Hermes Personal — Privacy Policy
Last updated: October 17, 2026
Purpose and operator
Hermes Personal is a private assistant operated for its owner's use. This policy describes this personal installation, rather than all deployments of the open-source Hermes software. Questions or deletion requests can be directed to the app owner using the support email displayed on its Google authorization screen.
Google information accessed
With the owner's authorization, the assistant can read Gmail message information and content, including message headers and labels, and Google Calendar information, including event times, titles, descriptions and participants. Calendar access can include calendars accessible to the connected Google account.
The installation requests gmail.readonly and calendar.readonly. These permissions do not allow sending email, changing message labels or read status, creating Gmail drafts, or creating, changing or deleting calendar events.
How information is used and shared
Information is used to provide the owner's requested summaries, answers, suggested replies and planning assistance. Selected message or event information can be sent through OpenRouter to the configured DeepSeek model provider to generate an answer. The owner should understand that hosted providers process the information submitted to them under their applicable terms and privacy policies.
The assistant sends its responses to the owner's selected conversation channel: Telegram or a private Matrix service. Information included in those responses is consequently processed or stored by that channel. Voice notes sent by the owner are transcribed using Groq; this is separate from Google account authorization.
The public information website does not publish connected Google data, credentials or private conversations. The assistant is not configured for advertising, data sales, or training a general-purpose model on the owner's Google data. This statement does not make a guarantee about a provider's independent retention practices; these depend on the selected service and account settings.
Public website hosting
These information pages are hosted on Cloudflare. Requests to the site may be processed in Cloudflare service and security logs, including standard connection information such as IP addresses. The pages do not include an assistant login, analytics scripts or forms for collecting Google data.
Storage and protection
Google OAuth credentials are stored in the private assistant account on the owner's server, with file access restricted to that account and server administrators. Conversation history and tool results may retain retrieved content on the server and in the selected messaging service. Encrypted server backups may also contain retained data and credentials.
The assistant is instructed not to copy private email or calendar content into shared project memory unless the owner specifically requests it. Access is limited to the owner's configured messaging account or room. These measures reduce exposure but do not eliminate all security risks.
Retention, revocation and deletion
The owner can revoke the connection using Google's third-party connections controls. Revocation stops further authorized Google access; it does not automatically erase copies already present in chat history, local records, backups or service-provider systems.
There is no automatic deletion deadline for all assistant conversation history. The owner can remove local credentials, delete local conversation records and request deletion through the relevant messaging or AI service controls. Backup copies remain until removed or expired by the backup retention policy. Removing this Google connection does not delete the original Gmail messages or Calendar events.
Changes
This page should be updated before changing the Google permissions, processing providers or data practices described here. Additional capabilities require separate authorization.