5.0 KiB
Privacy Policy
Last updated: October 6, 2026
In plain language
- We collect only what we need: your email, name, and basic usage data.
- Some models are private by design — inference runs in encrypted enclaves we cannot read. Others are chosen for renewable energy or open development, not architectural privacy. Pick the model that matches your needs.
- We do store your chat history on our server (so you can revisit it). We promise not to read it, but this is a promise, not a technical guarantee.
- We never train on your data, and we never sell it.
- You can export or delete your data at any time.
The full policy is below. Questions? info@inference.coop.
1. Our privacy philosophy
The Inference Cooperative is a member-governed project. We are not an ad-supported or data-extractive business — we have no incentive to read or sell your data. Privacy is a structural value, built into how we operate.
2. What we collect
- Account data: your email and name (from Open Collective).
- Membership data: your contribution status and role.
- Usage data: token counts, model used, and timestamps (for metering your monthly budget).
- Content: your prompts and the AI's responses (stored in your chat history).
- Billing data: handled by Open Collective — we do not see full payment details.
3. Privacy depends on the model you choose
We serve models from multiple providers, and they do not all offer the same privacy. You choose per task:
- Privacy-protected models (Tinfoil) run inference inside encrypted enclaves (TEEs). Your model inputs and outputs are encrypted end-to-end, so even our own infrastructure cannot read them at the inference step. This is verifiable through remote attestation — a property of the system, not a promise.
- Renewable-energy models (GreenPT) run on 100% renewable infrastructure. Their protection is about energy, not architectural privacy — inputs and outputs are processed under GreenPT's own terms and data-processing agreement, not in an enclave.
- Publicly developed models (PublicAI / Apertus) are fully open. They likewise are chosen for open development, not architectural privacy.
The distinction matters. If you need the strongest privacy, use a Tinfoil model. If you choose a GreenPT or PublicAI model, be aware that your inputs and outputs are not encrypted in a way that prevents them from being processed in the clear. We never read or sell your data regardless of model — but the architectural guarantee exists only on the Tinfoil path.
4. What we can see (an honest caveat)
Your chat history is stored on our server so you can revisit past conversations. Stored chat history is not encrypted in a way that prevents us from technically reading it, regardless of which model generated it.
We commit not to read it. But this is a policy commitment, not an architectural guarantee. We're transparent about this distinction because it matters.
Operational logs
Our server software keeps standard operational logs (dates, error messages, and — for account management like provisioning and welcome emails — the email addresses involved). These logs exist to run and debug the service, are kept briefly, and are not used to profile members.
5. Search
Web search runs through our self-hosted search instance. Search queries are forwarded to the underlying search engines (e.g. DuckDuckGo), which may see them. This is inherent to how web search works.
6. What we do NOT do
- We do not train models on your data.
- We do not sell, rent, or share your data.
- We do not use your data for advertising or profiling.
7. Third parties
- Tinfoil — provides encrypted (TEE) inference; its privacy and data-processing terms apply.
- GreenPT — provides renewable-energy inference; its terms and data-processing agreement apply (EU-hosted, GDPR-compliant).
- PublicAI — provides openly developed models (Apertus); its terms apply.
- Open Collective — handles billing and membership (their own privacy policy applies).
- Cloudron — our self-hosted platform; no third-party cloud provider.
- Search engines — receive your search queries (see §5).
8. Retention and deletion
- Chat history is retained until you delete it.
- On leaving, your account is deactivated (data preserved for reactivation).
- You may request full deletion at any time: info@inference.coop.
9. Security
- Self-hosted on Cloudron (sandboxed apps, SSL, backups).
- Per-member API keys; access gated on live membership.
- No external dependencies for core infrastructure.
10. Your rights
- Access, correct, export, and delete your data.
- As a member, you also have governance rights over this policy itself (through Loomio).
11. Children
The service is for people 18 and older. We do not knowingly collect data from children.
12. Changes
We may update this policy as the project evolves. Material changes are announced to members and, where appropriate, decided through Loomio.