← Back to irfanfahmi.com

Privacy Policy

1. Who We Are

This application ("Hermes") is a personal software project operated by Muhammad Irfan Fahmi ("the Operator", "I", "me"), an individual developer based in Malaysia. The application is hosted at irfanfahmi.com.

Contact for all privacy matters: [email protected]

2. Scope of This Policy

This policy explains how Hermes accesses, uses, stores, and protects information obtained through Google APIs, including Gmail, Google Calendar, Google Drive, Google Sheets, Google Docs, and Google Contacts (the "Google Services").

By authorising Hermes to access your Google account, you consent to the practices described in this policy.

3. Google User Data We Access

Hermes requests the following Google OAuth scopes. Each is used strictly for the personal automation purposes described:

Scope	What it allows	Why it is needed
gmail.readonly	Read email messages and metadata	To scan the inbox for job-application replies, alerts, and messages requiring attention
gmail.send	Send email on your behalf	To send follow-up emails and notifications that you compose or approve
gmail.modify	Apply labels and change read/unread state	To organise and triage the mailbox automatically
calendar	Read and manage calendars and events	To build daily briefings and detect scheduling conflicts
drive	Read and manage files in Google Drive	To store and retrieve documents (resumes, cover letters, reports) you create
spreadsheets	Read and edit Google Sheets	To maintain structured records such as application and trading trackers
documents	Read and edit Google Docs	To generate and update written documents
contacts.readonly	Read your contacts	To correctly address emails and match senders to known contacts

4. How We Use Google User Data

Google user data is used exclusively to provide the application's automation features to the account owner. Specifically:

• Reading email to summarise, triage, and surface messages the owner cares about
• Sending email that the owner has composed, requested, or approved
• Reading calendar data to generate daily briefings and detect conflicts
• Reading and writing documents, spreadsheets, and files the owner works with
• Reading contacts to correctly address correspondence

We do NOT use Google user data to:

• Sell, rent, trade, or transfer data to any third party
• Serve advertising, or build advertising or profiling audiences
• Train, fine-tune, or improve any machine-learning or AI model
• Determine credit-worthiness, or for any lending or insurance purpose
• Conduct surveillance, or for any purpose not described in this policy

5. Data Storage and Security

Local storage only. Hermes runs as a self-hosted application on the Operator's own personal devices (an Android phone and a personal laptop). There is no multi-tenant cloud service, no shared database, and no external server that stores Google user data.

Security measures in place:

• OAuth 2.0 credentials are stored only in local, access-restricted credential files (Unix permission 600, owner-read-only)
• OAuth client secrets and refresh tokens are never hardcoded into source code, and are never transmitted to any third party
• All communication with Google APIs occurs over HTTPS/TLS
• Access tokens are short-lived and refreshed automatically using the stored refresh token
• No employee, contractor, or other individual besides the Operator has access to the data

Data retrieved from Google is processed locally and retained only as long as it is useful for the automation task at hand. Derived summaries and cached state may be stored locally on the Operator's devices.

6. Data Sharing and Disclosure

We do not share, sell, or disclose Google user data to any third party, except:

• With your direction — if you explicitly ask the application to send or publish information
• For legal reasons — if required to comply with a valid legal process, in which case the Operator will notify the account owner unless legally prohibited

No third-party analytics, advertising, tracking pixels, or data brokers are integrated with this application.

7. Data Retention and Deletion

Locally cached data may be deleted at any time by the account owner, and is automatically pruned when it is no longer needed. To have all data removed:

• Revoke access: visit myaccount.google.com/permissions, select this application, and choose Remove access. This immediately invalidates all stored tokens, and Hermes can no longer access any Google data.
• Request deletion: email [email protected] to request deletion of any locally retained copies of your data, which will be actioned within 30 days.

8. Your Rights

You may at any time:

• Revoke the application's access to your Google account (link above)
• Request a copy of any data retained about you
• Request correction or deletion of your data
• Withdraw consent entirely — subsequent use of the application will cease to function

Because this is a single-user application, these rights are exercised directly by the account owner who grants consent.

9. Children's Privacy

This application is not directed at, and is not intended for use by, anyone under the age of 13 (or the applicable age of digital consent in your jurisdiction). It does not knowingly collect data from children.

10. International Users

The application is operated from Malaysia. Data is processed and stored locally on the Operator's devices. No cross-border transfer of Google user data to third parties occurs.

11. Changes to This Policy

This policy may be updated to reflect changes in the application's functionality or in applicable law. The "Last updated" date below will always reflect the most recent revision. Material changes will be reflected on this page. Continued use of the application after an update constitutes acceptance of the revised policy.

12. Contact

For any question, concern, or request relating to this privacy policy or the handling of your data:

Email: [email protected]
Website: irfanfahmi.com