Privacy policy

1. Scope

This policy applies to Hermes Operator, a private personal-use assistant. Hermes Operator is not offered to the public and has no public account registration. The application is operated for one authorised Google account.

2. Google data accessed

Depending on the permission granted, Hermes Operator may access:

• Gmail messages, threads, labels and attachments;
• Google Calendar events and calendar metadata;
• Google Drive files and file metadata;
• Google Docs and Sheets content required for requested tasks; and
• Google Contacts and profile information.

3. How data is used

Google user data is used only to provide the functions requested by the account owner: finding and interpreting information, organising email, preparing drafts, assisting with schedules, and working with authorised documents. Hermes does not use Google user data for advertising, profiling, credit decisions or unrelated analytics.

4. Processing and sharing

The minimum information necessary to complete a task may be sent to the AI model provider configured by the account owner. Data may also pass through infrastructure providers strictly where needed to operate the service. Google user data is not sold, rented or shared with data brokers, advertisers or unrelated third parties.

5. Storage and security

OAuth credentials, operational state and task outputs are stored on private, self-hosted infrastructure with restricted file permissions. Access is limited to the account owner and the software components required to operate Hermes. No security measure is absolute, but reasonable technical and organisational controls are used to protect stored information.

6. Retention and deletion

Data is retained only for as long as needed for active tasks, continuity and legitimate operational records. The account owner can remove locally stored data, revoke Google access at any time from Google Account security settings, or request deletion using the contact address below.

7. Google API Limited Use

Hermes Operator's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Changes and contact

This policy will be updated if the application's data practices materially change. Questions or deletion requests can be sent to privacy@richardsmith.one. This address is human-reviewed and is separate from Hermes' operational mailbox.