Data & permissions
Privacy policy
A clear account of what this personal integration is designed to do, and what still needs confirmation.
1. Who operates the integration
Cowork OS Hermes is a personal, self-hosted Hermes Agent integration operated by Michael Mulcahy. It is intended for the owner’s use with Google Drive, rather than public account registration. Privacy and support contact: hostmaster@cenlink.com. The owner must confirm this mailbox is active and monitored.
2. Google Drive access and purpose
The integration requests https://www.googleapis.com/auth/drive, Google Drive’s full read/write scope. This can permit viewing, creating, editing, and deleting files accessible to the connected Google account, within the account’s existing permissions.
Depending on the task, retrieved data may include file names, file identifiers, folder information, other file metadata, and document or file contents. The intended purpose is to retrieve relevant context on demand and carry out explicitly approved modifications.
Creating, editing, moving, sharing, and deleting Drive content require explicit owner approval under the intended workflow. These operating rules do not reduce the underlying OAuth permission or establish that technical approval controls have been verified.
3. AI providers and other processing
Retrieved content, prompts, and related task context may be transmitted to configured AI providers to produce responses, summaries, analysis, or proposed actions. Processing may take place outside the self-hosted environment. Provider retention, processing locations, human access, and training or model-improvement practices depend on the selected service and account settings.
Owner confirmation needed: identify each provider receiving Google-derived data, what is sent, the applicable service tier and data-use settings, and links to the relevant provider policies. Confirm any other tools or services receiving that data. This draft makes no claim that all processing stays local, that no third parties receive data, or that providers never retain or train on submitted content.
4. OAuth credentials and security
The integration uses Google OAuth authorization to access Drive. This static information website does not implement an OAuth callback or collect Google credentials, tokens, or Drive content.
Owner confirmation needed: document how authorization tokens and any retained content are stored and protected, who can access them, how logs handle sensitive information, and how credentials are revoked or removed. No specific encryption, access-control, or audit implementation is asserted here.
5. Storage, retention, and deletion
Drive-derived content and task context may persist in conversation history, agent state, logs, caches, backups, or provider systems, depending on configuration.
Owner confirmation needed: specify which of these stores are actually used, their retention periods, backup expiry, deletion procedure, and any provider-side limits. No automatic deletion period or immediate erasure guarantee has been established.
6. Disconnecting and managing data
The account owner can review and remove the app’s Google authorization using Google Account third-party connections. Revocation stops future access under that authorization; it does not itself delete previously retrieved data, conversation history, logs, or provider-held copies.
For removal of retained integration data, contact hostmaster@cenlink.com. A verified deletion process and response timeframe remain to be confirmed. The owner can also stop using the integration and review retained data within the systems they operate.
7. This public website
The supplied website consists of static informational pages. It includes no application JavaScript, analytics scripts, advertising, tracking pixels, embedded third-party content, forms, or browser-storage features. Fonts and visual assets are served with the site.
When hosted on Cloudflare Pages, Cloudflare handles web requests and may process connection information such as IP addresses and request metadata under its privacy policy. The hosting account’s logging, analytics, and security settings require owner confirmation. Changes to those settings may require an updated disclosure.
8. Google API data-use requirements
Use and transfer of information received from Google APIs must comply with the Google API Services User Data Policy, including Limited Use requirements, and the applicable Google Workspace API user-data policy.
Owner confirmation needed: verify that the actual integration and each receiving provider satisfy the applicable requirements, including restrictions on training generalized AI models with Workspace user data. This draft does not certify compliance or Google verification.
Owner review before publication
- Confirm the role-based contact mailbox works and is monitored.
- Identify AI providers and any other data recipients, with their policies and relevant data-use settings.
- Confirm storage locations, retention periods, backups, and deletion procedures.
- Verify approval enforcement, token protection, access controls, and logging practices.
- Confirm any sale, advertising, human access, or secondary-use practices; make only verified statements.
- Confirm hosting settings and applicable Google API policy compliance.
9. Updates
Material changes to the integration’s data handling should be reflected here before the changed practice is used. Replace the draft date and review notices once the owner has confirmed the final policy.