Privacy Policy

Hermes Agent · last updated 16 September 2026

Summary

Hermes Agent is a private, single-user personal assistant. It accesses one Google account — its owner's — with the owner's explicit consent, solely to carry out tasks the owner requests. The owner is the only data subject. This application does not sell, share, or transfer Google user data to anyone, does not use it for advertising, and does not use it to train or improve machine learning models.

Who operates this application

Hermes Agent is operated by Mohammed Alfadl ("the owner") for personal use. It is not a commercial service, has no public sign-up, and is not offered to other users. All questions about this policy or about data handling can be sent to moala057@gmail.com.

Google user data this application accesses

The application requests the following Google API scopes, and uses each one only for the purpose stated:

Gmail

• gmail.readonly — to read email so the owner can be briefed on what needs attention and asked to act on it.
• gmail.send — to send email on the owner's behalf, only when the owner explicitly asks it to.
• gmail.modify — to label, archive, and mark email as read as part of the owner's inbox triage requests.

Calendar

• calendar — to read the owner's calendar and create or update events when he asks, and to send reminders for upcoming commitments.

Drive, Docs and Sheets

• drive — to access files in the owner's own Drive that he asks it to work with.
• documents — to read and edit the owner's Google Docs.
• spreadsheets — to read and edit the owner's Google Sheets.

Contacts

• contacts.readonly — to look up contact details so the owner can be given accurate information about people he already knows.

How this data is used

Google user data is used exclusively to perform the specific task the owner has requested, in the moment he requests it, or to run scheduled jobs he has configured (such as a daily briefing). There is no secondary use of the data.

Storage and retention

• OAuth credentials (access and refresh tokens) are stored locally on a computer the owner controls, in a restricted file readable only by his user account.
• Email bodies, calendar contents, and file contents are not retained in a persistent database. They are fetched when needed, used, and discarded.
• The owner may revoke this application's access at any time at myaccount.google.com/permissions, which immediately ends all access.

What is never done with Google user data

• It is never sold or rented.
• It is never shared or transferred to third parties, except as strictly required to operate the assistant on the owner's instruction (for example, sending an email the owner asked to be sent).
• It is never used for advertising, profiling, or marketing of any kind.
• It is never used to train, fine-tune, or improve machine learning models.
• It is never made accessible to other users, because there are no other users.

Third parties

To function, the application sends the owner's requests to the language-model providers that generate responses. Only the minimum content required to answer a request is sent, and providers are used under terms that do not permit that content to be used for training. Google user data is never provided to any party for their own independent use.

Security

The application runs on a private computer controlled by the owner, reachable only over an encrypted private network. Google credentials are stored encrypted at rest, access is restricted to a single operating-system user, and no Google API endpoint is exposed publicly.

Children

This application is not directed at children and does not knowingly process data belonging to anyone under 13.

Changes to this policy

If this policy changes, the revised version will be published at this address with an updated date.

Contact

moala057@gmail.com