Privacy Policy

1. Overview

This Privacy Policy describes how the Hermes Agent instances described in Section 2 (each an "Instance", together the "Instances") access, use, and store data. Each Instance is a deployment of the open-source Hermes Agent software and runs on a device controlled by the operator. The Instances are not public services and are not offered to the general public.

2. Instances covered by this policy

This policy applies to all Hermes Agent instances operated by Ted Hwang, comprising:

• a personal instance, used only by the operator; and
• team instances, used by small teams led by the operator, in which each team member is an authorized user of the shared Instance.

All Instances are governed by this single policy. This policy does not apply to any third-party service the Instances connect to.

3. Information accessed

With a user's explicit consent, obtained through Google's OAuth 2.0 authorization flow, an Instance may access the following Google account data belonging to that user:

• Gmail — read, compose, send, and modify messages and labels
• Google Calendar — read and manage calendars and events
• Google Drive — read, upload, download, and manage files
• Google Docs and Google Sheets — read and edit documents and spreadsheets
• Google Contacts (People API) — read contacts

An Instance accesses this data only to carry out tasks that the authorizing user requests.

4. Shared (team) instances

In a team Instance, more than one member may authorize their own Google account. Accordingly:

• each member authorizes their own account; no member's credentials are used to access another member's account;
• credentials for each authorized account are stored separately on the Instance's device and are not published to team chat channels;
• a member may revoke their authorization at any time, and the operator can remove a member's access from the Instance;
• members should be aware that work performed through a shared Instance — for example, files it creates or messages it sends — may be visible to other authorized users of that Instance.

5. How information is stored

OAuth access and refresh tokens are stored locally on the device that runs the Instance, in its local Hermes configuration directory, protected by file permissions limited to the accounts permitted to use that device. The Instances operate no external servers or databases of their own, and Google account data is not transmitted to the developer of the Hermes Agent software.

6. How information is shared

Google account data is not sold, rented, or shared with third parties. Content may be transmitted to the large language model provider configured for an Instance, solely to produce the responses the user requests; the operator controls which provider is configured. No Google user data is used for advertising, profiling, or training of general-purpose models.

7. Data retention and deletion

Data retrieved from Google is processed on the Instance's device and is retained only as long as needed to complete the user's tasks. Cached data can be deleted at any time. Authorization can be revoked at any time at myaccount.google.com/permissions, which immediately stops further access for that account.

8. Security

Stored tokens are protected by device file permissions limited to authorized accounts, and access is governed by Google's OAuth 2.0 framework. Tokens can be revoked by the user, or removed by the operator, at any time.

9. Compliance with Google API Services User Data Policy

The Instances' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10. Changes to this policy

Any changes to this policy will be posted on this page together with a revised effective date.

11. Contact

Questions about this policy may be sent to tedchwang@gmail.com.