Privacy Policy

jun-hermes · Last updated 19 October 2026

This policy explains how jun-hermes (“the app”, “we”) accesses, uses, stores and shares information obtained from Google APIs when you connect your Google Account. The app is a personal, self-hosted integration for an AI assistant: it runs on the device of the person who installed it and acts only on that person's own Google Account.

1. Information the app accesses

After you grant consent on Google's OAuth screen, the app may access the following data in the account you selected:

• Gmail — message metadata, subjects, senders and message bodies, plus the ability to apply labels or mark messages read (gmail.readonly, gmail.modify) and to send a message you have reviewed (gmail.send).
• Google Calendar — your calendars, events, titles, times and descriptions, with the ability to create and modify events you ask for (calendar).
• Google Tasks — your task lists and tasks, with the ability to add, complete or edit them (tasks).
• Google Drive — the documents and files you open or create through the app (drive.file).
• Basic account information — the email address of the account you connect, used only to show which account is linked.

The app does not access Google data that is not covered by the scopes you approve, and it does not request scopes beyond what the features you use require.

2. How the information is used

Google user data is used solely to perform the actions you request of your assistant, for example:

• summarising new mail or finding a specific message;
• drafting a reply and sending it after you approve the text;
• listing, creating or moving a calendar event;
• adding or completing a task;
• exporting or filing a document you point the assistant at.

We do not use Google user data for advertising, profiling, credit assessment, or any purpose unrelated to the request you made. We do not use it to develop, train or improve machine-learning models.

3. Storage and retention

• Credentials. The OAuth refresh token is stored on your device only, encrypted at rest using the operating-system keychain, a local password manager, or an equivalent local encrypted store. It is not uploaded to, or retained by, the developer.
• Mail, calendar and file content. Processed in memory on your device to answer your request. It is not written to any server we operate.
• Local caches or logs. If the assistant keeps a local transcript of a conversation, it stays on your device and is under your control; it can be deleted at any time.
• Retention. Data is kept only as long as needed for the requested action. OAuth credentials persist until you revoke them or delete them.

4. Sharing and disclosure

We do not sell, rent, trade or transfer Google user data. We do not share it with third parties except:

• with the AI model provider you have configured for your assistant, and only to the extent needed to generate the response you asked for, under that provider's own terms; or
• where required by law, or to protect against fraud or abuse.

No human reads your Google data through this app.

5. Google API Services User Data Policy — Limited Use

jun-hermes's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide or improve user-facing features that are prominent in the app's interface;
• it is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice;
• it is not used for serving advertising, including retargeting or personalised advertising;
• it is not used to determine creditworthiness or for lending purposes;
• no humans read the data, except with your explicit consent, for security purposes, or to comply with law.

6. Your controls

• Revoke access at any time from Google Account → Data & privacy → Third-party apps & services. Revocation invalidates the token immediately.
• Delete local credentials by removing the stored token from your keychain or password manager, or by uninstalling the app.
• Request deletion of anything we hold — in practice only correspondence you have sent us — by emailing the address below; we respond within 30 days.
• Disconnect an account without revoking it globally by deleting the token stored for that account on your device.

7. Security

All communication with Google APIs uses HTTPS. Tokens are stored encrypted at rest on the user's device. The app requests short-lived access tokens and does not log their contents. Because the app runs on your own machine, the security of the device — disk encryption, screen lock, OS updates — is the primary safeguard for the stored credential.

8. Children

The app is not directed at children under 13 and does not knowingly collect data from them.

9. International users

The app runs on the user's own device, so data is processed wherever that device is. No transfer to a developer-operated server takes place.

10. Changes to this policy

Material changes will be published on this page with a new “last updated” date. Continued use after a change means you accept the updated policy.

11. Contact

Privacy questions and data requests: gjuoun@gmail.com.