jun-hermesYour AI agent, connected to your own Google account.
jun-hermes is an OAuth 2.0 integration for a self-hosted personal AI assistant. It lets the person running the assistant read mail, manage tasks and calendar events, and open documents in their own Google Workspace account — with explicit consent, and with credentials that never leave their machine.
What the app does
Gmail
Reads and searches the user's own mailbox so the assistant can summarise what arrived, find a specific message, or draft and send a reply the user asks for.
Calendar
Lists upcoming events and creates, moves or cancels the events the user requests.
Tasks
Adds reminders and checklist items, and marks them complete when the user says so.
Drive & Docs
Opens, exports and files the documents the user points it at — for example archiving a receipt PDF into the right folder.
Every action is initiated by the account owner in conversation with their assistant. There is no background crawling, no mailbox mining, and no data sent anywhere the user did not ask for.
How it works
- Authorization. The user starts the sign-in from their own machine. The browser opens Google's OAuth 2.0 consent screen, which lists exactly the scopes requested and the Google account that will be connected.
- Consent. Google returns an authorization code to the app's redirect endpoint
(
/oauth2/callback) or to the loopback address of the desktop app. The code is exchanged once for a refresh token over TLS. - Local storage. The refresh token is stored encrypted on the user's own device — in the operating-system keychain or a local password manager. It is never uploaded to a third-party server, and no copy of it is kept by the developer.
- On-demand use. When the user asks the assistant to do something in Google, the app exchanges the refresh token for a short-lived access token and calls the Google API for that one action.
- Revocation. The user can revoke access at any time from Google Account permissions or by deleting the local token.
How Google user data is handled
| Question | Answer |
|---|---|
| Who can use the app? | The single person who installed and configured it on their own machine. There is no multi-tenant service and no public sign-up. |
| Where does data go? | Google API responses are processed in memory on the user's device to answer the user's request. Message and file contents are not stored on developer-operated servers. |
| Is data shared or sold? | No. Google user data is not sold, rented, transferred or shared with third parties, and is not used for advertising. |
| Is data used to train models? | No. Google user data is not used to train, fine-tune or improve any machine-learning model. |
| How long is it kept? | Only for as long as needed to perform the requested action. OAuth credentials persist until the user revokes access or deletes them. |
These practices follow the Google API Services User Data Policy, including its Limited Use requirements. The full details are in the privacy policy.
Scopes requested
| Scope | Why the app needs it |
|---|---|
gmail.readonly / gmail.modify | Find and read the message the user asks about, and apply labels or mark read when asked. |
gmail.send | Send a reply only after the user has reviewed and approved its text. |
calendar | List, create and update the user's own events. |
tasks | Create, complete and list the user's reminders. |
drive.file | Create and open documents and files the user explicitly selects. |
Narrower scopes are used wherever they are sufficient; write access is requested only for the operations described above.
Contact
Questions about the app, privacy or a data-deletion request: gjuoun@gmail.com.