Privacy Policy

Hermes Google Access · last updated 23 October 2026

Scope

This policy covers Hermes Google Access, a private automation tool that runs on its owner's own computer and is used by that one person alone. There are no other users, no accounts, and no server operated by this application.

What Google user data is accessed

With the user's authorization, and only for the account that granted it, the tool reads:

• Google Calendar — event titles, times, locations and calendars of the authenticated account, read-only.
• Gmail — message headers and body text needed to identify mail that requires attention, read-only. The tool does not label, archive, delete, mark as read, or send mail.

No other Google data is requested. The scopes the tool asks for are declared on its authorization screen, and access can be revoked at any time at myaccount.google.com/permissions.

How the data is used

Solely to produce a short daily summary — the day's appointments and any message that appears to need attention — which is displayed to the owner on their own machine. The data is not used for advertising, profiling, analytics, or any purpose other than that summary.

What is stored, and where

• The OAuth credentials (client ID, secret and refresh token) are stored on the owner's own computer, in files readable only by that user.
• Message content is processed in memory and is not persisted beyond a short-lived local cache used to avoid repeating items already reported.
• Nothing is uploaded to the developer, to this website, or to any cloud service.

Sharing and disclosure

Google user data is never sold, rented, transferred or disclosed to any third party — no advertisers, no analytics providers, no data brokers. It is not used to train machine-learning models and it is not read by any human other than the account owner.

Limited Use

This application's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion

No server-side copies exist. Locally, credentials and cached content remain until the owner deletes them; revoking the application's access at myaccount.google.com/permissions makes the stored token unusable immediately, and deleting the local files removes them.

Security

Credential files are stored with owner-only permissions on a single machine. The tool runs unattended but performs read operations only.

Contact

Questions about this policy can be sent to the support address listed on the application's Google authorization screen.