Privacy Policy

For the personal Hermes Google connection described here. Effective October 16, 2026.

This policy describes a personal Hermes installation. It is not a privacy policy for a public, multi-user service.

Google data accessed

With the account holder’s consent, the installation can request access to Gmail, Calendar, Drive, Contacts, Sheets, and Docs. The exact access is controlled by the OAuth permissions shown during authorization. The current setup includes Gmail read/modify/send permissions and access to the listed Workspace services.

How data is used

Google data is accessed to perform tasks requested by the owner, such as finding or summarizing email, reviewing calendar information, or working with Google files. The installation is configured not to send email without the owner’s explicit approval.

When the owner asks Hermes to analyze Google content, relevant content may be included in a request to the AI model provider configured for the installation (currently OpenAI) to generate an answer. That provider processes the request under its own applicable terms and privacy practices. This site does not claim that Google content is processed only on the device.

Storage and retention

OAuth credentials are stored in the owner’s Hermes installation environment, outside this public website. Google content and generated responses may appear in Hermes conversation history or local session records when needed to fulfill a request. Retention depends on the installation’s storage and retention settings; this policy does not promise a fixed deletion period.

The public information pages are static and have no forms, advertising, cookies, or analytics enabled. Cloudflare Pages is intended to host these pages and may process ordinary technical request information when serving them.

Sharing

Google data is not sold or used for advertising. It may be transmitted to the configured AI model provider as described above. The OAuth application’s External setting may let other Google accounts authorize their own accounts if they obtain the consent flow; it does not automatically share one account holder’s Google data with another.

Your choices

• Revoke the application’s Google access from your Google Account’s third-party connections/security settings.
• Remove the account’s OAuth token from the Hermes installation to stop future API access.
• Ask the operator to delete relevant local conversation/session records, subject to available backups and system retention.

This policy should be updated if the app’s scopes, model provider, storage, or sharing practices change.