Privacy Policy

hermes-yudhi · Personal OAuth integration · Last updated 21 October 2026

1. Scope

This policy covers the application hermes-yudhi ("the Application"), a private, self-hosted personal automation tool operated by a single individual for their own use. The Application is not distributed publicly and has exactly one user: the owner of the Google Account that authorises it.

2. What Google user data is accessed

With the owner's explicit authorisation, the Application accesses:

• Google Sheets — spreadsheets created and owned by the owner.
• Gmail — the owner's own messages, and the ability to send as the owner.
• Google Calendar — the owner's own calendar events.
• Google Drive and Docs — files and documents owned by the owner.
• Google Contacts — the owner's own contact list, read-only, used to resolve names.

3. How data is used

• Data is used solely to perform actions the owner explicitly requests through the Application's interface.
• Data is not used for advertising, profiling, scoring, or any secondary purpose.
• Data is not used to train, fine-tune, or improve machine-learning models.
• Data is not sold, rented, or licensed to anyone.

4. Storage and security

• OAuth credentials are stored on a private server controlled by the owner, in a file readable only by the owner's operating-system account, with permissions restricted to that account.
• Credentials are never transmitted to any third party.
• The Application does not operate a public server that stores other people's data.

5. Disclosure to third parties

Google user data is not disclosed to third parties, except where strictly necessary to communicate with Google's own APIs on the owner's behalf, or where required by law. Where the Application uses a language model to help draft or summarise content, only the minimum text needed to complete the owner's request is sent, at the owner's direction.

6. Retention and deletion

Data is retained only as long as needed to perform a requested action. The owner may delete all locally stored data at any time by removing the credentials file and any cached copies on their own server. Revoking access (see below) stops all further access immediately.

7. Google API Services User Data Policy

The Application's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Use of Google user data is limited to the practices disclosed in this policy.

8. Revoking access

Access can be revoked at any time at myaccount.google.com/permissions. Revocation takes effect immediately.

9. Changes

Material changes to this policy will be reflected in the "last updated" date above.

10. Contact

swahyuinfo@gmail.com