1. Purpose

The integration connects my Hermes Agent to my own Gmail, Google Calendar and Google Contacts account so that it can retrieve information and take actions that I request. Access is authorised through Google OAuth and is limited to the permissions shown on Google’s consent screen.

2. Google data accessed

• Gmail: message content and metadata are read and searched, and messages may be labelled, archived or moved to the bin. Hermes includes send and reply functions and the Gmail permission is technically capable of sending email, but I do not use those functions for this integration.
• Google Calendar: event details are read and events may be created. Hermes includes an event-deletion function and the Calendar Events permission is technically capable of deleting events, but I do not use that function for this integration.
• Google Contacts: contact names and details are read. Contacts are not created, changed or deleted.

The OAuth scopes requested are:

• https://www.googleapis.com/auth/gmail.modify
• https://www.googleapis.com/auth/calendar.events
• https://www.googleapis.com/auth/contacts.readonly

3. How the data is used

Google data is used only to provide the personal assistant functions I request, such as finding information in email, organising messages, reviewing or adding to my schedule, and identifying contacts. It is not sold, used for advertising, used for credit or lending decisions, or used to train or improve a general-purpose or non-personalised AI or machine-learning model.

4. Storage and sharing

OAuth tokens: OAuth tokens are stored locally in Hermes’ managed credential storage on my privately administered system. The Google token file is restricted to its operating-system owner (file mode 600). The underlying storage is not encrypted.

Google data: Google data is processed through my self-hosted Hermes installation. Information returned in a conversation can be retained in Hermes’ local session database as part of the full message history, and information may be added to Hermes’ local memory when requested. Automatic pruning is enabled for this profile: ended sessions are normally deleted after 30 days of inactivity. Active or pinned sessions and separately saved memory remain until I end, unpin or delete them as applicable. The Hermes application-data folder is backed up to a locally administered NAS; backup copies remain until they are overwritten or deleted under my backup arrangements.

AI processing: Content needed to answer my requests may be sent to OpenAI’s Luna model through OpenAI Codex OAuth. I have disabled “Improve the model for everyone” on my OpenAI account. OpenAI processes and retains this content under the terms and retention controls applicable to my OpenAI account; I do not claim a fixed retention period that has not been confirmed.

Other recipients: No other hosting, analytics or monitoring provider receives Google data. OpenAI receives only the content sent for the requested AI processing described above. The local NAS backup remains under my administration.

5. Security

I operate Hermes on an access-restricted, privately administered system and keep its software updated. Its Google token file has owner-only permissions. Administration is restricted to my local network and remote access through a VPN. Access is limited to me and the systems needed to operate the integration.

6. Control and deletion

I can revoke access at any time from my Google Account connections. Ended, unpinned Hermes sessions are automatically pruned after 30 days of inactivity. I can delete data sooner by deleting the relevant session, removing related Hermes memory entries and deleting applicable backups. OAuth tokens are deleted when the integration is disconnected or no longer used.

8. Contact

Operator: Richard Mines
Email: richard@mines.uk