Privacy Policy

Hermes Personal Automation — Last updated: 20 September 2026

This Privacy Policy describes how Hermes Personal Automation (“the application”, “we”) accesses and handles information when it connects to Google services. The application is a private, self-hosted tool operated by a single individual (the “owner”) on the owner’s own computer. Its only user is the owner.

1. Who we are and who this policy covers

The application is not a company, product, or public service. It has no servers that accept user data, no sign-up, and no users other than the owner of the Google account that authorises it. This policy therefore describes the handling of one person’s data: the owner’s.

2. What Google data the application accesses

The application accesses only the owner’s own Google data, and only after the owner grants permission on the Google consent screen. The specific scopes and their purposes are:

Google Calendar

• https://www.googleapis.com/auth/calendar — read the owner’s own calendars to produce a daily schedule briefing, detect conflicting meetings, and compute preparation time. The application may also create or edit an event when the owner explicitly requests it.

Google Drive

• https://www.googleapis.com/auth/drive.readonly — read documents and files the owner shares with the application, in order to summarise them for the owner.
• https://www.googleapis.com/auth/drive.file — create or update files the application itself produced at the owner’s request (e.g. a generated report).

Google Sheets

• https://www.googleapis.com/auth/spreadsheets — read and update the owner’s own tracking spreadsheets, such as a personal research-paper inventory.

Google Docs and Slides

• https://www.googleapis.com/auth/documents.readonly — read the owner’s documents in order to summarise their contents.
• https://www.googleapis.com/auth/presentations.readonly — read the owner’s presentations in order to summarise their contents.

Gmail

• https://www.googleapis.com/auth/gmail.readonly — search and read the owner’s own mailbox to prepare summaries and draft replies.
• https://www.googleapis.com/auth/gmail.modify — apply labels and mark messages as read so the owner’s inbox stays organised.
• https://www.googleapis.com/auth/gmail.send — send a reply or message only after the owner has reviewed and explicitly approved the text.

Google Contacts

• https://www.googleapis.com/auth/contacts.readonly — resolve contact names and email addresses when the owner is scheduling or addressing mail.

3. How Google user data is used

Google user data is used solely to provide the features above to the owner. The application does not use Google user data for advertising, profiling, creditworthiness, or lending decisions, and does not use it to train, fine-tune, or improve any machine-learning model.

4. Sharing and disclosure

We do not sell, rent, trade, or otherwise share Google user data with third parties. There are two narrow exceptions, both under the owner’s direct control:

• Language-model processing. When the owner asks the application to summarise or draft text, the relevant content may be transmitted to the large-language-model provider the owner has configured, for the sole purpose of generating that response for the owner. No separate copy is retained by the application for any other purpose.
• Legal requirement. Data may be disclosed if strictly required by applicable law, in which case only the minimum necessary would be provided.

The application’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Storage, security, and retention

• Where data lives. OAuth credentials and any cached content are stored only on the owner’s own computer, in a directory readable only by the owner’s operating-system user account.
• Transmission. All communication with Google APIs uses HTTPS/TLS.
• Retention. Cached content is short-lived and exists only to produce the output the owner requested. Credentials are retained until the owner revokes them.

6. Deletion and revoking access

The owner can revoke the application’s access to their Google account at any time at myaccount.google.com/permissions. Revoking access invalidates the stored credentials immediately, after which the application can no longer read or modify any Google data. Any local files produced by the application can be deleted by the owner directly from their own computer.

7. Children’s privacy

The application is not directed to children and collects no data from anyone other than its single adult owner.

8. Changes to this policy

If the application’s data handling changes, this page will be updated and the “Last updated” date above revised.

9. Contact

Questions about this policy can be sent to: shunbaik100@gmail.com