Privacy Policy

Effective date: November 6, 2026 · Version: 2026-11-06.1

The short version.

• We collect what it takes to run Hillclimb: your name and email, sign-in and security records, and what you and your agents put into your organization's trees.
• No analytics, ads, tracking scripts, or third-party cookies. Hillclimb calls no AI. We don't sell your data, share it for advertising, or train AI on it.
• We email only sign-in codes, invitations, and rare security or legal notices we're required to send. Never marketing.
• Your organization controls its content, and we process it for the organization under our Data Processing Addendum.
• Four providers help run Hillclimb: Vercel, Neon (Databricks), Cloudflare, and Resend. Google or GitHub are involved only if you sign in with them. Agents, trigger destinations, and share links receive only what you or your organization send them.
• You can delete your account yourself in Settings. Work you did in shared organizations stays with them under your name, marked "(deleted account)", and they can have your name removed. We keep a record that you accepted our terms.
• Hillclimb is run from the United States for US businesses, and your data is stored and processed in the US.
• Questions or requests: hello@hillclimb.me.

Desiderata LLC, a Pennsylvania limited liability company, operates Hillclimb at hillclimb.me. Hillclimb is a hosted service for organizations: accounts, organizations, trees of goals and outcomes, evidence and files, plans, comments, share links, and triggers are processed on our systems and those of our service providers.

This policy explains what we collect and why. It covers two kinds of processing:

• Information we control. We decide how to handle account, sign-in, security, rate-limit, log, acceptance, service-communication, support, and legal-compliance records. This policy governs them.
• Information we process for an organization. The content of an organization's trees and the records used to run the organization (members, roles, teams, invitations, access grants, share links and their visit records, triggers, and activity events) are processed on that organization's behalf. The organization is the controller of that information and decides what goes into it, who sees it, and where it is sent. Our Data Processing Addendum governs that processing. If you are a member, guest, or someone named in an organization's content, direct requests about that content to the organization; we will help it respond and forward requests we receive.

Accepting the Terms of Service doesn't waive your privacy rights.

1. Information we collect

• Accounts: your name, email address, whether the email is verified, a profile image address supplied by Google or GitHub (stored as a link; Hillclimb does not currently display it), account identifiers, and creation and update times. Hillclimb has no passwords.
• Sign-in: you sign in with Google, GitHub, or a six-digit code we email to you. Emailed codes are stored only as a hash and expire after 10 minutes. Google sign-in provides your name, email, profile image, and verification status (scopes openid, email, profile); GitHub sign-in provides your name or login, email, avatar, and verification status (scopes read:user, user:email). We store the provider's account identifier and the access, refresh, and ID tokens the provider issues, together with their scope. Neither sign-in grants access to your Gmail, Drive, repositories, or other content. A Google or GitHub sign-in is linked to an existing Hillclimb account with the same verified email address.
• Sessions and devices: session tokens and expiry, the IP address and browser user-agent recorded when a session starts (for security investigations; we don't use them to track you), and the organization you last selected. A browser can hold up to five signed-in accounts at once.
• Agents, API keys, and OAuth clients: API keys you create (a name, the first characters of the key, a hash of the key, owner, expiry, time of last use, and a request count; the full key is shown once and not stored). When an AI agent or other MCP client connects through OAuth, we store its registration (name, website, icon, contact addresses, terms and policy links, redirect addresses), your consent, and access and refresh tokens. If a client identifies itself with a metadata URL, our server fetches that URL. When an agent signs you in with the sign_in tool, it receives an API key for your account. The records your agent creates and the activity log carry the agent name or API key it acted through, so you and your organization can see which agent did what.
• Agreement records: the version and hash of the documents you accepted, the wording of the notice you were shown, how you signed in (Google, GitHub, an emailed code, or an agent's sign_in call), the email address your account had, and when. We record this at sign-in or sign-up, on the web (including when an agent's OAuth flow sends you to our sign-in page) or through the sign_in tool.
• Organization records: organization names, addresses (slugs), logos and settings; memberships and roles; teams, team members (including guests from outside the organization), and team access; invitations (the invitee's email address, role, status, expiry, and who invited them); and per-goal access grants.
• Tree content: goals, briefs, outcomes, user stories and criteria, tags, statuses, claims, evidence (summaries, bodies, links, sources and verdicts), files attached to evidence, plans and every revision of them, comments, approvals and pending changes, and an activity log of events. These records carry the name or identifier of the person, and where relevant the agent, that created them. Content can contain whatever people and agents write or upload, including information about other people. Some events store other people's email addresses, for example when access is granted to someone.
• Share links and visits: for each share link, its name, view, expiry, creator, and whether it was revoked. When someone opens a share link, we record the time, an approximate location (city, region, and country derived by our host from the visitor's IP address), the browser user-agent, the referring page (up to 300 characters), and a salted one-way hash of the visitor's IP address and user-agent. We do not store the raw IP address for these visits. Visits are recorded for the organization's owners and admins, who can see them; see section 3.
• Triggers: for outbound triggers, the destination address, the event types chosen, a signing secret, and delivery state (last error and failure count). For inbound triggers, a hash of the secret address and the rules; anything posted to an inbound trigger is stored as evidence, including up to 4,000 characters of the raw payload.
• Usage and rate limits: hourly counts of agent, API, and trigger calls per organization, and totals of evidence, storage, and active trees. These counts contain no personal information. To limit abuse of sign-in, we keep short-lived counters keyed by the email address or IP address making the request (for example, how many codes were requested for an email address in the last 15 minutes). These counters contain the email address or IP address in plain text.
• Operational information: for each agent request, a log line with the method, tool name, protocol, user-agent (up to 80 characters), client name, status, and duration; it excludes tokens, keys, tool arguments, and results. Unexpected errors and failed trigger deliveries are logged, and an error log can include information from the request that caused it. Our hosting provider also keeps its own request logs, including IP addresses and request paths.
• Support and reports: contact details, correspondence, and anything you send us about support, security, privacy, or rights complaints.

We receive information directly from you, automatically from your use of Hillclimb, from Google or GitHub when you choose them to sign in, from agents and clients you connect, and from other people in your organizations, who may add you to an organization, invite you by email, assign or mention you, or write about you in content. The categories, purposes, and rights described in this policy apply to that information too.

Hillclimb has no built-in AI and calls no AI or language-model services. It has no analytics, advertising, session-replay, or third-party error-tracking scripts.

2. How we use information

We use information to create and secure accounts and sign you in; send sign-in codes and organization invitations; run organizations, trees, sharing, approvals, and triggers as their members direct; let agents you authorize act with your permissions; store and deliver files; record agreement to our terms; meter usage and enforce limits; prevent and investigate abuse and security incidents; answer requests; comply with law; and fix and improve Hillclimb using usage counts, error logs, and feedback. We don't read organizations' content to improve the product.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use your information, or any organization's content, to train AI models. We do not use Google or GitHub sign-in information for advertising.

We send email only for sign-in codes and organization invitations, and, rarely, a security or legal message we are required to send. We do not send marketing email from Hillclimb. Changes to this policy and our other terms are announced on the site, by publishing the new version here.

We use and disclose sensitive personal information, such as the sign-in tokens that let you into your account, only as needed to provide Hillclimb and keep it secure, and never to infer characteristics about you. For information we process for an organization, the organization decides how it is used, within our Data Processing Addendum.

3. Who can see your information

Hillclimb is used inside organizations. What others can see depends on the organization's settings, not just yours.

• Members and their agents. People in an organization, and the agents they connect, can see the names and email addresses of the people whose work, comments, approvals, and changes appear in trees they can access, along with organization members, roles, teams, and invitations as their role allows. Agents act with their person's permissions, so anything that person can see, their agent can read and pass to its provider.
• Guests. People outside an organization who are added to a team or granted access to a goal can see what that access covers, including the names and emails attached to it.
• Owners and admins can see their organization's usage, triggers, share links, and the share-link visit records described above (the first 8 characters of each visitor's hash, approximate location, browser, and referrer).
• Share links. Anyone with a share link can read the part of a tree it covers without signing in, until the link expires, is revoked, or the tree is archived. Share links hide people's names and plans, and serve files through links that expire after 5 minutes. They ask search engines not to index them, but they are not secret from anyone the address reaches. Names or emails written into content itself are not hidden.
• Outbound triggers. When an organization's owner or admin sets up an outbound trigger, Hillclimb sends signed event messages to the address they choose. Each message includes the acting person's account identifier, name, and email address, and the event's data, which can include other people's email addresses. The recipient handles that information under its own practices.

Hillclimb is not built for public publishing. Your account email is not shown to people outside the organizations and grants described here unless someone includes it in content they share.

4. Service providers and other disclosures

We use Vercel Inc. for website and application hosting, scheduled jobs, and approximate visitor location for share-link visits; Databricks, Inc. (Neon) for the hosted database; Cloudflare, Inc. (R2) for storing files attached to evidence; and Plus Five Five, Inc. (Resend) for sign-in-code and invitation email. Providers receive the information necessary for the functions they perform, subject to their terms and our arrangements with them. Hosting and email providers also process technical delivery and security records. The current list, with each provider's role and location, is on the Subprocessors page. Fonts are served from our own site; your browser does not contact Google Fonts or other font services.

Google and GitHub handle sign-in when you choose them. They process your sign-in under their own privacy policies and learn that you signed in to Hillclimb.

If you connect an AI agent or other client, information available under the permissions you grant can be transferred to that agent's provider, which has its own privacy practices and may retain what it receives, use it as its own terms allow, or send it to its own AI model providers. That agent and provider act for you, not for us; they are not our service providers, and what they do with information they receive is between you and them. Only connect providers you trust. Revoking the agent's API key or OAuth authorization stops future access; signing out of the browser does not, and neither deletes copies a provider already holds. Destinations chosen for outbound triggers are likewise outside our control.

The /api/v1/visualize endpoint renders a submitted specification as a page and does not store it; our host's request logs still apply. The example tree at /example is fictional.

We may disclose information when reasonably necessary to comply with law or valid legal process, protect rights or safety, investigate abuse, or resolve disputes. A rights complaint and relevant contact details may be shared with the affected person or claimant as required to handle it. In a merger, acquisition, or asset transfer, information may transfer subject to applicable law and appropriate notice. We may also disclose information at your direction or with your consent.

5. Cookies and browser storage

Hillclimb uses only first-party cookies and browser storage, for sign-in, security, and remembering your display choices. We use no advertising, analytics, or third-party cookies. Google or GitHub may set their own cookies during their sign-in pages. Our infrastructure still processes operational logs.

Blocking cookies prevents sign-in. Signing out ends the session on our side; you can clear cookies and local storage with your browser's controls at any time. Local storage stays on your device and is not sent to us.

6. Retention and deletion

We keep account and organization records while your account or the organization exists, and keep security, support, and legal records as reasonably necessary for their purposes. Most records last as long as the account, organization, or tree they belong to, and are deleted with it. In particular:

• Sessions, emailed codes, OAuth tokens, activity events, and share-link visits are kept for the life of the related account, organization, or tree and deleted with it, or sooner on request. Deleting your account removes the ones tied to you, as described below. Sessions expire after 7 days of inactivity, sign-in codes after 10 minutes, OAuth access tokens after 1 hour, and refresh tokens after 30 days; expired ones can no longer be used. We don't yet clear them automatically; email us and we'll delete them.
• Sign-in rate-limit counters (which contain email or IP addresses) are replaced once their window has passed, the next time the same key is used; counters that are not reused can remain until we clear them. Hourly usage counts contain no personal information and are kept for the life of the organization.
• Evidence and plan revisions are append-only, and comments can be resolved but not deleted. This preserves the record of what was observed and decided. If something ends up there by mistake, such as a secret or someone's personal data, an owner or admin can ask us and we will remove that item or revision.
• Archiving a tree hides it everywhere, including share links, and can be undone. Deleting a tree (only after it is archived) removes its goals, outcomes, evidence, plans, comments, events, triggers, access grants, share links, and visit records. Files attached to its evidence are deleted from file storage at the same time.
• Deleting an organization is possible once it owns no trees, and also removes its files, views, teams, organization-wide triggers (including their URLs and secrets), and usage counts.
• Leaving or being removed from an organization removes your access, goal grants, and team places there. Your account is unaffected, and content you created stays with the organization, still attributed to you.
• Revoking an API key deletes it.
• Operational logs are kept by our hosting provider for about 1 day under our current plan.
• Backups. Our database provider keeps point-in-time restore history; deleted records remain in that history until it is overwritten, currently within 7 days.

Deleting your account

You can delete your account and the data tied to it yourself at any time after leaving every organization that has other members, or being removed from it by an owner or admin. Settings lists any such organizations; leave each one under Settings → Organization → Overview → Leave, and if you are its only owner, make someone else an owner first. Then go to Settings → General → Danger zone, type the confirmation, and enter a fresh code we email to you. Only you can do this, signed in as yourself: agents cannot delete an account through MCP or the API, and no one else in Hillclimb, including organization owners and admins, can delete your account. Owners and admins can only remove you from their organization, which keeps your account and the content you wrote there. If you can't sign in, email hello@hillclimb.me and we will verify the request and, under the same rules, delete the account for you within 30 days.

Deleting your account deletes your account and profile, your sessions on every browser, your Google and GitHub sign-in links and the tokens stored with them, your sign-in codes, your API keys, your connected agents' authorizations and tokens, your memberships, team places, and goal grants, and invitations you sent or received. Your claims on outcomes are released, and you are removed from assignments and approver lists; where you were a goal's only approver, the organization's owners take over approving it.

• Content you wrote in organizations you left, or in trees shared with you: goals, outcomes, evidence, plans, comments, and other content you or your agents created in an organization's trees belong to that organization and stay there, so its record of what was decided and verified stays intact. Files attached to your evidence and the history of your changes stay too. So that the organization keeps a record of who did what, all of it stays attributed to you by the name and email address your account had when you deleted it, shown as "(deleted account)" wherever people are named, including in the console, in tool and API results, and in outbound trigger payloads. We keep that name, email, and the time of deletion only as part of the organization's content, not as an account, and only if something of yours remains in an organization. Your email address is free to sign up again, as a new account. The organization's owners and admins control that content under our Data Processing Addendum and can delete the trees or organization it sits in, and can instruct us to remove your name and email from its records. To have them removed, ask that organization, or contact us and we will pass your request on and help it respond.
• Organizations where you are the only member are deleted with your account, including all their trees and files.

We keep your records of accepting our terms (the version, the notice you were shown, how and when you accepted, and the email address you used) for four years after your account is deleted, the Pennsylvania limitation period for contract claims, or longer while a dispute is pending, then delete them. We keep them to establish and defend legal claims, and use them for nothing else.

Deletion takes effect in our active systems when you confirm it. Copies in our providers' backups and restore history, and in their logs, lapse on those providers' schedules. If the law requires us to keep something else, we keep only that, use it only for that reason, and delete it when the requirement ends. Copies already sent to agents, trigger destinations, or other people remain beyond our control.

To request access, correction, or deletion of other information, email hello@hillclimb.me. We will verify the request and respond within the time applicable law requires.

7. Security

We use safeguards intended to protect information, including encrypted connections, access controls checked on the server for every request, hashed sign-in codes and API keys, short-lived signed links for files, sign-in rate limits, and approval rules organizations can set. No system or transmission is completely secure. Protect your API keys, review which agents you connect, and report suspected security issues privately to hello@hillclimb.me. Do not include live secrets in support messages, evidence, comments, or files.

8. Your choices and rights

You can edit your name and display preferences, leave an organization, revoke API keys, sign out, delete your account and the data tied to it in Settings → General → Danger zone (section 6 explains what organizations keep), choose which sign-in method to use, and decline optional features such as connecting agents. Organization owners and admins can revoke share links, disable triggers, remove members, and archive or delete trees.

Your US state privacy rights

Depending on the state where you live, such as California, Colorado, Connecticut, Virginia, and others with consumer privacy laws, you may have the right to:

• know and access the personal information we hold about you, including the categories and specific pieces;
• delete personal information we hold about you;
• correct inaccurate personal information;
• obtain a portable copy of your personal information; and
• opt out of the sale or sharing of your personal information, targeted advertising, and certain profiling. We don't sell personal information or share it for cross-context behavioral advertising, including information from Google or GitHub sign-in, and we don't use it for targeted advertising or profiling, so there is nothing to opt out of.

We don't use or disclose sensitive personal information beyond what is needed to provide Hillclimb, as described in section 2. We will not discriminate against you for exercising any of these rights, for example by denying you the service or providing a different level of it.

How to exercise them

Email hello@hillclimb.me with what you'd like us to do. You can also delete your account yourself in Settings, as section 6 explains. For content an organization controls, we will refer your request to that organization and help it respond.

We will verify your request by confirming that it comes from the email address on your account, for example by asking you to sign in or reply from that address. We may ask for proportionate additional information to verify identity or authority and protect other people's information; do not send identity documents or sensitive information unless we explain why they are needed and how to provide them.

You may use an authorized agent to submit a request where your state's law permits. We may ask the agent for proof that you authorized it and ask you to verify your identity with us directly.

We respond within the time your state's law requires and explain any permitted extension. If we decline your request, we will explain why. Where your state's law provides an appeal, you can appeal by replying to our decision or emailing hello@hillclimb.me with the subject "Privacy appeal"; we will respond within the time that law requires, and if you disagree with the outcome, you may contact your state attorney general. A privacy request does not require acceptance of a new version of the Terms.

9. Where we operate

Hillclimb is offered to businesses in the United States and operated by Desiderata from the United States. We and our providers store and process information in the United States, though some providers' distributed delivery and support infrastructure may operate elsewhere; see the Subprocessors page. Hillclimb is not directed to people or businesses in the European Economic Area, the United Kingdom, or Switzerland. If you use it from outside the United States, you do so on your own initiative, and your information will be processed in the United States under this policy.

10. Children

Hillclimb is a business service intended for people 18 and over. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action, including deletion where required.

11. Changes and contact

We will update the date and version above when this policy changes and provide notice of material changes as required. We will obtain consent where required before materially different processing. The current version is available at /legal/privacy and through the read_doc tool; earlier versions are available on request.

Desiderata LLC
4607 Library Road, Ste 220 PMB 630
Bethel Park, PA 15102
United States

hello@hillclimb.me