IIRC they didn’t train on private repos though, so using copilot in a private (github) repo will potentially open up your proprietary code to being used in that way.

No, the model doesn't train on your private code (which is good but also somewhat limiting as in my experience it doesn't provide useful answers that are very specific to your codebase); it's good for generic code though and saves time looking stuff up.