Effective date: November 3, 2026 · Last updated: November 3, 2026
Hermes Agent is a private, single-user personal assistant operated by Zak Holt
on his own home server. It is not a commercial product and has no users other
than its operator. This page describes how the application handles data when it
is authorized to access the operator's Google account.
What the application accesses
Google Calendar (scope https://www.googleapis.com/auth/calendar)
for the operator's own Google account, solely to read his personal calendar
and to create or move calendar reminders for his own household tasks.
The application requests no access to Gmail, Google Drive, Google Contacts,
Google Sheets, or Google Docs.
How the data is used
Calendar events are read to generate a daily summary for the operator and
to find free time when placing task reminders.
Events created by the application are ordinary calendar entries owned by
the operator's own calendar.
Data is used only to provide these personal functions to the operator.
It is never used for advertising, profiling, creditworthiness, or any
automated decision-making about any other person.
Storage and retention
OAuth credentials and short-lived calendar caches are stored on hardware
controlled by the operator. No calendar data is stored on a third-party
server operated by this application.
Daily summaries are saved as private notes in the operator's personal
note vault and can be deleted by him at any time.
Cached calendar data is transient and replaced as new summaries are built.
Sharing
No data is sold, rented, or shared with advertisers, data brokers, or any
other third party.
No analytics or tracking technologies are used on this page or in the
application.
Data leaves the operator's server only in the requests needed to call the
Google Calendar API, where Google's own privacy policy governs Google's
processing.
No human other than the operator reads the data.
Google API Services User Data Policy
Hermes Agent's use and transfer of information received from Google APIs
adheres to the
Google API Services User Data Policy,
including the Limited Use requirements.
Revoking access and deleting data
Access can be revoked at any time at
myaccount.google.com/permissions,
which immediately stops all further access. Because the application is a
single-user tool, revoking access also removes the only account it can act on.
Stored notes and caches on the operator's server can be deleted directly on
that server.
Security
Credentials are stored with restricted file permissions on hardware the
operator controls, and access is limited to the operator's own account. API
traffic is encrypted in transit over HTTPS.
Changes to this policy
Any material change will be reflected here with an updated date. This policy
is not retroactive.
Contact
Questions about this policy or the application's data handling:
zak.j.holt@proton.me.