inference-bot
2fdda5a201
The policy described chat history and enclave models carefully but never addressed the API path, and §2 read as though all content is retained — which is wrong for members using their own keys. Verified before writing, rather than restating policy language: a request with a distinctive marker was sent through the gateway and searched for afterwards. It appears nowhere in the gateway's logs, `litellm_settings` enables no content logging, and the request records carry usage fields only (model, tokens, cost, key). - privacy-policy.md §2: content retention now depends on the surface, with a pointer. - privacy-policy.md §4: new subsection on API requests, including the two limits that stop it being read as more than it says — we can still link a request to a key and therefore a member, and "not stored by us" says nothing about the provider. - api-access.md: a "what we store" section, since that is the page an API user reads before worrying about it. - models.md: the privacy-limitations section now distinguishes chat from API.
131 lines
8.1 KiB
Markdown
131 lines
8.1 KiB
Markdown
# Privacy Policy
|
|
|
|
**Last updated:** October 28, 2026
|
|
|
|
## In plain language
|
|
|
|
- We collect only what we need: your email, name, and basic usage data.
|
|
- We offer a **changing variety of models with different privacy and value affordances** — some run in encrypted enclaves we cannot read, others differ. **You are responsible for assessing each model's properties and picking the one that fits your needs.**
|
|
- We **do** store your chat history on our server (so you can revisit it). We promise not to read it, but this is a promise, not a technical guarantee. **Temporary chats** are the exception: nothing is stored at all, and you can make them your default — see §4 if you'd like sensitive conversations to leave nothing behind.
|
|
- We never train on your data, and we never sell it.
|
|
- You can export or delete your data at any time.
|
|
|
|
The full policy is below. Questions? info@inference.coop.
|
|
|
|
---
|
|
|
|
## 1. Our privacy philosophy
|
|
|
|
The Inference Cooperative is a member-governed project. We are **not** an ad-supported or data-extractive business — we have no incentive to read or sell your data. Privacy is a structural value, built into how we operate.
|
|
|
|
## 2. What we collect
|
|
|
|
- **Account data:** your email and name (from Open Collective).
|
|
- **Membership data:** your contribution status and role.
|
|
- **Usage data:** token counts, model used, and timestamps (for metering your monthly budget).
|
|
- **Content:** your prompts and the AI's responses. Whether we keep them depends on how you use the service: in the **chat interface** they are saved as your chat history, while through the **API** they are not stored at all. See §4.
|
|
- **Billing data:** handled by Open Collective — we do not see full payment details.
|
|
|
|
## 3. Privacy depends on the model you choose
|
|
|
|
We serve a **changing catalog of models from multiple providers, and they do not all offer the same privacy**. Models differ in their affordances — some run inference inside **encrypted enclaves** (TEEs) where inputs and outputs are not readable in plaintext at the inference step; others are selected for renewable energy, openness, or cost rather than architectural privacy. The set of available models, and their properties, will change as members decide.
|
|
|
|
**You are responsible for assessing each model's privacy and value properties and choosing the one that fits your needs.** As a rule of thumb:
|
|
|
|
- Some models run inference in encrypted enclaves, verifiable through remote attestation — a property of the system, not a promise.
|
|
- Other models are processed in the clear under their provider's own terms and data-processing agreement.
|
|
|
|
We never read or sell your data regardless of model — but the *architectural* guarantee applies only to models that offer it. Check the current model catalog and each provider's terms before relying on a particular model for sensitive material.
|
|
|
|
## 4. What we *can* see (an honest caveat)
|
|
|
|
Your **chat history is stored on our server** so you can revisit past conversations. Stored chat history is **not** encrypted in a way that prevents us from technically reading it, regardless of which model generated it.
|
|
|
|
We commit not to read it. But this is a **policy commitment**, not an architectural guarantee. We're transparent about this distinction because it matters.
|
|
|
|
Note the boundary precisely: enclave models protect your conversation **while it is being processed** — the model provider and we cannot read the exchange at inference time. Stored history is a separate leg: once a conversation is saved, it sits on our server in a form we can technically read. So for sensitive material, the strongest combination available today is a **Temporary Chat with an enclave model** — protected in transit and at inference, and never stored afterwards.
|
|
|
|
### If you use the API, nothing you send is stored
|
|
|
|
This is the part that surprises people, so it is worth stating plainly. If you call
|
|
the co-op's API with your own key and your own client, there is no conversation on
|
|
our side to save. Our gateway records **that** a request happened and what it cost:
|
|
the model, the token counts, the cost, and which key made the request. It does not
|
|
record **what you asked or what came back**.
|
|
|
|
We measured this rather than asserting it. A request with a distinctive marker was
|
|
sent through the gateway and then searched for: it appears nowhere in the gateway's
|
|
logs, the gateway's configuration enables no content logging, and the request records
|
|
themselves carry usage fields only. So the API path keeps no text.
|
|
|
|
Two boundaries on that statement, because it would be easy to read it as more than
|
|
it is:
|
|
|
|
- **We can still tell that a given key made a request**, and therefore which member
|
|
it belongs to. That link is how metering works — it is not something we hide.
|
|
- **"Not stored by us" is not the same as "not stored."** The provider's handling is
|
|
a separate question from ours, and it depends on the model you choose — see §3. Not
|
|
being stored on our side says nothing about the far end of the request.
|
|
|
|
### Temporary chats (recommended for anything sensitive)
|
|
|
|
The chat has a **Temporary Chat** mode designed exactly for this:
|
|
|
|
- Click the **Temporary Chat** toggle in the chat header, and the conversation is **never saved** — it doesn't appear in your history, it isn't written to our database, and it disappears when you leave the page.
|
|
- To make this the default for every new conversation, open **Settings → Conversations** and enable **Default Temporary Chat**. The preference is stored in your browser, so it's yours to change at any time.
|
|
- The trade-off is that there's nothing to revisit: no history, no search, no sync across devices. Use it whenever that trade is right for you — you can mix saved and temporary conversations freely.
|
|
|
|
Temporary chats change what we store, not who processes your request: the model you choose still receives your messages to generate a reply, under the properties described in §3.
|
|
|
|
### Operational logs
|
|
|
|
Our server software keeps standard operational logs (dates, error messages, and — for account management like provisioning and welcome emails — the email addresses involved). These logs exist to run and debug the service, are kept briefly, and are not used to profile members.
|
|
|
|
## 5. Search
|
|
|
|
Web search runs through our self-hosted search instance. Search queries are forwarded to the underlying search engines (e.g. DuckDuckGo), which may see them. This is inherent to how web search works.
|
|
|
|
## 6. What we do NOT do
|
|
|
|
- We do **not** train models on your data.
|
|
- We do **not** sell, rent, or share your data.
|
|
- We do **not** use your data for advertising or profiling.
|
|
|
|
## 7. Third parties
|
|
|
|
The models we serve are provided by third parties that change over time, each with its own terms and privacy posture. We never sell your data, but when you use a model, that model's provider processes your inputs under its own terms and data-processing agreement — some in encrypted enclaves, some in the clear. Review each provider's terms before relying on it for sensitive material. Our current providers are listed in the model catalog.
|
|
|
|
- **Open Collective** — handles billing and membership (their own privacy policy applies).
|
|
- **Cloudron** — our self-hosted platform; no third-party cloud provider.
|
|
- **Search engines** — receive your search queries (see §5).
|
|
|
|
## 8. Retention and deletion
|
|
|
|
- Chat history is retained until you delete it.
|
|
- **Temporary chats are never retained** — they are not written to our database at all (see §4).
|
|
- On leaving, your account is deactivated (data preserved for reactivation).
|
|
- You may request full deletion at any time: info@inference.coop.
|
|
|
|
## 9. Security
|
|
|
|
- Self-hosted on Cloudron (sandboxed apps, SSL, backups).
|
|
- Per-member API keys; access gated on live membership.
|
|
- No external dependencies for core infrastructure.
|
|
|
|
## 10. Your rights
|
|
|
|
- **Access, correct, export, and delete** your data.
|
|
- As a member, you also have **governance** rights over this policy itself (through Loomio).
|
|
|
|
## 11. Children
|
|
|
|
The service is for people **18 and older**. We do not knowingly collect data from children.
|
|
|
|
## 12. Changes
|
|
|
|
We may update this policy as the project evolves. Material changes are announced to members and, where appropriate, decided through Loomio.
|
|
|
|
## 13. Contact
|
|
|
|
**info@inference.coop**
|