Privacy notice

How Hermes Mail handles mail data

Last updated: 31 October 2026

Hermes Mail is an owner-operated private mail system, not a public mailbox or multi-user service. This notice explains the planned and implemented data flows for the personal system as it is configured and rolled out. Some integrations are still being authorized and tested; this page does not mean every described service is currently live.

What Hermes Mail is allowed to read

For Gmail, the intended authorization is the exact gmail.readonly scope. The system uses OAuth authorization rather than asking for a Google password, backup code, or two-factor code. Other configured sources may use read-only IMAP access. Source mail is not changed by the read path: the system does not use Gmail or IMAP to delete, move, or modify source messages.

When a message is ingested, the local system may retain its raw MIME form, including headers, body parts, HTML, inline content, and attachments. It also keeps local processing, classification, and delivery records. The local database and raw-mail spool are owner-controlled files with restrictive permissions, but they are not encrypted at rest.

What data is processed

Message identity and headers: sender, recipients, subject, dates, message identifiers, and source identifiers.
Message contents: plain text, HTML, and other MIME parts needed to preserve or copy the original mail.
Attachments: attachments may be retained locally and copied unchanged when a message is selected for Outlook delivery under the owner's authorized rules. The current AI processing path does not submit attachment files to AI providers or execute them.
Operational records: cursors, hashes, job state, delivery state, error details, and local budget records. No automatic expiry or universal retention period is promised.

AI-assisted processing

For selected classification decisions, the system may send a bounded representation of mail data to an OpenAI API. The intended decision inputs include the sender, subject, and relevant message text so the system can classify signals such as whether a message contains a current one-time code and what language it uses. General translation and other processing may use the owner’s existing OpenAI Codex/ChatGPT subscription through Hermes.

The mail is treated as untrusted input. The decision client does not give the model tools, shell access, mailbox authority, or permission to fetch URLs. Attachments are not sent for execution and are not part of the intended classification input. Local limits and schema checks are applied to model output.

Provider limitation. Hermes Mail does not claim a provider-specific zero-retention guarantee. We do not use Google user data to develop, improve, or train generalized AI models, and the integration is intended for service processing rather than model training. Any downstream handling, retention, or account-level data use by an AI provider remains subject to that provider’s current terms, controls, and applicable law; those terms may change.

Gmail processing is not yet activated. Before enabling Gmail-to-AI processing, the owner must confirm that the applicable provider terms and account controls exclude use of Gmail data for generalized model training. This notice does not certify those provider settings or imply that Google has approved the application.

Where selected results go

Outlook: messages selected automatically under the owner's authorized classification rules, or explicitly requested by the owner, may be sent as real SMTP copies to an Outlook destination. The full original content and attachments may be included alongside a translation. Verification-code messages may be copied immediately without translation. This creates a separate copy governed by Microsoft/Outlook and the destination account's policies.
Discord: summaries, delivery status, and errors may be posted to a private owner-controlled Discord channel. A summary is not a promise that no mail data appears: relevant snippets or mail metadata may be included, but raw full mail is not sent by default. Discord retains what is posted under its own policies.
Google: the system uses Google API data only for the owner-authorized personal mail function described here. It does not sell that data, show advertising based on it, or share it except as needed for the intended services above and the owner’s operation of the system.

Google API Services User Data Policy

Hermes Mail’s use of Gmail API data is intended to comply with the Google API Services User Data Policy, including its Limited Use requirements. The application requests only the read-only Gmail access needed for the personal mail workflow, uses the data to provide that workflow, and does not use Google user data to develop, improve, or train generalized AI models. We do not transfer Google user data to third parties except where needed to provide the user-facing feature, with the owner’s direction, or as otherwise permitted by the policy and law.

Storage, retention, and deletion

Local raw MIME, SQLite databases, tokens, and processing records are stored under the owner’s control. Tokens are stored in owner-only files; this is access control, not encryption at rest. There is currently no automatic expiry policy. The owner controls deletion of local mail and records, and must separately delete copies already sent to Outlook or posted to Discord.

Revoking Google access or disconnecting a third-party account stops or prevents future access; it does not automatically delete local files or copies already delivered to Outlook or Discord. To request deletion from this owner-operated system, contact xjwxpo@gmail.com. The owner will handle local deletion and any separate third-party deletion steps that are available. Backups and provider retention are not covered by a blanket deletion guarantee.

Google access can be revoked at Google Account third-party connections by removing Hermes Mail's access. Previously issued access tokens may remain valid until Google's revocation takes effect.

This website

This is a small static website designed for Cloudflare Pages. The site has no login, OAuth callback, account creation, forms, analytics, or advertising, and does not set application cookies. Cloudflare may process IP addresses, browser and request metadata, security cookies, and infrastructure logs under its own service terms. Do not send private mail through this website.

Contact

For questions about this privacy notice or deletion of owner-controlled Hermes Mail data, email xjwxpo@gmail.com.