Privacy Policy

Hermes Robet — effective 9 November 2026.

This policy describes how the application Hermes Robet ("the app") handles Google user data. The app is operated privately by its owner, Robert Devi Yanu Wibisono, for his own accounts only.

1. What data the app accesses

After the owner grants consent, the app may access the following data from the owner's own Google accounts, limited to the scopes he approved:

• Gmail — message metadata and content, read-only or read/write depending on the account.
• Google Calendar — events, calendars and settings.
• Google Drive and Docs — files the owner can already see, to read and export documents.
• Google Sheets — spreadsheets used for the owner's own reporting.
• Google Contacts — contact names and addresses.
• Google Chat — spaces and messages, read-only, on the owner's Workspace account.
• Basic profile — name, email address and profile picture, to identify the account.

2. How the data is used

Data is used only to perform tasks the owner asks his assistant to perform: summarising mail, preparing briefings, reading and writing calendar events, compiling spreadsheet reports, and searching the owner's own documents. Nothing is used for advertising, profiling of other people, or resale.

3. How the data is stored

• OAuth refresh tokens are stored encrypted (AES-256-GCM with a PBKDF2-derived key) on a private server the owner controls.
• The server is reachable only over the owner's private network (Tailscale); its data services are not exposed to the public internet.
• Fetched content is processed locally and cached only as long as needed for the task.

4. Sharing

No Google user data is sold, rented, or shared with third parties. Data is not used to train machine-learning models outside the owner's own deployment, and no human other than the owner reads it. The app's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

5. Retention and deletion

Data is kept only while it is needed for the owner's tasks. Access can be revoked at any time at myaccount.google.com/permissions, which immediately invalidates the stored tokens. To request deletion of any cached copy, write to the address below and it will be removed.

6. Security

Tokens are encrypted at rest, file permissions are restricted to the owner's unix account, and no credential is ever transmitted to a third-party service. If a token is ever exposed, it is revoked and reissued.

7. Children

The app is not directed to children and has no users other than its owner.

8. Changes

Material changes to this policy will be published on this page with a new effective date.

9. Contact

Robert Devi Yanu Wibisono — privacy@robertwibisono.com