privacy: document temporary chats (incl. as default) and sharpen the honest caveat

- §4: the exact boundary — enclave models protect inference, stored
  history is operator-readable; recommend Temporary Chat + enclave model
  for sensitive material. New subsection on Temporary Chat (per-
  conversation toggle, Default Temporary Chat setting, trade-offs,
  what it does and does not change).
- §8: temporary chats are never retained.
- getting-started: add Temporary Chat to the chat feature list with
  the Settings → Conversations default toggle.
No engineering change; documents what the deployed chat (1.4.5) already
supports. Member request 2026-10-28.

getting-started.md

@@ -53,6 +53,13 @@ with the account you created in step 1.
   there's a tool you'd like available, ask in #general.
 - **Voice** works in both directions: speak to the chat with the microphone
   icon, and have replies read aloud.
+- **Temporary chats** — for conversations you don't want kept on our servers
+  at all. Click the **Temporary Chat** toggle (in the chat header) and the
+  conversation is never saved: it disappears when you leave the page, and
+  nothing lands in your history or our database. To make this your default,
+  open **Settings → Conversations** and turn on **Default Temporary Chat**.
+  For anything sensitive, we recommend a temporary chat — ideally paired with
+  a 🔒 enclave model. See [Privacy](privacy-policy.md#4-what-we-can-see-an-honest-caveat).
 
 Your usage draws from your monthly allowance; you can see it on the 
 [Member Dashboard](https://dashboard.inference.coop).

privacy-policy.md

@@ -1,12 +1,12 @@
 # Privacy Policy
 
-**Last updated:** October 6, 2026
+**Last updated:** October 28, 2026
 
 ## In plain language
 
 - We collect only what we need: your email, name, and basic usage data.
 - We offer a **changing variety of models with different privacy and value affordances** — some run in encrypted enclaves we cannot read, others differ. **You are responsible for assessing each model's properties and picking the one that fits your needs.**
-- We **do** store your chat history on our server (so you can revisit it). We promise not to read it, but this is a promise, not a technical guarantee.
+- We **do** store your chat history on our server (so you can revisit it). We promise not to read it, but this is a promise, not a technical guarantee. **Temporary chats** are the exception: nothing is stored at all, and you can make them your default — see §4 if you'd like sensitive conversations to leave nothing behind.
 - We never train on your data, and we never sell it.
 - You can export or delete your data at any time.
 
@@ -43,6 +43,18 @@ Your **chat history is stored on our server** so you can revisit past conversati
 
 We commit not to read it. But this is a **policy commitment**, not an architectural guarantee. We're transparent about this distinction because it matters.
 
+Note the boundary precisely: enclave models protect your conversation **while it is being processed** — the model provider and we cannot read the exchange at inference time. Stored history is a separate leg: once a conversation is saved, it sits on our server in a form we can technically read. So for sensitive material, the strongest combination available today is a **Temporary Chat with an enclave model** — protected in transit and at inference, and never stored afterwards.
+
+### Temporary chats (recommended for anything sensitive)
+
+The chat has a **Temporary Chat** mode designed exactly for this:
+
+- Click the **Temporary Chat** toggle in the chat header, and the conversation is **never saved** — it doesn't appear in your history, it isn't written to our database, and it disappears when you leave the page.
+- To make this the default for every new conversation, open **Settings → Conversations** and enable **Default Temporary Chat**. The preference is stored in your browser, so it's yours to change at any time.
+- The trade-off is that there's nothing to revisit: no history, no search, no sync across devices. Use it whenever that trade is right for you — you can mix saved and temporary conversations freely.
+
+Temporary chats change what we store, not who processes your request: the model you choose still receives your messages to generate a reply, under the properties described in §3.
+
 ### Operational logs
 
 Our server software keeps standard operational logs (dates, error messages, and — for account management like provisioning and welcome emails — the email addresses involved). These logs exist to run and debug the service, are kept briefly, and are not used to profile members.
@@ -68,6 +80,7 @@ The models we serve are provided by third parties that change over time, each wi
 ## 8. Retention and deletion
 
 - Chat history is retained until you delete it.
+- **Temporary chats are never retained** — they are not written to our database at all (see §4).
 - On leaving, your account is deactivated (data preserved for reactivation).
 - You may request full deletion at any time: info@inference.coop.