1. Access and accounts
You must provide accurate account information and keep it current. You are responsible for activity performed through your account and credentials.
API keys are confidential. Keep them in server-side secret storage; do not publish them, commit them to source control, or include them in client-side code. You must promptly revoke and replace a key if you know or reasonably suspect that it has been exposed.
You may use only the permissions and services granted to your account. You may not share, sell, transfer, or sublicense credentials unless Josh gives you written permission.
2. Permitted use
You may use the APIs to build, operate, and support applications that comply with these terms, the applicable documentation, and all laws and regulations that apply to you.
You may not:
- access or attempt to access data, accounts, permissions, or systems you are not authorized to use;
- circumvent rate limits, security controls, usage restrictions, or technical protection measures;
- probe, scan, or test vulnerabilities except under a written security-testing authorization from Josh;
- use the APIs to distribute malware, facilitate fraud, harass people, violate privacy, or infringe intellectual-property rights;
- interfere with the APIs or impose an unreasonable load on the service;
- misrepresent your identity, your application, or its relationship with Josh; or
- use API output to make high-impact decisions about a person without appropriate human review and a lawful basis.
3. Data and privacy
You may request, collect, retain, and use only the data needed for the user-facing function you clearly disclose. You are responsible for providing required notices, obtaining required consent, honoring deletion or access requests, and maintaining a lawful basis for your processing.
Protect API data using reasonable administrative, technical, and physical safeguards. Do not expose API data to another party except as needed to provide your disclosed service and under protections at least as strong as these terms.
If you discover unauthorized access, use, or disclosure involving an API or API data, revoke affected credentials, contain the incident, and notify security@josh.one without unreasonable delay. Include enough information for Josh to understand and help contain the incident.
Josh’s handling of personal information is also governed by any privacy notice presented for the applicable service.
4. Operation, limits, and changes
Josh may apply and change request, storage, or usage limits to protect users and keep the services reliable. Do not create multiple accounts or keys to evade a limit.
APIs may evolve. Josh may add, change, deprecate, or remove features and may release backward-incompatible versions. When practical, Josh will provide advance notice of a material change through documentation, the account agreement record, or the contact information associated with your account.
Beta, preview, or experimental features may change or stop without notice and may be subject to additional terms.
5. Ownership and feedback
Josh and its licensors retain all rights in the APIs, documentation, service software, names, and branding. These terms give you a limited, non-exclusive, non-transferable, revocable right to use the APIs only as described here.
You retain rights in your application and content. You give Josh the limited rights needed to transmit, process, store, and display content solely to operate, secure, support, and improve the services and meet legal obligations.
If you voluntarily provide feedback, Josh may use it without restriction or compensation to you.
6. Risk and responsibility
The APIs are provided “as is” and “as available.” To the extent permitted by law, Josh disclaims implied warranties, including merchantability, fitness for a particular purpose, non-infringement, and uninterrupted or error-free operation.
To the extent permitted by law, Josh will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenues, data, goodwill, or business interruption arising from the APIs.
To the extent permitted by law, Josh’s total liability arising from the APIs will not exceed the greater of (a) the amount you paid Josh for the affected API during the 12 months before the event giving rise to the claim or (b) US $100.
You are responsible for your application, users, content, security, legal compliance, and use of API output. You will defend and indemnify Josh from third-party claims arising from your application, content, or violation of these terms, except to the extent caused by Josh’s own misconduct.
7. Suspension and termination
You may stop using the APIs at any time and may revoke credentials in your Josh account. Josh may suspend or terminate access when reasonably necessary to prevent harm, respond to a security risk, comply with law, address nonpayment, or enforce these terms.
When practical, Josh will give notice and an opportunity to cure. Immediate action may be taken when delay could harm a person, the service, or another system. Sections that by their nature should survive termination—including ownership, responsibility, disclaimers, liability limits, and general terms—will survive.
8. General terms
Additional service-specific terms presented in your account may apply. If they conflict with these API terms, the more specific terms control for that service.
Josh may update these terms. Material updates will be identified by a new effective date and, when they affect your existing access, may be presented in your account for review. Continuing to use the APIs after updated terms take effect constitutes acceptance where permitted by law.
You may not assign these terms without Josh’s written consent. If any provision is unenforceable, the remaining provisions remain in effect. A failure to enforce a provision is not a waiver. These terms, together with incorporated service-specific terms, are the entire agreement concerning the APIs.
Questions about these terms may be sent to legal@josh.one. Security reports should be sent to security@josh.one.