Skip to content
Hermes
Draft for the public beta. This document has not yet been reviewed by counsel and may change before general availability.

Privacy policy

Last updated October 15, 2026

Hermes (“we”, “us”) gives each person their own AI assistant running in a private cloud instance. This policy explains what we collect, why, and the choices you have.

What we collect

  • Account data: your name, email address, password hash (never the password itself) and sign-in method.
  • Device data: a name and platform for each signed-in device, its public device key, and when it was last seen.
  • Your Hermes data: conversations, memory, files, schedules and settings stored inside your private instance.
  • Connection tokens and saved credentials: stored encrypted in your vault (see below).
  • Operational data: instance status, error logs and usage counts used to run, secure and bill the service.

How we use it

To provide the service you ask for: run your instance, carry out your requests, keep your devices in sync, prevent abuse, and fix problems. We do not sell your data and we do not use your conversations to train AI models.

AI model providers

To answer you, Hermes sends the relevant parts of your conversation to the AI model provider configured for your account (for example Anthropic via AWS Bedrock, or your own Claude Code / Codex account if you connect one). Those providers process the data under their own terms and do not train on it under our agreements.

Vault and secrets

Passwords, API keys and OAuth tokens you give Hermes go to an encrypted vault (AES-256-GCM with per-user data keys). They are decrypted only inside your own instance when needed, every use is audited, and they are never shown to the AI model. Card numbers and bank logins stay on your devices.

Payments

Hermes can only pay with a mandate you sign on your device, within caps you set. We keep a ledger of approved payments. We do not store raw card numbers.

Retention and deletion

Your data is kept while your account is active. Instance backups are kept for up to 30 days. You can delete saved credentials and connections at any time in the app; to delete your account, contact us from your account email and we will erase your instance, vault and backups within 30 days.

Security

Instances are isolated from each other, accept no inbound connections, and are reached only through our authenticated edge. Devices are revocable at any time.

Your rights

Depending on where you live (for example under GDPR or PIPEDA) you may have the right to access, correct, export or delete your data, and to object to some processing. Contact us to exercise them.

Children

Hermes is not intended for anyone under 16.

Changes

We will post updates here and tell you in the app before material changes take effect.

Contact

Questions: contact the Hermes team through the email you receive our messages from.