ToS + privacy: make model/provider agnostic; user assesses per-model affordances

privacy-policy.md

@@ -5,7 +5,7 @@
 ## In plain language
 
 - We collect only what we need: your email, name, and basic usage data.
-- **Some models are private by design** — inference runs in encrypted enclaves we cannot read. **Others are chosen for renewable energy or open development, not architectural privacy.** Pick the model that matches your needs.
+- We offer a **changing variety of models with different privacy and value affordances** — some run in encrypted enclaves we cannot read, others differ. **You are responsible for assessing each model's properties and picking the one that fits your needs.**
 - We **do** store your chat history on our server (so you can revisit it). We promise not to read it, but this is a promise, not a technical guarantee.
 - We never train on your data, and we never sell it.
 - You can export or delete your data at any time.
@@ -28,13 +28,14 @@ The Inference Cooperative is a member-governed project. We are **not** an ad-sup
 
 ## 3. Privacy depends on the model you choose
 
-We serve models from multiple providers, and they do **not** all offer the same privacy. You choose per task:
+We serve a **changing catalog of models from multiple providers, and they do not all offer the same privacy**. Models differ in their affordances — some run inference inside **encrypted enclaves** (TEEs) where inputs and outputs are not readable in plaintext at the inference step; others are selected for renewable energy, openness, or cost rather than architectural privacy. The set of available models, and their properties, will change as members decide.
 
-- **Privacy-protected models (Tinfoil)** run inference inside **encrypted enclaves** (TEEs). Your model inputs and outputs are encrypted end-to-end, so **even our own infrastructure cannot read them at the inference step.** This is verifiable through remote attestation — a property of the system, not a promise.
+**You are responsible for assessing each model's privacy and value properties and choosing the one that fits your needs.** As a rule of thumb:
-- **Renewable-energy models (GreenPT)** run on 100% renewable infrastructure. Their protection is about energy, not architectural privacy — inputs and outputs are processed under GreenPT's own terms and data-processing agreement, not in an enclave.
-- **Publicly developed models (PublicAI / Apertus)** are fully open. They likewise are chosen for open development, not architectural privacy.
 
-**The distinction matters.** If you need the strongest privacy, use a Tinfoil model. If you choose a GreenPT or PublicAI model, be aware that your inputs and outputs are not encrypted in a way that prevents them from being processed in the clear. We never read or sell your data regardless of model — but the *architectural* guarantee exists only on the Tinfoil path.
+- Some models run inference in encrypted enclaves, verifiable through remote attestation — a property of the system, not a promise.
+- Other models are processed in the clear under their provider's own terms and data-processing agreement.
+
+We never read or sell your data regardless of model — but the *architectural* guarantee applies only to models that offer it. Check the current model catalog and each provider's terms before relying on a particular model for sensitive material.
 
 ## 4. What we *can* see (an honest caveat)
 
@@ -58,9 +59,8 @@ Web search runs through our self-hosted search instance. Search queries are forw
 
 ## 7. Third parties
 
-- **Tinfoil** — provides encrypted (TEE) inference; its privacy and data-processing terms apply.
+The models we serve are provided by third parties that change over time, each with its own terms and privacy posture. We never sell your data, but when you use a model, that model's provider processes your inputs under its own terms and data-processing agreement — some in encrypted enclaves, some in the clear. Review each provider's terms before relying on it for sensitive material. Our current providers are listed in the model catalog.
-- **GreenPT** — provides renewable-energy inference; its terms and data-processing agreement apply (EU-hosted, GDPR-compliant).
+
-- **PublicAI** — provides openly developed models (Apertus); its terms apply.
 - **Open Collective** — handles billing and membership (their own privacy policy applies).
 - **Cloudron** — our self-hosted platform; no third-party cloud provider.
 - **Search engines** — receive your search queries (see §5).

terms-of-service.md

@@ -5,7 +5,7 @@
 ## In plain language
 
 - You are a **member**, not a customer. You help govern this project.
-- We provide AI chat and API access through open models, with **privacy-protected options** (some models run in encrypted enclaves; others are value-based choices — see §3).
+- We provide AI chat and API access through open models, with **a variety of privacy and value options** (some models run in encrypted enclaves; others differ — see §3).
 - Your prompts and the AI's outputs are yours to keep.
 - We don't train on your data, and we don't sell it.
 - AI can be wrong. Use your judgment.
@@ -34,14 +34,11 @@ When you join, you become a **member** — someone with a voice in how the proje
 
 We provide:
 
-- **AI chat and a developer API** through open models from multiple providers. You choose per task not just *which model*, but *which values it embodies*:
+- **AI chat and a developer API** through a changing catalog of open models from multiple providers. You choose per task not just *which model*, but *which affordances it offers* — models differ in privacy architecture, energy source, openness, capability, and cost. Some run inference inside encrypted enclaves; others do not. Some run on renewable energy; others do not. The catalog changes as members decide, and the specific models and providers available will evolve.
-  - **Privacy-protected** models run inside encrypted (TEE) enclaves, so inputs and outputs are not readable in plaintext at the inference step (Tinfoil).
-  - **Renewable-energy** models run on 100% renewable infrastructure (GreenPT).
-  - **Publicly developed** models are fully open — weights, code, and training data (PublicAI / Apertus).
 - **Web search** and **file uploads** within the chat interface.
 - **Governance** — a seat in decisions about models, pricing, and direction.
 
-Privacy protection is a **choice you make per model**, not a universal property of the service. Only the Tinfoil models are architecturally private; the others are value-based choices. Please choose the model that matches your needs, and see our [Privacy Policy](privacy-policy.md) for details.
+Models are **not interchangeable in their affordances**. Each model has its own privacy, sustainability, and openness properties, and the set of available models changes over time. You are **responsible for assessing** which model fits your needs for a given task — in particular its privacy properties — before relying on it. See our [Privacy Policy](privacy-policy.md) for what this means in practice.
 
 The service is provided **"as is"** and may change as the project evolves. We do not guarantee uptime or specific performance at this stage.
 
@@ -80,7 +77,7 @@ You are **responsible for what you submit and what you do with AI outputs**, and
 
 ## 7. Privacy
 
-Privacy is a core value, but it is not uniform across the service. Some models (Tinfoil) run inference in encrypted enclaves so that inputs and outputs are not readable in plaintext at the inference step; others are selected for renewable energy or public development rather than architectural privacy. **Choose the model that matches your privacy needs.** Details are in the [Privacy Policy](privacy-policy.md).
+Privacy is a core value, but it is **not uniform across the service** — and the set of available models changes over time. Models differ in their privacy affordances: some run inference in encrypted enclaves so inputs and outputs are not readable in plaintext at the inference step, while others are selected for renewable energy or openness rather than architectural privacy. **You are responsible for assessing each model's privacy properties and choosing one that matches your needs.** See the [Privacy Policy](privacy-policy.md) for the current picture.
 
 ## 8. Termination