Privacy Policy

Hermes Agents — last updated 15 September 2026

Summary

Hermes Agents is a private, self-hosted personal assistant operated by one individual for their own use. It accesses only that individual's own Google account, with their explicit consent. No data is sold, shared, or transmitted to any third party, and the application has no users other than its owner.

Who operates this application

This application is operated privately by the holder of the Google account it accesses. It is not a company, not a commercial service, and is not made available to other people.

Google permissions requested, and why

Scope	Purpose
`gmail.readonly`	Read the owner's own email so the assistant can summarise, search, and answer questions about it.
`gmail.send`	Send email on the owner's behalf, at the owner's request.
`gmail.modify`	Organise the owner's own mailbox — labelling, archiving, and marking messages read.
`calendar`	Read and create events in the owner's own calendar, such as scheduled routines and reminders.
`drive`	Read and write files the owner asks the assistant to work with.
`contacts.readonly`	Resolve names to email addresses when the owner asks the assistant to contact someone.
`spreadsheets`	Read and update the owner's own spreadsheets.
`documents`	Read and write the owner's own documents.

How data is handled

Where it goes. Data retrieved from Google is processed on hardware owned and physically controlled by the account holder. It is not uploaded to any external service.
Credentials. OAuth tokens are stored locally in files readable only by the operating-system account that runs the application. They are never displayed, transmitted, or shared.
Retention. Content is held only for as long as needed to carry out the task requested, plus local logs kept for troubleshooting. Nothing is retained in any external database.
Sharing. None. No data is sold, rented, shared, or disclosed to any third party, and none is used for advertising or profiling.
AI processing. Language models used by the assistant run locally on the owner's own hardware. Google user data is not sent to third-party AI providers for training.

Limited Use

Use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Revoking access

Access can be withdrawn at any time at myaccount.google.com/permissions. Revoking access immediately and permanently ends the application's ability to reach any Google data.

Changes

Any change to this policy will be published on this page with an updated date above.