Privacy Policy
Last updated: October 21, 2026
hermes-agent ("the app") is a private, single-user AI assistant operated by Chris Prewitt ("the owner", "I"). This policy describes how the app accesses, uses, stores and shares information obtained through Google APIs. It applies to this app only, and to no other software or website.
1. What Google user data the app accesses
With the owner's consent, granted through Google's OAuth 2.0 consent screen, the app may access the following data in the owner's own Google account:
- Gmail — message headers and bodies, labels, and thread state; and the ability to create drafts and send mail the owner has explicitly approved.
- Google Calendar — event titles, times, locations and descriptions.
- Google Drive, Docs and Sheets — file contents the app is asked to read or edit.
- Google Contacts — names and email addresses, read-only, used to address mail.
2. How the data is used
Data is used only to carry out tasks the owner requests: summarising and prioritising email, drafting replies for review, reporting the day's calendar, and reading or editing documents on request. The app does not use Google user data for advertising, profiling, creditworthiness, lending, or any purpose unrelated to those tasks.
3. How the data is stored
The app runs on hardware owned and controlled by the owner. The OAuth refresh token is stored as a file on that machine, readable only by the owner's user account. Summaries and briefings the app produces are written to files on the same machine. Message content is not stored in any cloud database operated by the app, because the app operates no servers or databases.
4. Sharing and third parties
The app does not sell, rent or share Google user data with third parties, and does not transfer it to anyone for advertising or for training AI models.
To generate summaries and drafts, the text being processed is sent over an encrypted connection to a large-language-model API provider configured by the owner, solely to produce the requested output. That processing is governed by the provider's API terms, which prohibit use of API data for advertising and, for the provider selected, for model training.
No other person has access to the data, and no human other than the owner reviews it.
5. Google API Services User Data Policy — Limited Use
hermes-agent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Retention and deletion
Data is retained only as long as needed to produce the output the owner asked for. The owner can delete stored output files at any time. The owner can revoke the app's access entirely at myaccount.google.com/permissions, which immediately invalidates the stored token; deleting the token file has the same effect.
7. Security
Access uses Google OAuth 2.0 with a private client, and the refresh token is stored with owner-only file permissions on a machine that is not publicly reachable. The app never holds a Google account password.
8. Children
The app is not directed to children and is not available to anyone other than its owner.
9. Changes
If this policy changes, the revised version will be posted at this URL with an updated date.
10. Contact
Questions about this policy or the app's handling of Google user data: christopherprewitt@gmail.com