Privacy Policy
Hermes — private, single-user AI agent. Last updated: 30 October 2026.
This policy describes how Hermes (“the Application”) accesses, uses, stores and shares information obtained from Google APIs. The Application is operated privately by a single individual (“the Owner”) on the Owner's own infrastructure. It has no other users and is not offered to the public.
1. Google user data the Application accesses
Only with the Owner's explicit consent, and only for the Owner's own Google Account, the Application may access:
- Gmail (
gmail.readonly,gmail.modify,gmail.send) — message and thread content, headers, labels and attachments. - Google Calendar (
calendar) — calendar lists and event details. - Google Drive, Sheets and Docs (
drive,spreadsheets,documents) — files, spreadsheets and documents owned by the Owner, when an optional document workflow is used. - Google Contacts (
contacts.readonly) — contact names and email addresses, for addressing messages.
2. How the data is used
- Solely to perform tasks the Owner explicitly requests — for example searching or summarising email, drafting or sending a reply, or creating and updating a calendar event.
- Google user data is never sold, never rented, and never shared with or transferred to third parties.
- Google user data is never used for advertising, profiling, or marketing of any kind.
- Google user data is never used to train, fine-tune or improve machine learning models, whether by the Owner or by any third party.
- Access is limited to the minimum required for the requested task.
3. How the data is stored
- OAuth 2.0 credentials and refresh tokens are stored locally on the Owner's own private server, in a file readable only by the Owner's service account, and are never transmitted to any third party.
- Message, calendar and document content is processed in memory to fulfil a request. It is not retained beyond the completion of that request, except where the Owner has deliberately saved a note or artefact in their own storage.
- No copy of Google user data is stored in any cloud service operated by a third party.
4. Third-party sharing
The Application does not share Google user data with any third party. It does not use advertising networks, analytics services or data brokers. Any language model used to interpret a request is self-hosted by the Owner or operated under the Owner's own account; no Google user data is passed to an external party for processing.
5. Retention and deletion
- The Owner may revoke the Application's access at any time at myaccount.google.com/permissions, which immediately stops all further access.
- Deleting the OAuth token file on the Owner's server removes all stored credentials.
- Because the Application does not retain copies of Google user data, there is no separate data set to delete after a request completes.
- Requests to access or delete any data held by the Application can be sent to the contact address below.
6. Security
- Authentication uses Google OAuth 2.0; the Owner's Google password is never seen or stored by the Application.
- The Application runs on a private, firewalled server; its API is not exposed to the public internet.
- Credentials are protected by filesystem permissions and encrypted storage.
7. Compliance with Google API Services User Data Policy
The Application's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: Google user data is used only to provide or improve the features that are prominent in the Application's interface and are directly relevant to the Owner's requested actions; it is not transferred to others except as necessary to provide those features, for security purposes, or to comply with applicable law; and it is not used or transferred for advertising purposes.
8. Children
The Application is not directed at children and has no users other than the Owner.
9. Changes to this policy
Any material change will be published on this page with an updated revision date.