Terms of Service

Effective date: November 6, 2026 · Version: 2026-11-06.1

The short version. This summary helps you find your way; the Terms below control.

• Your content is yours. We use it only to run Hillclimb for you. We don't sell it, publish it beyond what you share, show ads, or train AI on it. Hillclimb itself calls no AI.
• Hillclimb is free today. If that changes, we'll tell you in advance, and you'll pay only if you agree.
• Your organization decides who sees its trees. Share links, triggers, and connected agents send data only where you point them.
• Agents you connect act as you. Give them only the access they need, and keep a person in charge of anything hard to undo.
• A "verified" status records what someone showed as evidence. It isn't our certification.
• You can leave at any time: owners and admins can delete trees, and you can delete your own account in Settings.
• Because the Service is free and provided as is, our liability is limited (Section 12). The limit never covers fraud, gross negligence, or anything the law won't let us limit.
• Hillclimb is for businesses in the United States. If you use it from elsewhere, that's your choice and your risk, and your local laws are yours to follow (Section 1).
• Pennsylvania law and courts. No forced arbitration and no class-action waiver.
• We post changes here with a new version and date, and ask you to accept them when you next sign in.

Hillclimb, available at hillclimb.me, is operated by Desiderata LLC, a Pennsylvania limited liability company (“Desiderata,” “we,” “us,” or “our”). These Terms govern access to and use of our website, accounts, the Hillclimb console, organizations and trees, the REST API at /api/v1, the MCP server at /mcp, the agent skill and documentation, share links, inbound and outbound triggers, the public visualize endpoint, and the public example tree (the “Service”). They apply to all users, including visitors who read our pages or documentation, open a share link, or use a public interface without an account.

By accessing or using the Service, you agree to these Terms. If you do not agree, do not access or use the Service. Creating an account or signing in additionally requires affirmative acceptance. Sign-in and sign-up happen on the same page, which states: “By continuing, you agree to the Terms of Service and acknowledge the Privacy Policy.” Continuing from that page is your acceptance, and the email with your sign-in code repeats the notice. When an agent signs you in through the sign_in tool, the agent must show you these Terms and the Privacy Policy and may pass acceptTerms: true only after you agree; it then accepts on your behalf. We record the version you accepted and when. That additional requirement does not limit these Terms to account holders.

The Privacy Policy explains our data practices, and the Copyright & DMCA Policy forms part of these Terms. The Data Processing Addendum, including its Subprocessors disclosure, also forms part of these Terms where we process personal data on an organization's behalf, as described in Section 10. The disclaimers and liability limitations below are intended to apply to all use of the Service, including access without an account, to the extent permitted by applicable law.

1. Eligibility, accounts, and sign-in

Hillclimb is a business service. You must be at least 18 and able to enter a binding contract to create an account, and you must use the Service for business or professional purposes, not as a consumer. If you accept these Terms on behalf of an organization, “you” and “your” refer to that organization for that use, and you represent that you have authority to bind it. The individual operating the account must still satisfy the age requirement. Otherwise, you accept for yourself. Creating or administering an organization in Hillclimb for a company, team, or client is use on that organization's behalf. When you use the Service as a member or guest of an organization, you use it on that organization's behalf to the extent of your authority, and that organization, not you personally, bears the responsibilities in Sections 4 and 13 for that use. You remain personally responsible for use outside your authority or in breach of these Terms.

Where Hillclimb is offered

Hillclimb is offered to businesses in the United States and operated from the United States. It is not directed to people or businesses in the European Economic Area, the United Kingdom, or Switzerland, and we don't offer commitments specific to the GDPR or similar laws, such as EU or UK data-transfer clauses or a local representative. If you choose to use Hillclimb from outside the United States, you do so on your own initiative and at your own risk, and you are responsible for complying with your local laws, including any obligations for personal data you put into it.

Sign-in is passwordless: you continue with Google or GitHub, or with a six-digit code we email you. Your first sign-in creates your account. A Google or GitHub sign-in with the same verified email address joins the same account. You can be signed in to up to five accounts in one browser and switch between them. Use your own account rather than sharing one, keep your email account and identity-provider accounts secure, and provide accurate information.

API keys let software act as you. A key is shown once, when it is created; we store only a hashed form and cannot show it again. Treat each key as a secret, store it securely, give it only to software you trust, and revoke it when no longer needed. Anyone holding your key can act with your permissions until it is revoked or expires. You are responsible for activity you authorize through your account, including through API keys and connected agents. Tell us promptly at hello@hillclimb.me about suspected compromise, mistaken access, or a security vulnerability in the Service. Please give us a reasonable chance to fix a vulnerability before disclosing it, and do not access other people's data or degrade the Service to demonstrate one. These responsibilities do not make you liable for activity you did not authorize merely because our records attribute it to your account, or excuse a duty the law places on us.

2. What Hillclimb provides

Hillclimb keeps a ranked tree of goals, outcomes, and evidence for an organization's people and their AI agents. A goal is something to aim for, with a brief; position in the tree sets priority. An outcome is a checkable result under a goal, written as a user story with acceptance criteria, and carries a status of unverified, verified, or failing. Evidence is an observation that confirms, denies, or notes something about an outcome, with optional links and files. Plans and comments let people and agents propose and review how work will be done. Agents read the tree, claim the next outcome, do the work wherever it lives, and write back evidence and status.

Hillclimb has no AI of its own. It does not call AI models, generate content, write code, or check whether software works. People and the agents they connect do that work and record what they found. Hillclimb stores, ranks, and shows those records, and computes signals from them, such as which outcomes are next, “stale” (an outcome's meaning changed after its status was set), and “broken” (denying evidence arrived after its status was set).

Evidence and statuses are records, not certification

A “verified” status, “confirms” verdict, plan approval, or computed signal records what a person or agent wrote and when. It is not Desiderata's certification, audit, test, or warranty that software, a product, or a process works, is secure, or complies with any requirement. We do not review evidence, run the commands it describes, or confirm that its links, files, or summaries are accurate. Next-work ordering follows the tree as your organization arranged it; it is not advice about what your business should prioritize. Check the underlying evidence, at the version that matters to you, before relying on a status for a release, a customer commitment, or any consequential decision.

Public pages and interfaces

Our website, documentation, /llms.txt and related files, the agent skill, and the example tree at /example are public. The example tree is fictional and illustrative. The visualize endpoint at /api/v1/visualize renders a tree specification you post into a page and returns it; it does not store what you send. Public documentation and examples describe how the Service works at the time; they are not a commitment to keep any feature unchanged (see Section 4).

3. Organizations, roles, and access

Trees belong to organizations. An organization (the “customer”) controls its trees and the content in them, decides who may see and change them, and is responsible for how its people and agents use them. Roles in an organization are owner, admin, editor, and contributor. Owners and admins manage the organization's trees, members, teams, invitations, share links, triggers, and usage; editors shape the tree; contributors claim outcomes, add evidence, and set status. A goal can name approvers, whose sign-off is required before edits beneath it from non-approvers and from any agent take effect. Approval workflows are controls your organization configures; they help you govern changes but do not guarantee that an approved change is correct.

Owners and admins are responsible for whom they invite, the roles they assign, and what they share, and for removing access when someone's employment or authority ends. Access can also be granted on a single goal and everything beneath it, to a person with a Hillclimb account or to a team. Teams can include guests from outside the organization, who see only what the team is granted. Granting access to a goal discloses its content, including descendants, evidence, files, plans, and comments within that access, to the people you grant. Being able to reach content through the Service does not itself establish authority to commit an organization to anything.

Share links

Owners and admins can create read-only share links. Anyone with a share link's URL can view what it shares, without signing in, until the link is revoked, expires, or its tree is archived. Share-link pages hide people's names and plans but show the shared goals, outcomes, evidence, and evidence files. Treat a share link like a password: send it only to intended recipients, set an expiry where appropriate, and revoke links that are no longer needed. Revoking a link stops future access through it; it cannot recall copies or downloads a viewer already made. Share-link visits are recorded for the organization as described in the Privacy Policy.

Triggers

Owners and admins can create outbound triggers, which send signed event data to HTTPS URLs the organization chooses, and inbound triggers, which accept posted data at a secret URL and record it as evidence. Outbound trigger payloads include tree content and the acting person's identifier, name, and email address. The organization chooses those destinations and is responsible for them, including their security, the lawfulness of sending that data there, and the recipient's handling of it. Trigger recipients are not our service providers. An inbound trigger acts as the person who created it; anyone holding its URL can post evidence, and set outcome status if the trigger allows it, in that person's name until the trigger is deleted. Keep trigger URLs and signing secrets confidential and verify signatures on what you receive. Deliveries can be delayed, retried, or stop after repeated failures; do not rely on a trigger as your only record of an event or as a safety control.

4. Connected agents, the API, and AI tools

You choose whether to connect an agent, such as a coding assistant, through MCP, OAuth, an API key, or the skill. Hillclimb has no AI of its own: agents are third-party software that you, or someone in your organization, choose and run, and that act through Hillclimb on your behalf. An agent acts with the permissions of the person who authorized it. Within those permissions it can read the trees that person can see, create or change goals, outcomes, evidence, plans, comments, claims, and statuses, and take any other action the tools allow, including actions that change access or are hard to undo.

You are responsible for your agents

Your agent is software you choose and run, and Hillclimb can't see inside it, so we treat what it does with your access as done by you. The person who authorizes an agent, and the organization they act for, are responsible for everything the agent does with that authorization, as if they had done it themselves, whether or not they gave precise instructions, anticipated the action, or reviewed it first. That doesn't make you responsible for our own failures, or for access you never authorized (see Section 1). That includes content the agent writes, evidence and statuses it records, claims it makes, information it reads and passes to its provider, and changes it makes to access, sharing, triggers, and keys. By connecting an agent, you represent that:

• you have the authority to let it act for you and, where you act for an organization, for that organization;
• you have any consents and notices required for the information it will read, write, or send, including other people's personal information in your trees; and
• your instructions to it, and what it does in carrying them out, comply with these Terms and applicable law.

Review the provider and the access requested, grant only the access needed, and revoke API keys and disconnect agents you no longer use. Revocation stops future access. It cannot undo completed actions or recover copies an agent or its provider already received.

Keep a person in charge

Keep meaningful human oversight of what your agents do. Tools that change access or are hard to undo, such as sharing a goal, inviting someone, adding someone to a team, changing a role, creating an API key, share link, or trigger, accepting an invitation, or archiving or deleting a tree or organization, ask the agent to confirm with its person first and to say so when it calls them. We cannot verify that an agent asked you. An action an agent takes with your credentials while stating that it confirmed with you is treated as authorized by you, so set your agent to ask before anything hard to undo. You are responsible for use of API keys, OAuth tokens, and trigger URLs you issued until you revoke them or tell us they are compromised, except where the misuse results from our failure to secure the Service. Approvers can require that changes to goals and outcomes wait for a person's sign-off, and agents should approve only when their person asks. Only a person, signed in themselves, can delete an account. These are safeguards, not guarantees that an agent will follow them. Configure your agents to ask before acting where a mistake would matter.

Agents, OAuth clients, MCP clients, and AI services are not operated by us and have their own terms and privacy practices. OAuth clients register themselves with the Service and supply their own names and details; a client's appearance on a consent screen does not mean we have reviewed or endorse it. We do not guarantee their output, availability, security, or conduct.

Agent output can be wrong

AI agents make mistakes, including confident mistakes. An agent's evidence, summaries, plans, code, and claims of verification may be fabricated, incomplete, outdated, insecure, or wrong, even when they look correct. A status an agent sets is not independent proof that a criterion holds. Verify agent work before you rely on it, ship it, or make decisions with it. Nothing an agent produces through Hillclimb is legal, financial, security, medical, or other professional advice.

Content stored in Hillclimb, including briefs, criteria, evidence, comments, and organization and invitation names, is written by people and agents, sometimes outside your organization, and may contain misleading or malicious instructions. Configure your agents to treat it as data, not instructions. We do not screen content for instructions aimed at agents and are not responsible for what your agent does after reading it.

Our role

Connecting an agent does not make us your agent, fiduciary, partner, or employee, or make your agent ours. We do not direct your agent's actions or decide whether they achieve your goals. We may refuse, block, or limit an agent's request, or suspend a key or connection, when we reasonably believe it is unlawful, violates these Terms, threatens security or other users, or exceeds limits, even if you authorized it. We record which agent or key took each action, as described in the Privacy Policy, to attribute actions, secure the Service, and resolve disputes. We do not guarantee that an agent's request will be carried out, completed in time, or be reversible.

Limits and changes to the API

We apply rate, size, and usage limits to protect the Service. Current examples include 14,400 agent calls per organization per hour by default, limits on sign-in codes and attempts per email address and network address, files of up to 100 MB, and limits on the size of requests, evidence, plans, comments, and trees. The current limits are documented in our agent docs and returned by the Service. We may change limits, including for a particular organization, and may throttle or suspend automation that threatens the Service or other users. Do not evade limits, for example by creating extra organizations, accounts, or keys to multiply them.

We may add, change, deprecate, or remove tools, endpoints, inputs, outputs, and documentation. We will try to give reasonable notice of changes that break existing integrations, but we do not promise backward compatibility or a fixed deprecation period unless we agree in writing. The documentation, agent skill, and examples are provided as-is to help you use the Service. The public agent skill repository is offered under the MIT License. Third-party and open-source components keep their own licenses, which govern those components.

5. Your content, confidentiality, and licenses

You and your organization retain the rights you hold in the goals, briefs, outcomes, stories, criteria, evidence, files, plans, comments, organization names and logos, and other material you or your agents submit (“Your Content”). You represent that you have the rights and permissions necessary to submit Your Content, process it through the Service, and share it with the recipients you choose, including permission from employers, clients, collaborators, and other rights holders, and a lawful basis for any personal data it contains. These assurances apply each time you or your agents submit or update content.

For rights you own or are authorized to license, you grant Desiderata a nonexclusive, worldwide, royalty-free license to host, store, copy, process, transmit, and display Your Content as necessary to operate, secure, and support the Service, and to share it as you direct through the Service, including through access grants, teams, share links, triggers, and connected agents, and to allow our service providers to do so for us. This license does not authorize us to sell Your Content, publish it beyond the sharing you choose, or use it to train AI models. It lasts while we host the content, with limited continuation for backups, legal obligations, and copies already delivered as you directed.

Evidence and plan revisions are append-only, and the Service keeps a history of changes, so earlier versions remain visible to people with access to the tree. Comments can be resolved but not edited away. If a secret or personal data ends up in evidence, a plan, or a comment by mistake, an owner or admin can email hello@hillclimb.me and we will remove that item or revision. Rotate any exposed secret right away.

Confidentiality

Content in your organization's trees is private to the people, teams, agents, and share-link holders your organization gives access to. Desiderata treats Your Content as confidential: we use and disclose it only to provide, secure, and support the Service, as you direct, as described in the Privacy Policy and Data Processing Addendum, or as required by law. Only personnel and service providers who need access for those purposes, and who are bound by appropriate confidentiality obligations, may access it. People at Desiderata look at an organization's content only when it asks us to (for support), to investigate security or abuse, or when the law requires it. Where the law compels disclosure, we will limit it to what is required and, where lawful and practicable, notify the affected organization first. These duties do not cover information that is public without a breach, already lawfully known to us, independently developed, or lawfully received from someone without a confidentiality duty. Content is encrypted in transit and at rest by our providers, but not end-to-end, so our systems can read it to run the Service. Our responsibilities are subject to the limits and exceptions in these Terms.

Use another organization's nonpublic content that you can see, for example as a guest on a team or through a share link, only for the purpose for which it was shared, and do not disclose it further without authority.

Feedback

If you send us suggestions, bug reports, or proposals about the Service, we may use them without obligation to you. This does not give us rights in Your Content.

6. Acceptable use and enforcement

Do not use the Service to:

• break the law or infringe intellectual property, privacy, publicity, or other rights, including by submitting content you do not have the right to share;
• distribute malware, malicious files, or deceptive links, or store credentials, keys, or secrets that belong to others;
• submit other people's personal data without a lawful basis and any required notice or consent;
• submit health information, payment-card data, government identification numbers, or other specially regulated personal data, unless doing so is lawful and necessary for your use. Hillclimb is not designed for regulated data such as protected health information or payment-card data, and we do not sign business associate agreements or provide PCI-compliant handling;
• attack, probe, scan, or load-test the Service, or test its security, without our written permission (reporting a vulnerability you came across under Section 1 is welcome);
• access or scrape data you are not authorized to see, or circumvent access controls, approvals, rate limits, or other restrictions;
• use share links, triggers, invitations, or the visualize endpoint to send spam, deceive recipients, or exfiltrate data;
• plant content intended to hijack or manipulate other people's agents, such as hidden instructions to share, invite, change roles, create keys or links, approve changes, or reveal information;
• impersonate a person or organization, create accounts or organizations deceptively, or misrepresent who authored evidence or approved a change, including presenting an agent's evidence, approvals, or verification as a person's own review;
• run agents or automation that hide their automated nature where disclosure is required, or that chain actions across systems to evade our limits, attribution, or approvals;
• rely on Hillclimb or an agent's output as the sole basis for decisions with legal or similarly significant effects on people, such as employment, credit, housing, insurance, or access to essential services, without meaningful human review;
• sell, resell, sublicense, or provide the Service to third parties as a service bureau, except for your organization's own members, guests, and share-link recipients; or
• interfere with the Service or other users, or generate traffic intended to disrupt it.

These rules apply to agents and automation you authorize as they apply to you.

Comply with applicable export controls, import restrictions, and trade sanctions when accessing, uploading, or transferring content. Do not use the Service from or for a prohibited destination, recipient, or end use. Do not upload classified information, controlled technical data, or other material whose lawful hosting requires recipient, nationality, residency, or security commitments that we have not expressly agreed in writing to provide. Private access controls do not establish export-control compliance or a restricted processing location.

We may investigate reports and remove, restrict, or decline to host content, disable share links, triggers, or API keys, suspend accounts or organizations, or revoke access when reasonably necessary to enforce these Terms, address security concerns, comply with law, or protect others. Where practicable and lawful, we will notify the affected account or organization owner and give a chance to respond; urgent restrictions may precede notice. To report a concern or appeal a decision, email hello@hillclimb.me with the relevant URL or organization, the decision, and why you believe it was mistaken. We do not review every item of content or promise to detect every violation. This process does not limit copyright counter-notices, privacy rights, access to courts, or other remedies required by law.

7. Copyright reports

Our Copyright & DMCA Policy explains how to submit an infringement notice or counter-notice and how we handle repeat infringement. It forms part of these Terms. Send reports to hello@hillclimb.me, addressed to Desiderata LLC, Copyright Manager. We act expeditiously on qualifying notices and do not require a court order or copyright registration as a precondition to considering a notice.

We adopt and reasonably implement a policy of terminating repeat infringers in appropriate circumstances, accommodate and do not interfere with standard technical measures within the meaning of 17 U.S.C. § 512(i), and may restrict content or accounts on other lawful grounds.

8. Fees and usage

Hillclimb is currently free. We meter usage, such as agent calls, evidence, storage, and active trees, per organization, and owners and admins can see it. We may introduce paid plans or usage limits in the future. We will give reasonable advance notice before introducing charges, and charges will apply to you only after you agree to them. Until then, the free Service remains subject to the limits in Section 4.

9. Availability, suspension, and termination

We may change, limit, suspend, or discontinue features, subject to applicable law and any express agreement with you. Some features may be labeled beta or preview; they may change or be withdrawn more readily and may have more defects. Unless separately agreed in writing, we do not provide a service-level agreement, support response time, or uninterrupted access. Keep independent copies of content that matters to you; the Service is not a guaranteed backup or archival service.

You can stop using the Service at any time. Owners and admins can archive a tree, which hides it everywhere, including from share links, and can restore it. They can then permanently delete an archived tree, which removes its goals, outcomes, evidence, plans, comments, triggers, access grants, and share links and cannot be undone. Uploaded evidence files are handled as described in the Privacy Policy. An organization can be deleted once it owns no trees, except that an organization whose only member deletes their account is deleted with it. You can delete your account yourself at any time after leaving every organization that has other members, or being removed from it by an owner or admin, from Settings → General → Danger zone, after typing a confirmation and signing in again with a fresh emailed code. Only you can delete or request deletion of your account; agents and API keys cannot, and no one else in Hillclimb, including organization owners and admins, can delete your account. Owners and admins can remove you from their organization, which keeps your account and your content there. If you can't sign in, email hello@hillclimb.me and we will verify your request and delete your account for you within 30 days. The Privacy Policy explains what deletion removes and what is kept, including content you created in organizations shared with others. Deletion cannot be undone, so before deleting an account or organization, retrieve what you want to keep through the console or the API.

We may suspend or terminate your access, or an organization's, if you materially breach these Terms, if required by law, or if continued access creates a security risk or risk of harm to others. We may also end the Service or your access for convenience. We will give at least 30 days' notice, posted on the site, and a reasonable opportunity to retrieve your content, before ending the Service or your access for convenience. Immediate restrictions may be needed for security, legal requirements, or serious abuse.

To the extent permitted by law, we are not responsible for delay or failure caused by events beyond our reasonable control, such as natural disasters, utility or network outages, failures of third-party infrastructure, or governmental restrictions. This does not excuse our own failure to satisfy a nonwaivable duty.

10. Data protection

When we process personal data in Your Content and related records on an organization's behalf, we act as its service provider and processor and the Data Processing Addendum applies. Owners and admins accept the Data Processing Addendum on the organization's behalf by accepting these Terms; an acceptance recorded at sign-in counts from the time the person holds that role. The Subprocessors page lists the providers that help us run the Service. The organization is responsible for having a lawful basis to submit personal data, for giving any required notices, including to people whose names or emails appear in its trees or are sent through its triggers, and for configuring access appropriately. Where the Data Processing Addendum conflicts with these Terms on the processing of personal data, the addendum controls. We store and process data in the United States, as Section 1 and the Data Processing Addendum describe, but do not promise a particular region unless we agree in writing.

11. Warranty disclaimer

To the fullest extent permitted by law, the Service, documentation, agent skill, and content we provide are supplied “as is” and “as available,” without express, implied, or statutory warranties, including merchantability, fitness for a particular purpose, title, and noninfringement. We do not warrant that the Service, a status, a signal, a ranking, evidence, an agent's output, or an integration is accurate, complete, secure, or fit for your needs, or that the Service will be uninterrupted, error-free, or free of data loss. No support response, documentation example, or status shown in the Service creates an additional warranty from Desiderata. Nothing here excludes warranties that cannot legally be excluded.

12. Limitation of liability

Hillclimb is free today, so we limit what we can owe you. Unless the law says otherwise, the most we'll pay for all claims together is the greater of US$100 or what you paid us in the 12 months before the claim, and that limit never covers fraud, willful misconduct, gross negligence, or anything the law doesn't let us limit. The full terms:

To the fullest extent permitted by law, Desiderata and its members, managers, employees, contractors, and representatives will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or lost profits, revenue, data, goodwill, business opportunities, or costs of substitute services arising out of the Service. To that same extent, our aggregate liability arising out of or relating to the Service will not exceed the greater of US $100 or the amount you paid us for the Service in the 12 months before the event giving rise to the claim. These limitations apply to claims in contract, tort (including ordinary negligence), or other legal theories, including claims involving inaccurate evidence or statuses, software or releases shipped in reliance on the Service, AI agent output, actions an agent took with your authorization (including ones you did not intend, such as wrongly changed statuses, shared information, granted access, or deleted content), unauthorized agent actions, share links or triggers you configured, and data loss, even if a loss was foreseeable and even if a limited remedy fails of its essential purpose, but always subject to the following exceptions.

The cap is a combined aggregate limit for Desiderata and the protected persons identified above, not a separate allowance for each claim, organization, tree, or legal theory. Subject to the exceptions below, it also applies to claims for rework, incident response, data restoration, and the cost of correcting decisions made in reliance on the Service. Describing these losses does not make every such loss indirect or exclude a remedy that the law preserves.

These exclusions and limits do not apply to fraud, willful misconduct, recklessness, gross negligence, death or personal injury caused by negligence where exclusion is prohibited, or any other liability that applicable law does not allow us to exclude or limit. Some jurisdictions do not permit particular exclusions or limitations; in those jurisdictions, they apply only to the extent permitted. These Terms do not transfer a statutory duty that the law places on us. Mandatory protections prevail over every conflicting provision of these Terms, including indemnities.

13. Responsibility for third-party claims

To the extent permitted by law, you agree to indemnify, defend on our reasonable request, and hold Desiderata and its members, managers, employees, contractors, and representatives harmless from third-party claims, damages, and reasonable expenses, including legal fees, arising from Your Content, your infringement of another's rights, your unlawful conduct, your material breach of these Terms (including confidentiality and data-protection obligations), the actions of people, agents, and API keys you authorize, or data you send through triggers or share links, to the extent attributable to your acts or omissions. This does not apply to the extent a claim results from our own wrongful conduct.

We will give reasonably prompt notice of a claim and cooperate in its defense. A delay in notice reduces your obligation to the extent it materially prejudices the defense. We may elect to control the defense with reasonably qualified counsel, with reimbursement limited to reasonable costs actually covered by this indemnity; you may participate through your own counsel. Neither party may settle a covered claim in a way that requires the other to admit fault, make a payment, or undertake an obligation without that party's written consent, which must not be unreasonably withheld.

14. Disputes and governing law

Please contact us first to try to resolve a dispute. This is a request, not a requirement to exhaust an internal process before filing a claim. It does not prevent urgent relief, interrupt a filing deadline, or restrict reporting to a regulator. Pennsylvania law governs these Terms, excluding its conflict-of-law rules, except where mandatory law requires otherwise. Subject to nonwaivable rights to bring a claim elsewhere, disputes will be heard in the state or federal courts in Allegheny County, Pennsylvania, and the parties consent to those courts. These Terms do not require arbitration or waive class proceedings.

15. General terms and changes

These Terms, the policies and addendum they incorporate, and any expressly agreed feature-specific terms form our agreement regarding the Service. A separate written agreement expressly made with Desiderata controls over these Terms only for the subject and conflict it specifically addresses. Purchase orders, content stored in the Service, or agent instructions cannot amend our agreement or bind Desiderata merely by being submitted or processed. If a provision is unenforceable, the remaining provisions continue to apply. Failure to enforce a provision is not a waiver. You may not assign your account or these Terms without our consent; we may assign them with a business transfer subject to applicable law, without relieving the successor of the obligations it assumes. Ownership, licenses already granted, confidentiality, and provisions intended to apply after termination survive to the extent applicable.

Using the Service does not create an employment, partnership, joint venture, fiduciary, or agency relationship with Desiderata, and does not authorize you to make commitments on our behalf. Desiderata and its licensors retain rights in the Service's software, branding, and other materials except as granted under an applicable license. Subject to these Terms, we permit you to access the Service for its intended purposes. This does not grant ownership of our software or permit copying it or bypassing its protections, except as a separate license or applicable law allows. Permission to use the Service does not grant permission to use our marks or suggest our endorsement; lawful descriptive references remain permitted. No third party gains rights to enforce these Terms merely by receiving a share link, trigger delivery, or invitation, except persons expressly protected by a provision to the extent the law permits. The disclaimers, liability limits, responsibility for third-party claims, and dispute provisions continue to apply after account closure or discontinued use to matters arising during your use.

We may update these Terms and will change the version and effective date. Prior versions are archived and available on request. We post every change at its usual address with a new version and date; the version is also returned by list_docs, so you or your agent can watch for it. The next time you sign in, the sign-in page asks you to accept the current version. Using the Service after the new version's effective date, including through an API key or connected agent, is acceptance of that version. Changes do not retroactively remove accrued rights. You agree to receive notices electronically. We provide notices, including changes to these Terms and our other policies, by posting them on the site, and a notice posted there is given when posted; we may also email your account's address where law requires. Send legal notices to us at hello@hillclimb.me with the subject "Legal notice". Keep your contact information current. You may decline revised Terms by stopping use and deleting your account; you may still request access to or deletion of your personal information, report a concern, and revoke API keys without accepting revised Terms. Contact us for a copy of the version recorded with your acceptance.

16. Contact

Desiderata LLC
4607 Library Road, Ste 220 PMB 630
Bethel Park, PA 15102
United States

hello@hillclimb.me