GitHub Copilot Privacy Review for Solo Freelancers (2026)

Short answer: GitHub Copilot uses your prompts, code snippets, and editor context to train its AI models on the Free, Pro, and Pro+ tiers unless you switch the training toggle off — our verdict is USE WITH CAUTION for client code, and only after you flip that setting and understand the agent-workflow risk exposed this month. As of July 2026, a security team publicly demonstrated that Copilot’s agentic mode could be tricked, through a booby-trapped public issue, into pulling content out of private repositories in the same organization and posting it where anyone could read it (the “GitLost” disclosure, 2026-07-08). For a freelance developer, that combines two headaches in one tool: your day-to-day coding may feed a training corpus, and the newer autonomous agent adds an exfiltration surface. This review breaks down what Copilot collects, what the July incident actually means for client work, how to lock it down, and the privacy-friendlier ways to keep coding. See how we vet privacy claims for the process behind this verdict.

What GitHub Copilot does with your data

Copilot is Microsoft-owned GitHub’s coding assistant, and its data posture changed in a way freelancers should know about. Since a policy update taking effect in April 2026, interaction data from the Free, Pro, and Pro+ tiers is used to train and improve the underlying models unless you opt out (per GitHub’s Copilot interaction-data usage update, retrieved 2026-07-09). That interaction data is broader than the prompt you type: it can include the suggestions returned, the code snippets around your cursor, which suggestions you accept or reject, file names, repository structure, and how you move through a project (per GitHub’s privacy documentation, retrieved 2026-07-09).

The private-repository nuance matters most for client work. GitHub’s position is that content sitting at rest — private repos you are not actively touching, issues, discussions — is not used for training. But when Copilot is switched on and working, code from private repositories is processed as part of that live interaction, and on Free/Pro/Pro+ that interaction stream can feed model training unless the toggle is off (per GitHub’s privacy documentation, retrieved 2026-07-09). In plain terms: the mere fact that a repo is private does not put your client’s code outside the training scope while you are coding in it.

On the corporate side, GitHub acts as data controller for services covered by its General Privacy Statement and collects personal data directly, automatically from your device, and from third parties. Retention is described in general terms — data is kept while your account is active and as long as needed for contractual and legal obligations — with no specific numeric retention window published for Copilot interaction data as of the snapshot date (per GitHub’s General Privacy Statement, retrieved 2026-07-09). Business and Enterprise licenses are treated differently: their interaction data is contractually excluded from model training by default, which is the single biggest reason a paid team tier changes the calculus here.

One more layer is easy to miss: third-party extensions. Copilot’s ecosystem includes integrations and extensions from other companies, and GitHub’s own documentation is explicit that those are governed by the third parties’ privacy statements rather than GitHub’s (per GitHub’s General Privacy Statement, retrieved 2026-07-09). For a freelancer wiring Copilot into a broader toolchain, that means each extension is a separate privacy decision — turning off GitHub’s own training toggle does nothing to constrain what a bolted-on extension collects. The practical takeaway is that “I disabled training in Copilot” is a necessary step, not a complete one, if your setup pulls in outside integrations.

What this means for solo freelancers

Three concrete scenarios show where the risk lands. First, if you code a client’s private application in VS Code with Copilot Pro and never touch the training toggle, the surrounding context of that proprietary codebase — structure, filenames, snippets near your cursor — is part of the interaction stream that can improve the models. Based on the policy as written, doing client work on a personal tier without opting out carries a genuine confidentiality risk you have accepted on your client’s behalf, often without a contract clause allowing it.

Second, the GitLost disclosure adds an agent-specific hazard. Researchers showed that a crafted public issue could steer Copilot’s autonomous coding agent into fetching content from private repos in the same organization and exposing it publicly (GitLost, disclosed to GitHub 2026-07-08). If you run the agent across a client org that also has public repos, a hostile outside actor filing an issue is a plausible exfiltration path — not a hypothetical for anyone doing agent-driven work.

Third, for EU clients there is a controller-processor question. When you paste or process a client’s personal data through Copilot on a personal tier, based on the policy as written you cannot cleanly demonstrate that the data stays out of training, which weakens any data-processing commitment you signed. The safer posture for regulated or NDA-bound client work is the Business tier plus a written note in your engagement terms about which AI tools touch client data — the same discipline we cover for solo workers handling sensitive files.

To make the exposure concrete, here is what actually leaves your machine on a default personal tier, ranked by how much it should worry a freelancer:

• Highest concern — proprietary code near your cursor: the snippets Copilot reads to generate suggestions are your client’s intellectual property, and on Free/Pro/Pro+ they sit inside the interaction stream that can feed training.
• High concern — repository structure and filenames: even without a full code dump, directory layout, module names, and file naming can reveal a client’s architecture and product roadmap.
• Medium concern — accept/reject behavior: which suggestions you keep signals how the codebase is being built, a subtle but real leak of engineering intent.
• Situational — agent actions across an org: only relevant if you run the autonomous agent, but this is where GitLost turned a data-collection question into an exfiltration one.

None of this is a reason to abandon the tool. It is a reason to treat a personal Copilot tier as unsuitable for confidential client work until you have changed the settings below, and to reach for a Business seat the moment an NDA is involved.

How to use it safely

Turn off training first. Click your profile picture at the top right, open Copilot settings and the Privacy area, find the dropdown labeled to allow GitHub to use your data for AI model training, and set it to Disabled (per GitHub’s individual-subscriber policy guidance, retrieved 2026-07-09). This is not available on Business or Enterprise seats because they are already excluded — so if you see no toggle on a work account, that is expected. Worth knowing: any earlier product-improvement opt-out you set is preserved, so if you switched something off before the April 2026 change, that preference carries forward rather than silently resetting.

• For any NDA or regulated client, use a Copilot Business or Enterprise seat rather than a personal Pro tier, so training exclusion is contractual, not a setting you might forget.
• Keep Copilot’s autonomous agent off for organizations that mix public and private repos until you have reviewed GitHub’s post-GitLost mitigations; use inline suggestions instead of the agent for sensitive orgs.
• Scope Copilot to specific repositories rather than granting broad org access, so a compromised workflow has a smaller blast radius.
• Strip secrets, tokens, and client identifiers from code and comments before they sit near your cursor — the surrounding context is part of what gets processed.
• Add a one-line clause to your client contract naming which AI coding tools you use, so consent is explicit rather than assumed.

Privacy-friendlier alternatives

If Copilot’s default posture or the agent risk is a dealbreaker for a given client, three options keep you coding with less data exposure. None of these is a magic fix — every AI coding tool sends something somewhere — but each shifts the tradeoff in a direction that is easier to defend in a contract.

Tabby — a self-hosted, open-source coding assistant. What it gives you that Copilot doesn’t: the model runs on your own machine or server, so client code never leaves infrastructure you control. Free and open-source (you supply the compute); best for privacy-strict developers comfortable running their own tooling.

Codeium — a Copilot competitor whose individual plan states it does not train on your private code. What it gives you that Copilot doesn’t: a no-training default on the free personal tier rather than an opt-out you have to remember. Free individual tier, with paid team plans (roughly in the low-double-digits per user per month); best for solo devs who want a hosted tool without the default-training tradeoff.

1Password plus a hardware key — not a coding assistant, but the pairing that closes the account side of this risk. What it gives you that Copilot’s settings don’t: strong credential isolation so a leaked token from an exposed repo cannot be reused. 1Password runs about a few dollars a month for individuals; pair it with a YubiKey security key (hardware two-factor, one-time hardware cost) to protect the GitHub account the agent operates under. Best for any freelancer whose GitHub login guards client repositories.

The verdict

Frequently asked questions

Does GitHub Copilot train on my prompts?

On the Free, Pro, and Pro+ tiers, yes — since the April 2026 policy update, your interaction data trains and improves the models unless you switch training off in Copilot’s privacy settings (per GitHub’s usage update, retrieved 2026-07-09). Interaction data goes beyond your typed prompt to include nearby code, accepted suggestions, and repository context. Business and Enterprise seats are excluded from training by default, so on a work seat the answer is no.

Is GitHub Copilot GDPR-friendly for EU client work?

Based on the policy as written, GitHub acts as data controller under its General Privacy Statement and offers a training opt-out, but on personal tiers you cannot cleanly show client personal data stays out of training. For EU clients, that weakens any data-processing commitment you signed. The lower-risk path is a Business or Enterprise seat, where training exclusion is contractual, plus explicit consent in your engagement terms — not a legal guarantee, but a defensible posture.

What was the GitLost vulnerability, and does it still affect me?

GitLost was a July 2026 disclosure showing that a crafted public issue could trick Copilot’s autonomous coding agent into fetching content from private repositories in the same organization and posting it publicly (disclosed to GitHub 2026-07-08). It was responsibly reported. If you run the agent across an org that mixes public and private repos, treat it as a live exfiltration risk until you have confirmed GitHub’s mitigations and reviewed your agent permissions.

Can I use GitHub Copilot with private client repositories?

You can, but privacy depends on your tier and settings. On personal tiers, code from private repos is processed while you actively code and can feed training unless you opt out. A repo being private does not remove it from the interaction stream. For client repos under NDA, use a Business or Enterprise seat, disable the agent on mixed public-private orgs, and scope Copilot to only the repositories you are actually working in.

How do I turn off training in GitHub Copilot?

Click your profile picture at the top right, open Copilot settings and the Privacy section, and set the dropdown that allows GitHub to use your data for AI model training to Disabled (per GitHub’s individual-subscriber guidance, retrieved 2026-07-09). The change applies going forward. If you are on a Business or Enterprise seat you will not see this toggle, because those accounts are already excluded from training by default.

Sources

• GitHub General Privacy Statement — https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement (retrieved 2026-07-09)
• Updates to GitHub Copilot interaction data usage policy — https://github.blog/news-insights/company-news/updates-to-github-copilot-interaction-data-usage-policy/ (published 2026-03-25, retrieved 2026-07-09)
• Managing Copilot policies as an individual subscriber — https://docs.github.com/copilot/how-tos/manage-your-account/managing-copilot-policies-as-an-individual-subscriber (retrieved 2026-07-09)
• GitLost security research — https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/ (disclosed 2026-07-08)

Reviewed by Jérémy, founder of AidTaskPro and GreenBudgetHub. Based in central France. Privacy posture sourced from public policies and vendor documentation as of 2026-07-09.

[INTERNAL_LINK_TO_CLUSTER_ai-privacy-reviews]

[INTERNAL_LINK_TO_CLUSTER_ai-privacy-reviews]