This policy describes the privately operated Hermes Personal Assistant, used by its owner for personal productivity and home automation.
The assistant processes voice recordings and transcripts, chat messages, notes, task details, calendar information, and relevant smart-home information. Google Calendar access may include event titles, descriptions, attendees, times, locations, and calendar identifiers when needed for a request. A service-account private key is stored on the private server to authenticate access to calendars explicitly shared by the owner. Short-lived access tokens are generated automatically. Retired user-OAuth credentials may remain in restricted backups until removed.
Information is used to fulfill the owner's requests, such as checking availability, scheduling events, saving notes, creating tasks, and delivering reminders. Relevant information, including calendar information when needed, may be sent to the configured AI model provider for processing. Calendar requests are sent to Google; confirmations and reminders may be delivered through Telegram. Requested tasks and notes are sent to Todoist and Obsidian Sync respectively.
The operator does not sell personal information or use Google user data for advertising. Google user data is used for the requested assistant functions, not to train the operator's own AI models. Each connected service and AI provider also applies its own privacy and retention policies.
Recordings, transcripts, processing records, conversation history, and credentials may be retained on the private server until the owner removes them. Notes, tasks, messages, and calendar events remain in their destination services until removed there. Copies may remain in backups under the owner's backup settings.
Connections use HTTPS, the recording endpoint requires authentication, and server files are restricted to the operating account. The owner can remove calendar sharing for the service account, delete its key in Google Cloud, and remove server-side credentials. Any previous user-OAuth authorization can also be revoked in Google Account settings. Revoking authorization does not automatically delete previously created calendar events, notes, tasks, messages, or archived recordings.
For access, deletion, or privacy questions, contact the owner using the support email displayed on the Google authorization screen.