From 3ee59e2dcce9fd75ad2d9026b56e63693e75dcb0 Mon Sep 17 00:00:00 2001 From: Nathan Schneider Date: Wed, 28 Oct 2026 17:48:12 -0600 Subject: [PATCH] privacy: document temporary chats (incl. as default) and sharpen the honest caveat MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - §4: the exact boundary — enclave models protect inference, stored history is operator-readable; recommend Temporary Chat + enclave model for sensitive material. New subsection on Temporary Chat (per- conversation toggle, Default Temporary Chat setting, trade-offs, what it does and does not change). - §8: temporary chats are never retained. - getting-started: add Temporary Chat to the chat feature list with the Settings → Conversations default toggle. No engineering change; documents what the deployed chat (1.4.5) already supports. Member request 2026-10-28. --- getting-started.md | 7 +++++++ privacy-policy.md | 17 +++++++++++++++-- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/getting-started.md b/getting-started.md index 5b459e1..efb04eb 100644 --- a/getting-started.md +++ b/getting-started.md @@ -53,6 +53,13 @@ with the account you created in step 1. there's a tool you'd like available, ask in #general. - **Voice** works in both directions: speak to the chat with the microphone icon, and have replies read aloud. +- **Temporary chats** — for conversations you don't want kept on our servers + at all. Click the **Temporary Chat** toggle (in the chat header) and the + conversation is never saved: it disappears when you leave the page, and + nothing lands in your history or our database. To make this your default, + open **Settings → Conversations** and turn on **Default Temporary Chat**. + For anything sensitive, we recommend a temporary chat — ideally paired with + a 🔒 enclave model. See [Privacy](privacy-policy.md#4-what-we-can-see-an-honest-caveat). Your usage draws from your monthly allowance; you can see it on the [Member Dashboard](https://dashboard.inference.coop). diff --git a/privacy-policy.md b/privacy-policy.md index 5572a77..742c9e3 100644 --- a/privacy-policy.md +++ b/privacy-policy.md @@ -1,12 +1,12 @@ # Privacy Policy -**Last updated:** October 6, 2026 +**Last updated:** October 28, 2026 ## In plain language - We collect only what we need: your email, name, and basic usage data. - We offer a **changing variety of models with different privacy and value affordances** — some run in encrypted enclaves we cannot read, others differ. **You are responsible for assessing each model's properties and picking the one that fits your needs.** -- We **do** store your chat history on our server (so you can revisit it). We promise not to read it, but this is a promise, not a technical guarantee. +- We **do** store your chat history on our server (so you can revisit it). We promise not to read it, but this is a promise, not a technical guarantee. **Temporary chats** are the exception: nothing is stored at all, and you can make them your default — see §4 if you'd like sensitive conversations to leave nothing behind. - We never train on your data, and we never sell it. - You can export or delete your data at any time. @@ -43,6 +43,18 @@ Your **chat history is stored on our server** so you can revisit past conversati We commit not to read it. But this is a **policy commitment**, not an architectural guarantee. We're transparent about this distinction because it matters. +Note the boundary precisely: enclave models protect your conversation **while it is being processed** — the model provider and we cannot read the exchange at inference time. Stored history is a separate leg: once a conversation is saved, it sits on our server in a form we can technically read. So for sensitive material, the strongest combination available today is a **Temporary Chat with an enclave model** — protected in transit and at inference, and never stored afterwards. + +### Temporary chats (recommended for anything sensitive) + +The chat has a **Temporary Chat** mode designed exactly for this: + +- Click the **Temporary Chat** toggle in the chat header, and the conversation is **never saved** — it doesn't appear in your history, it isn't written to our database, and it disappears when you leave the page. +- To make this the default for every new conversation, open **Settings → Conversations** and enable **Default Temporary Chat**. The preference is stored in your browser, so it's yours to change at any time. +- The trade-off is that there's nothing to revisit: no history, no search, no sync across devices. Use it whenever that trade is right for you — you can mix saved and temporary conversations freely. + +Temporary chats change what we store, not who processes your request: the model you choose still receives your messages to generate a reply, under the properties described in §3. + ### Operational logs Our server software keeps standard operational logs (dates, error messages, and — for account management like provisioning and welcome emails — the email addresses involved). These logs exist to run and debug the service, are kept briefly, and are not used to profile members. @@ -68,6 +80,7 @@ The models we serve are provided by third parties that change over time, each wi ## 8. Retention and deletion - Chat history is retained until you delete it. +- **Temporary chats are never retained** — they are not written to our database at all (see §4). - On leaving, your account is deactivated (data preserved for reactivation). - You may request full deletion at any time: info@inference.coop.