Privacy Policy
Last updated 19 October 2026
This policy covers shcherbik.com and the private Google Workspace integration operated under it. That integration is a single-user tool: it accesses one person's Google account, with that person's explicit consent. It is not offered to the public and has no other users.
Who operates this
Michael Shcherbik, an individual, operating a personal automation setup on hardware he controls. Contact: mshcherbik@gmail.com.
What data is accessed
The integration requests Google permissions at the time of authorisation, and only those the owner approves on Google's consent screen. In practice this covers:
- Gmail — reading messages and message metadata (sender, subject, date, body) to answer the owner's requests.
- Google Calendar — reading calendars and events, including times, titles, locations, and attendee status.
Any additional Google service is accessed only if the owner has separately granted that permission. If a permission was not granted, the corresponding data is not accessible.
How the data is used
- To answer the owner's own questions — for example, summarising the day's calendar or locating a specific email.
- To produce local summaries, briefings, or notes that the owner has asked for.
Data is not used for advertising, profiling, or training machine-learning models, and it is not analysed for any purpose other than responding to the owner's requests.
Where data is stored
- Credentials: the OAuth client secret and refresh token are stored as files on the owner's own machine (
~/.hermes/), readable only by the owner's operating-system account. There is no central server holding them. - Content: message and event content is processed in memory to answer a request. If the owner asks for a summary to be kept, it is written to a local file or note on the same machine. No copy is stored on third-party infrastructure.
Sharing and disclosure
No data obtained from Google APIs is sold, rented, or shared with third parties. There is no advertising, no analytics resale, and no data broker involved.
Data may be disclosed only where strictly required to comply with applicable law, or to address a security issue such as unauthorised access.
Limited Use disclosure. Shcherbik's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Human access
No one other than the owner reads the data, and the owner is the only person who has authorised the integration. No Google user data is reviewed by any other person.
Retention and deletion
Access persists until it is revoked. The owner can revoke it at any time in either of two ways:
- Remove the app's access from the Google account at myaccount.google.com/permissions. This takes effect immediately.
- Delete the locally stored credentials on the machine that runs the integration.
After revocation, no further Google data is retrieved. Locally saved summaries or notes remain until the owner deletes them.
Security
Credentials are stored with owner-only file permissions on a machine that is not publicly accessible, and access tokens are refreshed automatically. The integration does not expose Google data through any public endpoint or API.
Children
This integration is not directed at children and does not knowingly access data belonging to anyone other than its sole adult owner.
Changes to this policy
If the scope of access or the handling of data changes, this page will be updated and the date at the top revised.
Contact
Questions about this policy or about data handling: mshcherbik@gmail.com.