ToS + privacy: make model/provider agnostic; user assesses per-model affordances

terms-of-service.md

@@ -5,7 +5,7 @@
 ## In plain language
 
 - You are a **member**, not a customer. You help govern this project.
-- We provide AI chat and API access through open models, with **privacy-protected options** (some models run in encrypted enclaves; others are value-based choices — see §3).
+- We provide AI chat and API access through open models, with **a variety of privacy and value options** (some models run in encrypted enclaves; others differ — see §3).
 - Your prompts and the AI's outputs are yours to keep.
 - We don't train on your data, and we don't sell it.
 - AI can be wrong. Use your judgment.
@@ -34,14 +34,11 @@ When you join, you become a **member** — someone with a voice in how the proje
 
 We provide:
 
-- **AI chat and a developer API** through open models from multiple providers. You choose per task not just *which model*, but *which values it embodies*:
-  - **Privacy-protected** models run inside encrypted (TEE) enclaves, so inputs and outputs are not readable in plaintext at the inference step (Tinfoil).
-  - **Renewable-energy** models run on 100% renewable infrastructure (GreenPT).
-  - **Publicly developed** models are fully open — weights, code, and training data (PublicAI / Apertus).
+- **AI chat and a developer API** through a changing catalog of open models from multiple providers. You choose per task not just *which model*, but *which affordances it offers* — models differ in privacy architecture, energy source, openness, capability, and cost. Some run inference inside encrypted enclaves; others do not. Some run on renewable energy; others do not. The catalog changes as members decide, and the specific models and providers available will evolve.
 - **Web search** and **file uploads** within the chat interface.
 - **Governance** — a seat in decisions about models, pricing, and direction.
 
-Privacy protection is a **choice you make per model**, not a universal property of the service. Only the Tinfoil models are architecturally private; the others are value-based choices. Please choose the model that matches your needs, and see our [Privacy Policy](privacy-policy.md) for details.
+Models are **not interchangeable in their affordances**. Each model has its own privacy, sustainability, and openness properties, and the set of available models changes over time. You are **responsible for assessing** which model fits your needs for a given task — in particular its privacy properties — before relying on it. See our [Privacy Policy](privacy-policy.md) for what this means in practice.
 
 The service is provided **"as is"** and may change as the project evolves. We do not guarantee uptime or specific performance at this stage.
 
@@ -80,7 +77,7 @@ You are **responsible for what you submit and what you do with AI outputs**, and
 
 ## 7. Privacy
 
-Privacy is a core value, but it is not uniform across the service. Some models (Tinfoil) run inference in encrypted enclaves so that inputs and outputs are not readable in plaintext at the inference step; others are selected for renewable energy or public development rather than architectural privacy. **Choose the model that matches your privacy needs.** Details are in the [Privacy Policy](privacy-policy.md).
+Privacy is a core value, but it is **not uniform across the service** — and the set of available models changes over time. Models differ in their privacy affordances: some run inference in encrypted enclaves so inputs and outputs are not readable in plaintext at the inference step, while others are selected for renewable energy or openness rather than architectural privacy. **You are responsible for assessing each model's privacy properties and choosing one that matches your needs.** See the [Privacy Policy](privacy-policy.md) for the current picture.
 
 ## 8. Termination