Privacy Policy

This policy describes how Hermes Personal Data Broker accesses, uses, stores, and protects Google user data. The app is operated by Matt Povey for private, single-user personal use.

Google user data accessed

Depending on the OAuth scopes authorized, the broker may access:

• Gmail message metadata, labels, snippets, headers, and message content for read-only search, thread lookup, and recent-mail context.
• Gmail compose access for creating drafts only. The app does not send, delete, or alter email through the compose flow.
• Google Calendar events, calendar metadata, and free/busy availability for scheduling, appointment lookup, and calendar draft workflows.
• Google Tasks task lists and task items for personal task lookup and draft-confirm task updates.

How the data is used

Google user data is used only to provide personal assistant functionality requested by Matt Povey, such as answering questions about email or calendar context, finding availability, preparing drafts, and reviewing tasks.

The broker may provide selected, policy-filtered results to the Hermes assistant so it can answer the user's request. The app does not use Google user data for advertising, profiling, resale, or generalized model training.

Storage and protection

OAuth tokens and synchronized data are stored in private broker infrastructure controlled by Matt Povey. Access is limited by operating-system permissions, service boundaries, bearer-token-protected broker routes, and least-privilege OAuth scopes.

The broker is designed to avoid exposing raw Google credentials to the Hermes assistant. Write-capable actions use separate tokens and draft-before-confirm workflows where applicable.

Sharing and disclosure

Google user data is not sold, rented, or shared with advertisers. It is not made available to public users. Selected data may be processed by configured personal-assistant inference services only to complete user-requested tasks, and not for this app to train generalized AI models.

Retention and deletion

Synced broker data is retained only for personal assistant operation and can be deleted from the broker storage controlled by Matt Povey. OAuth access can be revoked at any time from the Google Account permissions page, after which the broker must be reauthorized before it can access Google data again.

Contact

Questions about this policy can be sent to mjp-km [at] kyomu.org.