Privacy policy

1. Purpose and operator

Hermes Studio is operated by its account owner for personal assistance. It is not a public email, calendar or AI service. For privacy questions, contact the installation owner directly or use the support email displayed on the Google authorization screen.

2. Google data accessed

With the owner's explicit OAuth consent, the installation can access:

• Basic Google account identity, including name and email address, to identify the authorized account.
• Gmail messages, attachments, threads and labels, for approved searches, reading, drafting, sending and mailbox management.
• The list of accessible calendars and calendar events, including event details, dates, guests and locations, for approved planning and event management.

The configured permission scopes are gmail.modify, calendar.events and calendar.calendarlist.readonly, plus basic account identity. These do not grant general access to Google Drive, Contacts, Docs or Sheets.

3. How data is used

Google data is used only to provide the owner's requested personal assistance: finding relevant information, summarizing approved content, preparing drafts and carrying out separately approved actions. The assistants must obtain human approval before private reads and external actions.

This installation does not sell Google user data, use it for advertising or use it to train generalized AI or machine-learning models.

4. Processing and sharing

A local model is used by default. If the owner explicitly selects an external model provider, such as OpenAI, the content necessary for the approved task may be sent to that provider for processing, subject to its applicable terms and data practices.

Google receives API requests needed for the authorized operations. Approved sends, forwards, attachments or calendar invitations disclose their specified contents to the recipients reviewed by the owner. Access to one assistant does not authorize it to share private data with another assistant without approval.

5. Storage, protection and retention

OAuth credentials are stored encrypted on the owner's private computer, with filesystem access restricted to the owner's operating-system account. The application is accessed over the owner's private network. This public website does not contain OAuth tokens or mailbox data and does not provide a route into the private application.

Conversation history, approved working files and saved memories may contain information used in a task. The owner controls their retention and deletion. Revoking Google access does not itself erase information previously retained in conversations or files.

6. Revoking access and deleting data

The owner can revoke the Google connection at any time in Google Account third-party connections. The owner can also remove the local OAuth credentials and delete relevant Hermes conversations, memories and working files. Someone whose information appears in the owner's records can contact the owner directly with a request.

7. This public website

These are static information pages. They do not ask visitors to sign in, collect form submissions, embed analytics or set application tracking cookies. The hosting and DNS providers may process ordinary connection and security information, such as IP addresses and request logs, to deliver and protect the website.

8. Changes

This policy will be updated if the installation's data practices change. The effective date identifies the current version.