Privacy notice

Access and purpose

On its owner’s explicit request, Hermes/Morph searches and retrieves Gmail messages and metadata using only https://www.googleapis.com/auth/gmail.readonly. Selected data is used to answer questions, summarize relevant email, or prepare reply text in private chat.

The scope can allow broad mailbox reading. Relevant-on-request selection is an operating rule, not a narrower Google permission. There is no background mailbox monitoring.

The Gmail helper does not send email, create Gmail drafts, change labels, mark messages read, modify messages, or delete messages. It does not access Calendar, Drive, or Contacts. Reply text is prepared in chat.

OpenAI processing and permitted use

Selected message content, metadata, prompts, and relevant chat context are transmitted to OpenAI to generate requested answers, summaries, and reply text. Provider records may be retained under applicable service terms, account settings, and retention practices.

Google user data is used only to provide the requested personal email features, not sold or used for advertising or training general-purpose AI models. Data transfers are limited to delivering these features with the owner’s consent, security, legal obligations, and other uses permitted by Google’s Limited Use requirements.

Hermes/Morph use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including Limited Use requirements.

Storage and retention

OAuth tokens are kept in protected files on the private backend, not in this public site or its browser storage. No private assistant runtime or token endpoint is exposed by this information site.

Message content, generated answers, summaries, and reply text may remain in private local chat history, caches, or reports. Provider-held records may also be retained under the provider’s terms and settings. There is no fixed deletion period or comprehensive automatic deletion mechanism for these copies. A no-training commitment is not a zero-retention promise.

Revocation and manual cleanup

The owner can revoke access through Google Account third-party connections. Revocation prevents future access through that grant but does not automatically delete copies already present in local chat history, caches, reports, or provider records.

Contact the project owner using the support email shown on the Google OAuth consent screen to request manual cleanup of local copies. Cleanup requires appropriate owner approval and verification of what can be removed. This site has no deletion form or automated deletion endpoint. Provider-held records may require a separate request to that provider and are not erased by local cleanup.

Visitors to this site

These static pages do not access Gmail, initiate OAuth, or collect email content. They have no scripts, forms, intentional analytics, advertising trackers, cookies, client-side storage, third-party fonts, or remote assets.

Cloudflare, the static hosting provider, may retain ordinary request logs such as IP addresses, request times, requested URLs, and browser information. No promise is made that hosting infrastructure keeps no logs. External links are subject to their destination’s policies.

Questions and changes

Use the project-owner support email on the Google OAuth consent screen for privacy questions. This notice will be updated if the assistant’s functionality, providers, or data practices materially change. No Google verification, endorsement, or security certification is claimed.