Privacy Policy

Hermes Agent — last updated 28 October 2026

Hermes Agent is a private, self-hosted assistant used by a single person: its owner. This policy explains what Google user data the application accesses, why, and what happens to it.

1. What data is accessed

• Gmail: message metadata, bodies and attachments needed to read, search, label, draft or send mail the owner asks about.
• Google Calendar: calendar lists, event titles, times, locations, descriptions and attendees, to read and to create or change events.
• Google Drive: file names, metadata and file contents the owner opens or asks to upload or organise.
• Google Docs and Sheets: document and spreadsheet contents that the owner reads or edits.
• Contacts: names and email addresses, read-only, to resolve recipients.

2. How it is used

Only to carry out the owner's own requests inside a chat with the assistant — for example "summarise unread mail", "move Thursday's meeting to Friday", "put this file in the shared folder". Data is never used for advertising, profiling, resale, or training models.

3. Where data is stored

The application runs on the owner's own server. OAuth tokens and the contents pulled from Google stay on that server, in files readable only by the application's operating-system account. Conversation history is kept locally so the owner can review past work.

4. Sharing

• No Google user data is sold, rented, published or shared with third parties.
• No transfers to third parties except as required to operate the model that answers the owner (the assistant's inference provider sees the text of the request it is answering), and where required by law.
• No human reads the data, apart from the owner themself.

5. Retention and deletion

Data is retained only as long as it is useful to the owner, or as kept in the local conversation history. The owner can delete it at any time by removing the local files, and can revoke all API access instantly at myaccount.google.com/permissions.

6. Google API Services User Data Policy — Limited Use

Hermes Agent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Data is used only to provide or improve the owner-facing features described above.
• Data is not transferred to third parties except as needed to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior consent.
• Data is not used for serving advertisements.
• No human reads the data except the owner, for support the owner requests, for security purposes, or to comply with law.

7. Security

Credentials are stored in files with owner-only permissions on the server; the connection uses OAuth 2.0 with a revocable, refreshable token and no password is stored for Google access.

8. Contact

Questions about this policy: whoeverstuff@gmail.com