96 lines
5.0 KiB
Markdown
96 lines
5.0 KiB
Markdown
# Privacy Policy
|
|
|
|
**Last updated:** October 6, 2026
|
|
|
|
## In plain language
|
|
|
|
- We collect only what we need: your email, name, and basic usage data.
|
|
- **Some models are private by design** — inference runs in encrypted enclaves we cannot read. **Others are chosen for renewable energy or open development, not architectural privacy.** Pick the model that matches your needs.
|
|
- We **do** store your chat history on our server (so you can revisit it). We promise not to read it, but this is a promise, not a technical guarantee.
|
|
- We never train on your data, and we never sell it.
|
|
- You can export or delete your data at any time.
|
|
|
|
The full policy is below. Questions? info@inference.coop.
|
|
|
|
---
|
|
|
|
## 1. Our privacy philosophy
|
|
|
|
The Inference Cooperative is a member-governed project. We are **not** an ad-supported or data-extractive business — we have no incentive to read or sell your data. Privacy is a structural value, built into how we operate.
|
|
|
|
## 2. What we collect
|
|
|
|
- **Account data:** your email and name (from Open Collective).
|
|
- **Membership data:** your contribution status and role.
|
|
- **Usage data:** token counts, model used, and timestamps (for metering your monthly budget).
|
|
- **Content:** your prompts and the AI's responses (stored in your chat history).
|
|
- **Billing data:** handled by Open Collective — we do not see full payment details.
|
|
|
|
## 3. Privacy depends on the model you choose
|
|
|
|
We serve models from multiple providers, and they do **not** all offer the same privacy. You choose per task:
|
|
|
|
- **Privacy-protected models (Tinfoil)** run inference inside **encrypted enclaves** (TEEs). Your model inputs and outputs are encrypted end-to-end, so **even our own infrastructure cannot read them at the inference step.** This is verifiable through remote attestation — a property of the system, not a promise.
|
|
- **Renewable-energy models (GreenPT)** run on 100% renewable infrastructure. Their protection is about energy, not architectural privacy — inputs and outputs are processed under GreenPT's own terms and data-processing agreement, not in an enclave.
|
|
- **Publicly developed models (PublicAI / Apertus)** are fully open. They likewise are chosen for open development, not architectural privacy.
|
|
|
|
**The distinction matters.** If you need the strongest privacy, use a Tinfoil model. If you choose a GreenPT or PublicAI model, be aware that your inputs and outputs are not encrypted in a way that prevents them from being processed in the clear. We never read or sell your data regardless of model — but the *architectural* guarantee exists only on the Tinfoil path.
|
|
|
|
## 4. What we *can* see (an honest caveat)
|
|
|
|
Your **chat history is stored on our server** so you can revisit past conversations. Stored chat history is **not** encrypted in a way that prevents us from technically reading it, regardless of which model generated it.
|
|
|
|
We commit not to read it. But this is a **policy commitment**, not an architectural guarantee. We're transparent about this distinction because it matters.
|
|
|
|
### Operational logs
|
|
|
|
Our server software keeps standard operational logs (dates, error messages, and — for account management like provisioning and welcome emails — the email addresses involved). These logs exist to run and debug the service, are kept briefly, and are not used to profile members.
|
|
|
|
## 5. Search
|
|
|
|
Web search runs through our self-hosted search instance. Search queries are forwarded to the underlying search engines (e.g. DuckDuckGo), which may see them. This is inherent to how web search works.
|
|
|
|
## 6. What we do NOT do
|
|
|
|
- We do **not** train models on your data.
|
|
- We do **not** sell, rent, or share your data.
|
|
- We do **not** use your data for advertising or profiling.
|
|
|
|
## 7. Third parties
|
|
|
|
- **Tinfoil** — provides encrypted (TEE) inference; its privacy and data-processing terms apply.
|
|
- **GreenPT** — provides renewable-energy inference; its terms and data-processing agreement apply (EU-hosted, GDPR-compliant).
|
|
- **PublicAI** — provides openly developed models (Apertus); its terms apply.
|
|
- **Open Collective** — handles billing and membership (their own privacy policy applies).
|
|
- **Cloudron** — our self-hosted platform; no third-party cloud provider.
|
|
- **Search engines** — receive your search queries (see §5).
|
|
|
|
## 8. Retention and deletion
|
|
|
|
- Chat history is retained until you delete it.
|
|
- On leaving, your account is deactivated (data preserved for reactivation).
|
|
- You may request full deletion at any time: info@inference.coop.
|
|
|
|
## 9. Security
|
|
|
|
- Self-hosted on Cloudron (sandboxed apps, SSL, backups).
|
|
- Per-member API keys; access gated on live membership.
|
|
- No external dependencies for core infrastructure.
|
|
|
|
## 10. Your rights
|
|
|
|
- **Access, correct, export, and delete** your data.
|
|
- As a member, you also have **governance** rights over this policy itself (through Loomio).
|
|
|
|
## 11. Children
|
|
|
|
The service is for people **18 and older**. We do not knowingly collect data from children.
|
|
|
|
## 12. Changes
|
|
|
|
We may update this policy as the project evolves. Material changes are announced to members and, where appropriate, decided through Loomio.
|
|
|
|
## 13. Contact
|
|
|
|
**info@inference.coop**
|