from exploiting your existing user base rather than better research?

  • 26 million developers are now using GitHub Copilot, representing a huge range of use cases and needs. We want to deliver an exceptional experience for every user, which is why we’re giving users the option of allowing us to use their usage data to improve Copilot’s ability to perform a more diverse range of coding tasks.

• If training on user code is so obviously beneficial, why does every company try to hide it behind toggles, footnotes, or tiered pricing instead of proudly asking for consent?

  • We can only speak for GitHub, and we are being as transparent as we can be about this change. We are notifying affected users directly, we published a blog post, and we have in-product notifications alerting users of the upcoming changes and directing them to update their user settings per their preferences.

• I noticed the private repository access language was removed from the Privacy Statement. Where did it go?

  • We moved the description of when GitHub personnel may access private repository content from the Privacy Statement to Section E (Private Repositories) of the Terms of Service. This is a consolidation, not a change. The same access limitations that have always applied continue to apply. See the changelog for more details: Updates to our Privacy Statement and Terms of Service: How we use your data.

Join the discussion

Have additional questions or feedback? Please share them in the comments below.

[Xefreh]

Why not let people choose per project if they want to opt out?

[HappyTepid]

Just a convenient side effect of the “simple setting” that it prevents the owner of a repo from opting out of having their work exploited for microslop’s benefit?

[Choms]

@martinwoodward poor excuse when the post literally says that the enterprise enforcement is repository-level even when the user has a free or personal sub...

you can 100% enforce it but would loss on a lot of data (same as if you did this opt-in)

[brandon-fryslie]

Hadn't thought of it but it's a good idea to give the option. I would enable it on some of my repos but won't enable it for all.

And I would recommend taking a page from OpenAI's book, and giving out tokens. They give you something like 1 million tokens per day for free on projects where you enable them to use your data. That take it from "I'm paying you to give you my data? Really?" to "Sign me right up!" And to be clear: what they allow is for you to enable on a per-project/per-api-token basis, to opt-in to data collection. Anything you use that API Token for is fair game for them to use the data, and you also get some free tokens each day when using that API Token.

this is a far better tradeoff than "one toggle per account". It's just too big of a hammer to give users no options like this and if you're not already planning the work to fix it, you will be soon, I believe. If someone is a contractor w/ private repos who also does some personal projects, the choices are "risk exposing customer data, likely in breach of their own contracts", "disable data collection and double check that every day and still worry about it" (and you're not even able to collect data that they might not care about), or "find a different provider than GitHub so they can feel safe".

I'm fine with Opt-Out as a concept, because 90% of people never change default settings. But making this opt-out by default even for private repos is going to cause intense blowback to the point where I wouldn't be surprised to see adoption of GitHub Copilot stall or reverse. I'm not going to say this was poorly thought out, because there are a lot of moving parts. I understand that. But I think on the point of "we're going to make it easy by shipping an MVP with an account level toggle and iterate on customer feedback" you guys grossly misjudged how the community is going to react to this, how much non-enterprise users really depend on copilot as a core part of their workflow, how much data you'll actually get from this, and overall how successful this "yolo" approach will really be.

It's a stumble, you (Github) needs to recognize that, but you can recover. Here's what I see as the right path:

• Opt-out for public repos by default
• Opt-in for private repos by default
• Repo level toggle would be smart, but I don't think it's strictly necessary. Personally, I will only opt-in on a repo basis. I think you'll get more data if people can toggle by repo
• Apologize for the botched rollout and fix these problems before this pending disaster goes live
• Anyone who opts in on a private repo gets X premium requests per day for that repo. You want the data? Provide some tangible benefit

If you want the real power move:

• Make everything opt-in by default
• Anyone who opts-in gets X free premium requests per month
• For the first 2-3 months, opting in is invite only
• For the next 2-3 months, anyone can request an opt-in, but they're waitlisted
• Eventually "allow" everyone to opt-in, or announce that it was a tough sell, but you've finally got buy in from the business to "allow" giving everyone access to the 5 premium requests a day (or 10 a week or whatever) and you're rolling it out by default (effectively making this opt-out by default). You go from "here's an incredibly unpopular decision that everyone is going to hate" to "twitter is blowing up because everyone wants an invite and customers can't wait to opt-in"

Add restrictions around X requests per month at the account level, I can't design the whole thing for you. But whatever you do, you're gonna want to get started before this really blows up. Which it will.

[without-ordinary]

If it was a repo flag, then it would be possible to fix the forking exploit to circumvent the opt-out.

I personally have no issue with my trash code being used for training of open AI models, but Copilot and other closed model providers contributors little to nothing back to FOSS AI. The horribly forced "integrations" of Copilot alone are enough to make me want to actively hinder it.

[Xefreh]

Hadn't thought of it but it's a good idea to give the option. I would enable it on some of my repos but won't enable it for all.

And I would recommend taking a page from OpenAI's book, and giving out tokens. They give you something like 1 million tokens per day for free on projects where you enable them to use your data. That take it from "I'm paying you to give you my data? Really?" to "Sign me right up!" And to be clear: what they allow is for you to enable on a per-project/per-api-token basis, to opt-in to data collection. Anything you use that API Token for is fair game for them to use the data, and you also get some free tokens each day when using that API Token.

this is a far better tradeoff than "one toggle per account". It's just too big of a hammer to give users no options like this and if you're not already planning the work to fix it, you will be soon, I believe. If someone is a contractor w/ private repos who also does some personal projects, the choices are "risk exposing customer data, likely in breach of their own contracts", "disable data collection and double check that every day and still worry about it" (and you're not even able to collect data that they might not care about), or "find a different provider than GitHub so they can feel safe".

I'm fine with Opt-Out as a concept, because 90% of people never change default settings. But making this opt-out by default even for private repos is going to cause intense blowback to the point where I wouldn't be surprised to see adoption of GitHub Copilot stall or reverse. I'm not going to say this was poorly thought out, because there are a lot of moving parts. I understand that. But I think on the point of "we're going to make it easy by shipping an MVP with an account level toggle and iterate on customer feedback" you guys grossly misjudged how the community is going to react to this, how much non-enterprise users really depend on copilot as a core part of their workflow, how much data you'll actually get from this, and overall how successful this "yolo" approach will really be.

It's a stumble, you (Github) needs to recognize that, but you can recover. Here's what I see as the right path:

• Opt-out for public repos by default
• Opt-in for private repos by default
• Repo level toggle would be smart, but I don't think it's strictly necessary. Personally, I will only opt-in on a repo basis. I think you'll get more data if people can toggle by repo
• Apologize for the botched rollout and fix these problems before this pending disaster goes live
• Anyone who opts in on a private repo gets X premium requests per day for that repo. You want the data? Provide some tangible benefit

If you want the real power move:

• Make everything opt-in by default
• Anyone who opts-in gets X free premium requests per month
• For the first 2-3 months, opting in is invite only
• For the next 2-3 months, anyone can request an opt-in, but they're waitlisted
• Eventually "allow" everyone to opt-in, or announce that it was a tough sell, but you've finally got buy in from the business to "allow" giving everyone access to the 5 premium requests a day (or 10 a week or whatever) and you're rolling it out by default (effectively making this opt-out by default). You go from "here's an incredibly unpopular decision that everyone is going to hate" to "twitter is blowing up because everyone wants an invite and customers can't wait to opt-in"

Add restrictions around X requests per month at the account level, I can't design the whole thing for you. But whatever you do, you're gonna want to get started before this really blows up. Which it will.

The free premium requests if you opt-in are great but I don’t think Microsoft is going to do that tbh. But at this point if they’re not doing something everyone will just turn it off.

[eriklharper]

If training on user code is so obviously beneficial, why does every company try to hide it behind toggles, footnotes, or tiered pricing instead of proudly asking for consent?

The way to "proudly ask for consent" would be to require the user to opt-in instead of notifying them that this feature will be turned on at a future date, and thus requiring them to opt-out instead.

[o-leary]

If you find good alternatives for GitHub please let me know. I’m so sick of this type of behaviour where consumers are treated as product.

[jmac122]

@fritzmusic man, your 8 contributions are really going to hurt the training model. Please reconsider.

@o-leary please let me where you find a better home for your 17 contributions in the last year.

[o-leary]

@jmac122 first of all it was 36, secondly those do not cover forks where a pull request isn’t made, ie when changes are tested or recommended by other means. I don’t know if private repos are even included. Lastly it doesn’t matter if I’m contributing to projects, I still own whatever personal work I do regardless of size. If you code daily or once a year this affects you and the means in which it is being turned on for everyone is frankly quite ass.

[MeanDoubleStain]

Half the options still show as 'enabled' what does this even mean? Github is like Code City right? Why the sloppy GUI? The e-mail, blog and FAQ are just runarounds.

[ClariNerd617]

If you find good alternatives for GitHub please let me know. I’m so sick of this type of behaviour where consumers are treated as product.

@o-leary Codeberg is pretty good these days.

[zottelbeyer]

This is not okay. Let users opt in an please let this AI fad die.

[jmac122]

You have contributed 5 times in the last 4 years. Why do you care?

[JessMTermini]

You have contributed 5 times in the last 4 years. Why do you care?

@jmac122 Are you not aware that you can turn off showing personal contributions to private repositories? Just because - you - can only see 5 contributions from that person in the last year, does not mean that is the only contributions that person has made lol.. what a ridiculous comment to make.

[kinduff]

At least offer a discount if we opting to benefit the models you sell.

[Pr0methean]

Or better yet for no-budget open-source projects, an amount of extra free-tier usage commensurate with what we're contributing this way.

[gablilli]

last announcements for copilot were horrible guys, just delete it to make us a favour if you continue like this

[zoliidev]

Thank you microslop, I hope you will train your shitty model with this comment :)

[tehabe]

And still no ability to completely disable Copilot

[andrewkarch]

VS Codium is a MicroSlop / Copilot free VS Code.

[juan-octoco]

Agreed, been using vscodium for over a year now

[tehabe]

VS Codium is a MicroSlop / Copilot free VS Code.

Still a browser with a bad editor. I would rather use edit than that.

[Ste1io]

The fact that they don't maintain an official "vanilla" VSCode fork maintained alongside their broken AI IDE experiment is something I'll never understand. They would dominate the market share, locked in. And no reason for users to bitch about shoving AI down people's throats: just use the vanilla build. Increased user satisfaction from both sides of the fence, higher adoption rate for the AI version, and a more secure ecosystem through extension marketplace. But clearly Microsoft is too short sighted to realize that.

[marisloading]

As a new user to GitHub (sorta), I'm floored by this information. Can a mere person escape all this??? How do I opt out of all this? I think I've disabled most features Copilot has in my settings, but some say "Enabled", and I don't know how to turn them off.

I hate this timeline, thanks.

[gablilli]

@rhyswynne @knutmerket scroll a bit and you'll see, under the privacy section, "Allow GitHub to use my data for AI model training". atleast I have that option.

[kapaweb]

Allow GitHub to use my data for AI model training

What's the URL?

I 've got nothing here.

[Ste1io]

Settings > Copilot > Features. Scroll to very bottom of page. If you previously disabled it, the option will already be disabled, no further action needed:

---

[bentalexanderhaase]

Settings > Copilot > Features. Scroll to very bottom of page. If you previously disabled it, the option will already be disabled, no further action needed:

Had to scroll way too far to find a simple, straightforward guide for disabling this. Their FAQ and documentation are packed with management fluff and walls of text — yet somehow a plain "click here to opt out" in the banner was too much to ask for. Thank you @Ste1io! 🎉

[gu3st]

it's hard to opt out because they want it to be. dark pattern hoping people are too lazy or busy to figure it out.

[ghost]

[JessMTermini]

jmac122

Yeah real freedom lover right here folks lol
Think you need to change your personal tagline to something a little more...truthful perhaps?

[Kun0913]

Don't worry, you don't need to opt out.

you are being so rude. learn how to talk first before going online.

[runner18]

In fairness, jmac's screenshot only shows contributions from 2026. Buchhla had contributions in 2024, 2023, 2022, 2021, 2019, 2017, 2016, etc.

[ghost]

Ad hominem attacks that ignore the actual issue, got to love the internet. All my current work lives under an EMU account on the enterprise github at work, I have not really used this account in many years, but I actually couldn't post to this using my work account.

[annsek]

@jmac122 Fuck off already.

[burnhamup]

Dark pattern to not actually link to the page to update your settings in the email with instructions to disable it.

[inakarmacoma]

settings are also not present in the Android App...

"as transparent as we can be" eh?

[phette23]

I don't see this setting on the website...

[reubot]

https://github.com/settings/copilot/features

[IrregularShed]

@reubot doing what GitHub couldn't be bothered to do

[eriklharper]

All settings on a page should be hashtagged too so that when you click a link with the hashtag reference it will auto-scroll right to the heading for said setting.

[palapapa]

All these data and you still can't add a search feature to VSCode Copilot Chat
microsoft/vscode#259374

[IdfbAn]

• If your AI needs real user code to be competitive, isn’t that an admission that your advantage comes from exploiting your existing user base rather than better research?

  • 26 million developers are now using GitHub Copilot, representing a huge range of use cases and needs. We want to deliver an exceptional experience for every user, which is why we’re giving users the option of allowing us to use their usage data to improve Copilot’s ability to perform a more diverse range of coding tasks.

Unless I'm not getting something, this is a complete and utter nothing burger of an answer. How does this address the question at all?

[marisloading]

Wait till you find out they most likely asked Copilot to answer these...

[kinduff]

From Copilot itself:

[marisloading]

From Copilot itself:

Your answer is as equally disappointing.

[kinduff]

@marisloading They should've run their models in their own FAQ lol we've come full circle now

[fiammara]

At first please fix your bug..I cannot use my free quota, it does not reset.

[mattwhitlock]

Just because the whole industry is doing opt-in by default doesn't make it less shitty.

[era-epoch]

missing Q: Why would anyone trust anything Microsoft says when the punishments for corpos violating user data privacy are nonexistent?

[pdparchitect]

Copilot, or "chat with Copilot" is a button that is available on every page right next to the search bar.

You don't have to be a Copilot user to click on it.

This change is malicious, and it doesn't only affect Copilot users. It affects everyone on the platform!

[aepikgamer-art]

FUCK YOU MICROSLOP IT SHOULD BE OPT IN NOT OPT OUT YOU STUPID FUCKING COMPANY NOBODY WHOS PRIVACY CONSCIOUS WOULD WANT THIS STUPID FEATURE

[gu3st]

If this was something people actually wanted, it would be opt in.

You know that nobody wants to feed the AI beast so you're gambling on for laziness or inactivity to allow you to steal the IP of your user base for the slop machine.

[gu3st]

Further these options should also be able to be disabled. I NEVER wish to use Copilot yet I cannot fully disable it from my account

[urcraft]

Why did you have to enshittify GitHub? So sad.

[rautamiekka]

Fuck you. Truly, fuck you.

[Dennebog]

Thank you for the shoutout :-) and the immense effort also. It cannot be easy to do such good work for such a big organization :-) Context: I signed up for a GitHub trial (GitHub Pro / Copilot), where I was told a small verification charge (~$10) would be momentary and immediately released.

GitHub’s handling of this charge is frankly unacceptable.

This was not a “temporary” hold in any meaningful sense. The authorized amount has now been locked for a week—and can reportedly last up to 30 days—despite being presented as something that would be reversed almost instantly.

GitHub Support claims the refund was processed “right away,” but this is misleading. In practice, GitHub delegates the release of the authorization to a financial intermediary, fully aware that this is not an immediate process. Describing that as “momentary” is simply inaccurate.

After speaking with my bank, the situation is clear: the hold has not been released in a way that makes the funds available. There are only two ways forward—either wait for the authorization to expire (which can take up to 30 days), or have GitHub explicitly confirm to the bank that the hold should be released.

This is the key issue: it should not be the customer’s responsibility to resolve this. If GitHub initiates the authorization, then GitHub should also ensure its timely release—without requiring users to chase their own money through banking procedures.

In practice:

GitHub claims it’s been handled
The funds remain inaccessible
The burden shifts to the user to fix it

For anyone on a tight budget, this is not a minor inconvenience—it directly affects day-to-day expenses.

If GitHub knows these authorizations can persist for weeks, then calling them “momentary” is misleading and should be corrected. Users deserve clear, honest expectations about how long their money may actually be unavailable.

This situation reflects poorly on both the transparency and accountability of GitHub’s billing practices.

[Dennebog]

Also: Github sucks the sweat of a dead man's balls.

[Dennebog]

Just my money back Sendt fra Outlook til iOS<https://aka.ms/o0ukef>

…

________________________________ Fra: JesCiTy ***@***.***> Sendt: Saturday, March 28, 2026 2:10:38 PM Til: community/community ***@***.***> Cc: John Heuser ***@***.***>; Comment ***@***.***> Emne: Re: [community/community] FAQ: Privacy Statement update on Copilot data use for model training (Free/Pro/Pro+) (Discussion #188488) @jmac122<https://github.com/jmac122> Are you ok? Like do you need any help? Some medication maybe? LOL Are you - sane -? — Reply to this email directly, view it on GitHub<#188488?email_source=notifications&email_token=CALBSAD26TKUGMH4AOGAHXT4S7FM5A5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNRTGU3DENBQUZZGKYLTN5XKOY3PNVWWK3TUUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#discussioncomment-16356240>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/CALBSAGLSAUMQ6PNKRHDWTD4S7FM5AVCNFSM6AAAAACWEXUUNOVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTMMZVGYZDIMA>. You are receiving this because you commented.Message ID: ***@***.***>

[Symbai]

Ladies and Gentlemen, wanna know something funny? You can opt-out. And someone just forkes your repo who has not opt-out and AI will get trained on the code YOU have written. Isn't that amazing?!

The way to opt-out is basically just useful for private repos. For public repos its a no-op. Even if you delete your account and your repo, if someone has forked it already it becomes AI training material.

[raj-open]

This appears to be a serious breech of the trust of the user base (both free and paid users). In my understanding, GitHub, Bitbucket, GitLab, etc. are places where developers, academics, researchers, etc.¹ can freely and safely work on their ideas/IP (at minimum in private repositories and bare minimum in the case of paid accounts). By letting their LLMs train on projects worked on by private individuals, startups, etc., Microsoft has made some seriously consider whether it is safe to use GitHub in future.² And by designing the settings to be enabled-by-default, the core human concept of consent (with full awareness of the ramifications) has been clearly compromised here, in my view.³

Finally there's the transitive risk which cannot be avoided, forcing essentially everybody who values their IP to go completely private or move to another provider.¹⁴

Footnotes

1. Git-platforms are not merely used by developers, but also researchers/academics. E.g. if you are an academic and you use something like Overleaf to collaboratively (or privately) work on research papers, GitHub may be used to synchronise the changes in the background. Note further that it is quite common that academics are not experts at using or setting up Git integration correctly, so the probability of having a setting which enables OpenAI/Microsoft to train on your data is not 0. Moreover, even if one oneself is savvy, one may work with another researcher who is not and their settings may be such, that an LLM can train off their and by extension your data on collaborative research. Thus the IP of academic and research work may also be at risk here too. (This underscores why it is important for such changes to always be opt-in without exception.) ↩ ↩²

2. This continual erosion of trust may alternatively be an opportunity for competition (Bitbucket, GitLab, Gitea, etc. and on another level not merely limited to git repositories Google, Apple, etc.) to highlight the increased risk of the approach here and offer alternatives that by default respect and protect the IP of individuals, startups, etc. ↩

3. And as somebody else has pointed out in the comments, it is very difficult to even conceive of a person or company who would use these platforms and knowingly and willingly choose to have their work to be used for training purposes. ↩

4. See previous comments in this thread. ↩

[animas3D]

Wait. I am not a deeply experienced programmer but I am working on an ambitious application over the last six months in Visual Studio with the help of Github CoPilot Pro.

My only question is this: Is my code being viewed and uploaded somewhere so that the algorithms that run how my applications work is viewable by others?

What are they talking about here? Just how we interact with CoPilot, or what we tell it to do and how to do it?

This is unclear to me.

[raj-open]

What are they talking about here? Just how we interact with CoPilot, or what we tell it to do and how to do it?

This is less about our usage of Copilot, and more about how Microsoft plans to let its AI learn from our repositories.

I am working on an ambitious application over the last six months in Visual Studio with the help of Github CoPilot Pro. [...] Is my code being viewed and uploaded somewhere so that the algorithms that run how my applications work is viewable by others?

What you do on an IDE on your local machine is a separate issue. I cannot comment on what Copilot does with that data. The concern here is primarily about what is stored in our repositories (and possibly runs in GitHub actions including possibly environment variables/secrets).

If you navigate to https://github.com/settings/copilot then under Coding agent by default access to All repositories is selected here (I have disabled this):

Then if you navigate to Features the Allow GitHub to use my data for AI model training is enabled by default:

Together this means by default (unless users are aware and opt out) all repositories (including private ones) will be used to train Microsoft's AI. That includes code, documents, etc. As others have pointed out it is also unclear whether the settings of the owner of the repository determines whether Microsoft's AI is allowed to learn from it, or whether the settings of any contributor/collaborator can affect this (e.g. in forks). I.e. it is unclear to what extent our IP is protected even for paid accounts and private work. Imagine for example you work on a paper collaboratively and use GitHub to store the latex/markdown files and your code. If your settings allow it, the Microsoft could learn from your draft work, and their AIs could beat you to the punch and publish your work before you do. Or somebody else using CoPilot could ask it a question that only you have solved, and if it has learnt from your work could betray those answers to somebody else, who will then be enabled to steal your IP. Whilst these are hypothetical scenarios, the way things are moving, Microsoft's general trajectory does not sure up confidence or allow us to innovate, do research, etc. in a way without worrying about the integrity of our intellectual property.

[ClariNerd617]

Seems weird that Microslop is giving us the illusion of free will here.

[DamienStaebler]

So all this to train microslop... Is there another alternative to github? This sucks

[Symbai]

Yes there is it. Gitlab Bitbucket or if you dont trust them doing the same as Github in the future: self hosted Gitea. There might even be shared hosting providers for Gitea. It looks and act like Github and in the web UI you can even migrate all your Github projects. All git history, issues, PRs, wiki etc. are copied.

[ShikoShintaro]

I want a clarification becauss it didnt state in the post

Do public repositories also get trained even if you opted out? If so im ditching it no hesitation the because the reason i use github is to share to other people on my work and now you announce that you will use our work to train your ai thats kinda unfair you know? so i want a clarification on that one

Do our public works get trained?

[DamienStaebler]

Well, supposedly they will not. However it is microslop so the opt in/out option might just be a setting that makes us feel better. I doubt they'll respect it. Imma ditch github and use something else.

[kevcampb]

Absolutely appalling. Github was the one vendor I assumed would not start doing an opt-in by default. We've already had this pulled on us by Figma with their default opt-in for paid accounts.

Please understand our concerns. We have IP in our repos that took years to develop. We cannot have that exposed to models in order to train them. The attitude you are taking on this is not ok. We've now stuck playing whack-a-mole, as you slowly change the settings until a gap appears that leaks our data out.

[LLabmik]

I'd like a bit more granularity on it. On my public repos I don't mind you training on them, but I do not want you training on my chat inputs, as often I have to refer to local resources, internal passwords, etc. So if you split out the permissions to inputs/outputs/etc, then I'll enable everything but inputs. But until I can block inputs, my setting will be opted out.