Privacy Policy

Hermes Gmail Agent — last updated 29 September 2026

Hermes Gmail Agent ("the application") is a private automation tool operated solely by its owner for their own personal use. This policy explains what the application accesses and how that information is handled.

1. Who uses the application

The application is used by a single individual — the owner of the Google account that authorises it. It is not offered to the public, has no other users, and does not create accounts for anyone else.

2. What the application accesses

Only after the account owner explicitly grants consent, the application may access the following data belonging to that same owner:

• Gmail messages and labels (to read, search, label and send mail on the owner's behalf)
• Google Calendar events (to create, read and update the owner's own calendar entries)
• Google Drive, Sheets and Docs files owned by the owner
• Basic account profile information (name and email address)

3. How the data is used

Data is used exclusively to carry out tasks the owner has requested — for example, summarising incoming mail, adding a calendar event, or updating a spreadsheet. Data is never used for advertising, profiling, credit or lending assessment, or any purpose unrelated to the owner's own instructions.

4. Storage and retention

Access credentials (OAuth tokens) and any cached content are stored locally on the owner's own computer. Data is retained only as long as it is needed for the task at hand and can be deleted by the owner at any time. No copy of Google user data is stored on any server controlled by a third party.

5. Sharing and disclosure

Data is not sold, rented, traded or shared with any third party. It is not transferred to anyone else, and it is not used to train generalised machine learning models. Data may be sent to an AI model provider only as part of processing a task the owner requested, and such processing is limited to the content the owner chose to submit.

6. Security

Access is protected by Google's OAuth 2.0 authorisation framework. The tokens are stored on the owner's own device, and access can be revoked at any time from the owner's Google Account permissions page (myaccount.google.com/permissions). Once revoked, the application immediately loses access.

7. Google API Services User Data Policy

The application's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Changes to this policy

Any changes will be published on this page with an updated revision date.

9. Contact

Questions about this policy can be sent to hermeskwong25@gmail.com.