Last updated: October 20, 2026
Hermes Agent ("Hermes", "the Application") is a personal automation assistant operated by Peter Selby ("the Operator"). This policy describes how the Application accesses, uses, stores, and protects Google user data, in accordance with the Google API Services User Data Policy, including its Limited Use requirements.
Hermes is a self-hosted software agent that performs tasks at the direction of its users: managing calendars and calendar events, and finding, reading, and editing documents and files. It runs exclusively on infrastructure owned and controlled by the Operator. It is not a public service: it is used only by the Operator and a small number of members of the Operator's household and personal acquaintances whom the Operator has invited individually. It is not offered, sold, or advertised to anyone else.
The Application requests the following OAuth scopes, and only these:
https://www.googleapis.com/auth/calendar.readonly — to view
the user's calendars and events.https://www.googleapis.com/auth/calendar.calendarlist — to
see which calendars the user has subscribed to.https://www.googleapis.com/auth/calendar.calendars — to view
and manage calendar properties, and to create secondary calendars at the
user's request.https://www.googleapis.com/auth/calendar.events — to view
and edit events on the user's calendars.https://www.googleapis.com/auth/calendar.events.owned — to
view and edit events on calendars the user owns.https://www.googleapis.com/auth/calendar.app.created — to
manage calendars, and events on calendars, that the Application created for
the user.https://www.googleapis.com/auth/calendar.events.public.readonly
— to view events on public calendars when the user asks.https://www.googleapis.com/auth/documents — to read and edit
Google Docs documents at the user's request.https://www.googleapis.com/auth/docs — to locate, read, and
edit files in the user's Google Drive at the user's request.The Application does not request access to Gmail, Contacts, or any other Google service.
Google user data is accessed solely to perform tasks the user explicitly requests, such as adding an event to their calendar or finding and summarizing a document. To understand and carry out a request, the Application may send the relevant portion of that data (for example, an event's details or a document's text) to the AI language-model provider the Operator has configured, solely to generate a response to that request. Google user data is not used to train machine-learning or AI models, whether by the Operator or by any provider; it is not used for advertising; and it is not used to develop or improve any other product or service.
Authentication tokens are stored locally, on servers physically controlled by the Operator, with file-system permissions restricting access. Data the Application reads or creates is stored only in the user's own Google services (for example, their calendar) or on the Operator's own systems. The Operator does not operate any external database of user data.
The Application does not sell, share, transfer, or disclose Google user data to any third party, except as described above for processing an individual request with the configured AI language-model provider, which acts as a service provider and may not use the data for any other purpose. Google user data is never used or transferred for advertising, retargeting, data brokerage, or credit-worthiness purposes. No person reads a user's data other than that user, except where the user has asked for it or where necessary for security or to comply with applicable law.
Google user data is retained only as long as needed to perform the requested tasks. A user may ask the Operator to delete their stored data at any time by writing to the address below, and may revoke the Application's access entirely at any time via Google Account permissions; the Operator then removes that user's stored tokens.
Access credentials are protected with operating-system file permissions and are never transmitted except to Google's OAuth and API endpoints, over encrypted connections.
Material changes to this policy will be reflected on this page with an updated date.
Questions may be directed to admin@fudo.org.
Hermes Agent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.