1. Operator and scope
Johnson Mok operates this johnson-hermes application and its Hermes integration, accessible through johnson-ai.404-not-found.net. This policy applies to that deployment and its direct Google connection. Contact csjmok@gmail.com for privacy questions, access requests or deletion requests.
2. Information accessed and collected
The application processes your login details and settings; prompts, responses, uploaded or downloaded files, task results, saved memories and session history; and technical information such as timestamps, IP addresses and security events. Google OAuth access tokens, refresh tokens and the connected account's email address are stored to maintain and identify your authorised connection. The application does not ask for or store your Google password.
Subject to the permissions you grant and the tasks you request, Google data can include Drive file names, identifiers, metadata, content and sharing information; Docs text; Sheets cells and formulas; Slides content; Gmail message headers, recipients, bodies, attachments, labels and drafts; and Calendar descriptions, event times, locations and attendee information.
3. Why Google access is requested
Data is used to provide the assistant features described on the application homepage: finding and analysing your materials, drafting and editing documents, working with spreadsheets and presentations, assisting with email, and managing calendars. It is also processed to maintain task continuity, run automations you authorise, protect the service and resolve operational problems.
Account email and OpenID permissions identify the connection. Drive, documents, spreadsheets and presentations permissions support file and content operations. Gmail modify access supports reading, organising, drafting and sending messages. Calendar access supports reading and managing calendars and events. The currently requested Drive and Gmail permissions allow broad access; you should grant them only if you want these features. Permissions do not independently authorise a send, share, deletion or other consequential action.
4. Sharing and AI processing
Direct Google requests are transmitted to Google's APIs. Task-relevant Google content can be included in the prompts and tool results transmitted to the AI provider selected for the task. The deployment supports OpenAI services and, when enabled and selected, DeepSeek through LiteLLM. These providers process the submitted material under the terms and retention settings applicable to the configured provider account. The self-hosted Open WebUI, Hermes, LiteLLM, database, document extraction and browser components may process task data on the operator's infrastructure.
Only use a provider whose data handling is appropriate for your information. We do not sell Google user data, use it for advertising or creditworthiness decisions, or use it to develop, improve or train general-purpose AI or machine-learning models. Google data may be transferred only as needed for the user-facing features you request and consent to, for security, as required by law, or for another transfer permitted by Google's Limited Use requirements. Human access is limited to your affirmative agreement to access specific data, necessary security investigation, legal requirements, or another Limited Use exception.
The application's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Provider choice and configuration must support those restrictions. Connecting an account is not permission to train models on its data.
5. Storage and security
Google credentials and task data are stored on the operator's assistant server. Credential files are restricted to the service account and privileged administrators. Public access uses HTTPS; the gateway forwards this deployment's assistant traffic through an encrypted WireGuard connection without terminating its HTTPS session. Administrative access is restricted. Configuration backup archives use encryption.
Credentials are kept separate for each connected Google account. Account identity is checked before direct Google tool operations. These controls reduce risk but cannot guarantee absolute security. AI providers and Google operate separate infrastructure; submitted data may be processed in countries other than your own.
6. Retention and deletion
OAuth credentials remain until the connection is removed, revoked or replaced. Saved conversations, memories, sessions and downloaded task artifacts remain on the assistant server until you or an administrator delete them; Google remains the source of your original Google files, messages and events. Operational logs are rotated according to the relevant host's configured retention. The Freedom web server currently retains 14 daily rotated nginx logs.
The deployment's scheduled configuration archives have a 14-day retention rule; their contents depend on the configured backup scope. Manually retained archives and independent copies are separate. Deleting a chat or revoking Google access does not automatically remove memories, downloaded copies, previously transmitted provider data or backups. Ask the operator to identify and remove the relevant local copies and retained archives. Provider-held copies are subject to the provider's applicable deletion and retention arrangements; legally required records may be retained as necessary.
7. Your controls
You may decline a connection, stop using it, choose which connected account a task uses, or revoke permission through Google Account connections. Revocation prevents subsequent authorised Google access but does not itself delete data already copied. Contact csjmok@gmail.com to request removal of local tokens, account information, history, memories or artifacts, or to request access, correction or export. We may need to verify your authority over the affected account.
8. Website storage and policy changes
The assistant uses browser storage or cookies for authentication and preferences. These public application information pages contain no advertising, analytics scripts or third-party embedded resources. Web-server access logs record ordinary technical request information.
Policy changes will be published here with an updated date. Material new uses of Google data require updated disclosures and any required consent before those uses begin.