Add Terms of Service and Privacy Policy (plain-language, architecture-grounded)

privacy-policy.md

@@ -0,0 +1,83 @@
+# Privacy Policy
+
+**Last updated:** September 10, 2026
+
+## In plain language
+
+- We collect only what we need: your email, name, and basic usage data.
+- **Your AI conversations are encrypted** — even we can't read them at the inference step.
+- We **do** store your chat history on our server (so you can revisit it). We promise not to read it, but this is a promise, not a technical guarantee.
+- We never train on your data, and we never sell it.
+- You can export or delete your data at any time.
+
+The full policy is below. Questions? info@inference.coop.
+
+---
+
+## 1. Our privacy philosophy
+
+The Inference Cooperative is a member-governed cooperative. We are **not** an ad-supported or data-extractive business — we have no incentive to read or sell your data. Privacy is a structural value, built into how we operate.
+
+## 2. What we collect
+
+- **Account data:** your email and name (from Open Collective).
+- **Membership data:** your contribution status and role.
+- **Usage data:** token counts, model used, and timestamps (for metering your monthly budget).
+- **Content:** your prompts and the AI's responses (stored in your chat history).
+- **Billing data:** handled by Open Collective — we do not see full payment details.
+
+## 3. What we *can't* see (architectural privacy)
+
+Inference runs inside **encrypted enclaves** (TEEs). Your model inputs and outputs are encrypted end-to-end, so **even our own infrastructure cannot read them at the inference step.** This is verifiable through remote attestation — it's a property of the system, not a promise.
+
+## 4. What we *can* see (an honest caveat)
+
+Your **chat history is stored on our server** so you can revisit past conversations. Unlike the inference step, stored chat history is **not** encrypted in a way that prevents us from technically reading it.
+
+We commit not to read it. But this is a **policy commitment**, not an architectural guarantee. We're transparent about this distinction because it matters.
+
+## 5. Search
+
+Web search runs through our self-hosted search instance. Search queries are forwarded to the underlying search engines (e.g. DuckDuckGo), which may see them. This is inherent to how web search works.
+
+## 6. What we do NOT do
+
+- We do **not** train models on your data.
+- We do **not** sell, rent, or share your data.
+- We do **not** use your data for advertising or profiling.
+
+## 7. Third parties
+
+- **Tinfoil** — provides encrypted inference (cannot read your content).
+- **Open Collective** — handles billing and membership (their own privacy policy applies).
+- **Cloudron** — our self-hosted platform; no third-party cloud provider.
+- **Search engines** — receive your search queries (see §5).
+
+## 8. Retention and deletion
+
+- Chat history is retained until you delete it.
+- On leaving, your account is deactivated (data preserved for reactivation).
+- You may request full deletion at any time: info@inference.coop.
+
+## 9. Security
+
+- Self-hosted on Cloudron (sandboxed apps, SSL, backups).
+- Per-member API keys; access gated on live membership.
+- No external dependencies for core infrastructure.
+
+## 10. Your rights
+
+- **Access, correct, export, and delete** your data.
+- As a member, you also have **governance** rights over this policy itself (through Loomio).
+
+## 11. Children
+
+The service is for people **18 and older**. We do not knowingly collect data from children.
+
+## 12. Changes
+
+We may update this policy as the cooperative evolves. Material changes are announced to members and, where appropriate, decided through Loomio.
+
+## 13. Contact
+
+**info@inference.coop**