privacy: state what the API path actually stores (and add it where members read)

The policy described chat history and enclave models carefully but never addressed
the API path, and §2 read as though all content is retained — which is wrong for
members using their own keys.

Verified before writing, rather than restating policy language: a request with a
distinctive marker was sent through the gateway and searched for afterwards. It
appears nowhere in the gateway's logs, `litellm_settings` enables no content
logging, and the request records carry usage fields only (model, tokens, cost, key).

- privacy-policy.md §2: content retention now depends on the surface, with a pointer.
- privacy-policy.md §4: new subsection on API requests, including the two limits that
  stop it being read as more than it says — we can still link a request to a key and
  therefore a member, and "not stored by us" says nothing about the provider.
- api-access.md: a "what we store" section, since that is the page an API user reads
  before worrying about it.
- models.md: the privacy-limitations section now distinguishes chat from API.

api-access.md

@@ -14,6 +14,24 @@ client works.
 API usage draws from the **same monthly allowance as chat** — there's no separate
 quota.
 
+## What the co-op stores about your requests
+
+Usage records, and nothing else: the model, token counts, cost, and which key made
+the request — that is how your monthly metering works. **Your prompts and the
+responses are not stored on our side.** The API path keeps no conversation, so there
+is no transcript to delete later.
+
+Two things worth being precise about:
+
+- The **chat interface** is different — it saves your conversations so you can revisit
+  them. If you want the API's behaviour there instead, use a **temporary chat**.
+- The **provider** is a separate question. Whether a model's operator retains anything
+  is set by that provider, not by us, and it varies by model — the
+  [model list](models.md) distinguishes policy-based zero retention from
+  enclave-based protection.
+
+Full detail, including what we can and cannot see: [privacy policy](privacy-policy.md).
+
 ## Get a key
 
 Log in to the [Member Dashboard](https://dashboard.inference.coop) and create an