Does GitHub Copilot use any code from individual users to train GitHub's model (or any successor model)?

[dlindmark]

I have read the FAQ and I think that it is very clear when it comes to Business and Enterprise users. Not as clear when it comes to Pro and free users.

For example Does GitHub Copilot use any of your code to train the GitHub's model (or any successor model)? -> No. GitHub uses neither Copilot Business nor Enterprise data to train the GitHub model. But nothing about free or pro users.

When I look at my own Copilot policies (I am a pro user)

(clicking at that link do not take me to any privacy policy, just to some random doc page)

and reading the copilot documentation here It seems VERY clear that data (such as prompts which could include IP data) is NEVER used to train any AI-model.

However, when reading this article it explicitly says

Copilot for Business also does not use your code to train the Azure OpenAI model

and

GitHub Copilot for Individual users, however, can opt in and explicitly provide consent for their code to be used as training data. User engagement data is used to improve the performance of the Copilot Service; specifically, it’s used to fine-tune ranking, sort algorithms, and craft prompts.

Then it sound like it is possible for individual users to opt-in to for the code (which should mean prompts?) to be used as training data (to train the Azure OpenAI model). Even though copilot documentation says that is never done.

So my question include

• What model is the Azure OpenAI model? Is that the model I choose to chat with? or is it something else?
• As an individual user. Is it at any time possible that github or third parties use prompts or suggestions to train any AI-model?

[abdeliibrahim]

https://docs.github.com/en/copilot/managing-copilot/managing-copilot-as-an-individual-subscriber/managing-copilot-policies-as-an-individual-subscriber#model-training-and-improvements

[dlindmark]

Absolutely. I link to the same section twice in my question. What gets me confused is the contradicting statements from other official github sources.

[znorris]

I just came here looking for the same answers. Why isn't pro listed on the trust page? Why would I receive less privacy protections for being an individual who purchases the same product?

[haiqu91]

I'll be honest, I'm already at the point that I simply don't trust these tools on principle, and the launch of a new license type without comprehensive documentation updates explicitly referring to the new license type feels like GitHub, MS, or both (yes, I know MS owns GH) are attempting to purposefully obfuscate their policies so they have an escape hatch when someone realizes that their local code is, in fact, not being protected.

If our data is being kept private, it should not be difficult to explicitly say so. Since GitHub cannot seem to do that, we have to assume that Copilot is harvesting just as much data from Pro licensees as Free ones. And until the official documentation makes the policy explicit and consistent from document to document, I can only conclude that it is either misleading entirely on purpose, or that GitHub is not run well enough to keep such information accurate.

Either way, it's an unacceptable state of affairs, and genuinely makes me reconsider hosting anything here (not that I have much as it is).

Get it together, GitHub. This is not how such an important pillar in the development world should be run.

[SilverFuzz]

Very important question that requires an answer. If sll code is harvested, the days of credit algorithm invention are over. If you innovate FFT, bubble sort, backprop or some other gamechsnging algorithm, it will be trivially available ho all of humanity with zero cred to the inventor.

[dabockster]

What about filing for your own patent and/or promoting it somewhere super visible? Like on YouTube or Instagram?

I was on the fence about using online AI for a long time. But after hearing how Meta supposedly pirated a bunch of books to train their Llama series of AI models, I realized that you have effectively ZERO control over anything you put online if it's on a system other than your own. Now this doesn't mean you should self-host everything and become a recluse, but it does mean that you need to plan for that loss of control should you choose to use cloud services in general (especially cloud AI). And if you do self-host on your own infra, be prepared to develop blocks or even countermeasures against entities (beyond the obvious stuff like robots.txt) that you don't want to have access to your stuff.

Since I'm not building ACM/IEEE tier algorithms or a massive multi billion dollar company, I came to the conclusion that the benefits outweighed the level of control I'd effectively lose. But that was my own personal decision, and you all will have to make your own decisions as well.

[queenofcorgis]

Hi from GitHub here 👋🏼 ,

As a GitHub Copilot Pro user you can opt-out of having your prompts and suggestions used for AI training. The Managing Copilot doc walks through how to disable that setting.

Also I wanted to call from the doc and confirm this is accurate despite conflicting information you may have seen elsewhere:

By default, GitHub, its affiliates, and third parties will not use your data, including prompts, suggestions, and code snippets, for AI model training. This is reflected in your personal settings for GitHub Copilot and cannot be enabled.

The Azure OpenAI model mentioned in the article is out of date. We now host a variety of models and if you have opted out as a GitHub Copilot Individual user of your prompts being used to train the model, it will apply to all the models that we offer today.

[steinhh]

Paranoid, but:

if you have opted out as a GitHub Copilot Individual user of your prompts being used to train the model, it will apply to all the models that we offer today

It seems you're saying "you cannot opt in" ("...and cannot be enabled") but also "you can opt out".

Is the latter supposed to be about "Allow GitHub to use my data for product improvements", a setting which can be turned off.

[haiqu91]

Paranoid, but:

if you have opted out as a GitHub Copilot Individual user of your prompts being used to train the model, it will apply to all the models that we offer today

It seems you're saying "you cannot opt in" ("...and cannot be enabled") but also "you can opt out".

Is the latter supposed to be about "Allow GitHub to use my data for product improvements", a setting which can be turned off.

The bit that concerns me is "offered today". Those models are already trained; of course our code can't be used to train them. But that statement quite blatantly says nothing about future models, which is where the value of our code would actually be gleaned for them. It's such an obvious omission that it makes the entire privacy policy look even more amateur than it already does. Now why might that be, I wonder?

This isn't complicated; all of these companies stole the data these things run on, and they won't hesitate to steal our code just the same.

[ghost]

"Allow GitHub to use my data for product improvements", a setting which can be turned off.
Good luck if you trust it's turned of until now ! , simply I turned it off from first day then today was checking settings to enable sonnet and found it's suddenly turned on , please check other people too , they are playing games of G even competitors from other country who are not singing day and night about privacy will never do this games ! , please check your setting if you care about your privacy . I will request delete my data NOW and will never trust US tech companies again , switching to local offline is best maybe deepseek

[SomeOne-0o0]

No, GitHub Copilot does not use your private code to train its models (unless you explicitly opted in). As of now, the models like Codex or successors are trained on publicly available data, including public GitHub repos.

If you're using Copilot in a private repo, your code might be used to improve the product, but not for training the underlying model, unless you’ve opted in through your settings.

You can double-check or change that under:
Settings > GitHub Copilot > Data Sharing

Hope that clears it up! 😊 @dlindmark

[rafamerlin]

Could you elaborate on the "improve the product" aspect? Just knowing if we accepted or rejected some suggestion from github or something else besides that?

[nuttyartist]

@SomeOne-0o0 Can you please clarify on "your code might be used to improve the product", what product, in what way? Is there a way to opt-out?

Thanks.

[david-peherstorfer]

There is a checkbox to opt-out of this under: https://github.com/settings/copilot/features
"Allow GitHub to use my data for product improvements"

[ghost]

No, GitHub Copilot does not use your private code to train its models (unless you explicitly opted in).

Good luck if you trust it's turned of until now ! , simply I turned it off from first day then today was checking settings to enable sonnet and found it's suddenly turned on , please check other people too , they are playing games of G even competitors from other country who are not singing day and night about privacy will never do this games ! , please check your setting if you care about your privacy .

[Vaccano]

This page needs an authoritative response from someone who is clearly associated with the project.

Though what is REALLY needed is for the FAQ to be updated to include the Pro and Free versions of the product. (Something official from the product to let me know it is safe to purchase the Pro version or use the free version.)

(Lack of this is stopping GitHub Copilot adoption at my company.)

[haiqu91]

This thread was opened in February and absolutely nothing has changed. It’s absolutely unacceptable but unsurprising giving how much these models have relied on theft to begin with. Appalling.

[ichDaheim]

Well - let me put it this way: the documentation is quite clear about the privacy of business and enterprise users code - every other individual pricing plan is not so direct.

So please assume you are manager on the run to earn billions of dollars with your product and you now 2 things.

1. your product will only earn money if you meet the needs of the companies who are willing to pay (maybe a lot) for it.
2. individuals are weak and have no legal power (or money/will to envorce their rights)

What would be your conclusions if your paycheck on the end of the year is bound to the earnings of the product?

1. Are you being clear and honest about the terms and conditions of your product – and risk losing valuable data to make your product even more valuable to (business) customers?
2. obfuscate the facts as much as possible to earn your bonus and climb the career ladder?

Disclaimer: This is, of course, only a hypothetical consideration. Any similarity to possible reasons given by any existing personalities is purely coincidental and unintentional.

[kyle-chine-leismore]

Another question is:

If I saved my database user and password in some file in my codebase, will this file be uploaded and shared with someone else?

[ichDaheim]

If you are not a business or enterprise user - the answer is most likely: it’s already part of the training data.

[Akash1134]

Hey everyone,

Thanks for raising these privacy concerns. I wanted to provide clarity on where we are based on the feedback in this thread. I see why the documentation has been confusing, there were conflicting statements across different pages.

The clear answer

For GitHub Copilot Pro users: Your code is NOT used to train AI models.

By default, GitHub, its affiliates, and third parties do not use your data (prompts, suggestions, code snippets) for AI model training. This setting cannot be enabled —> it's off and stays off.

Source: Managing Copilot policies

What about the old articles?

The references to "Azure OpenAI model" in older blog posts are outdated. We now support multiple models (Claude, GPT-4, etc.), and the same privacy protection applies to all of them if you're a Pro user.

Product improvements vs. training

There's a separate setting: "Allow GitHub to use my data for product improvements"

This is not about training AI models. It's about things like:

• Whether you accepted or rejected suggestions
• Usage patterns to improve the UI
• Performance metrics

You can turn this off in your settings if you want.

Your private code

If you save passwords or credentials in your code, they're not being sent for training. But we do not recommend committing secrets to repos—use environment variables or secret management tools.

Official resources

• Pro user privacy settings
• Copilot Trust Center
• Privacy statement

Hope this helps.

[bgauchon-reply]

All the topic is effectively about the obfuscation of the policy for the Copilot free that you have by default

[haiqu91]

Whilst this is appreciated, I hope somebody at GitHub understands that it is unacceptable to leave these concerns dangling in the wind for 9 months. It was unacceptable to not have the documentation around this squared away at launch.

Concerns about data privacy and usage have to be taken so much more seriously than this. It's shocking mismanagement at best and has broken my trust in storing any code of real consequence here, much less paying for any other services offered by GitHub.

[sicklittlemonkey]

If this is really the answer, why not just update the FAQ in the Trust Center?

[autious]

I also feel the communication on this hasn't been clear enough. The fact that companies appear to believe that it's legal to suck up anything, feed it in to the machine and acquire copyright and ownership of anything that's generated as a result of this algorithmic regurgitation makes me have very little trust that private data or accidentally-made-public data won't end up being part of that.

Considering the current incentive structures that exists in the economy, and the virtual gold rush that's happening, I don't feel comfortable storing anything private on GitHub or even have publicly readable sources published online. I've begun the process of transferring it all to self-hosted private machines.

I fear we're heading in to a less free and open internet.

[bgauchon-reply]

First all all note that they only state this for Business version of Copilot ; and when it's free, your feeding it (copilot free)
I totally get along @autious feelings : There are numerous cases of breaches by AI models, further more the economic and political context doesn't make me feel safe about what could happen from whatever country.
Also note that a lot of US companies in the last months activated training on your data (linkedin, gmail, ....) by default without a clear communication and if your not aware , yes your data is by default leveraged to train models (linkedin direct messages, gmail emails content, ...)
Beside the fact it's illegal in multiple countries and in mine (In Europe any access to data must be done after an explicity consent by the end-user), the communication is obviously unclear in order to manage gaps, latency in reaction from users and create value from your data.

I'm also planning to move everything back on-premise in the next months

[ghost]

GitHub is owned by Microsoft
Microsoft forcefully installs spyware on people's computers
I think that is enough evidence to confirm that your code, art and music is being stolen to Copilot.
Switch to Codeberg or Gitlab, otherwise, face the dystopian consequences.

[praneeth-mohan]

No. GitHub Copilot does not use your private code or prompts to train its models.

In simple terms:

Your code and what you type into Copilot are not used to train Copilot or future models.

GitHub may collect basic usage stats (like whether you accept a suggestion), but not your actual code for training.

Copilot’s models were trained on publicly available code, not your personal or private projects.

So, using Copilot does not mean your code becomes part of its training data.

[ghost]

What publicly available code? The one I make public under GPL-3.0? Or the files I share with others via comments?

[bgauchon-reply]

Please, the End-user state only that Copilot Business doesn't train on your data, free version is enabled by default everywhere.

There is no way to access/manage policies without paying, can't even access Copilot panel in organization settings