Privacy policy.

1. Google data and permissions

With the account owner’s authorization, a dedicated local reader can access Gmail through the Gmail API using https://www.googleapis.com/auth/gmail.readonly. That OAuth permission is technically mailbox-wide; the application separately restricts the Aegis processing workflow to messages verified as starred.

Eligible message data can include message identifiers, star/label state, dates, sender and recipient information, subject, body and supported attachment content. Minimal account-identity information may be used to verify the connected account. The workflow does not request Gmail send, compose, modification or deletion permissions.

Optional personal Calendar reading requires a separate read-only authorization and selected-calendar allowlist. Its data can include event titles, times and other event details needed for the owner’s requested calendar assistance. Calendar reading is distinct from any separately approved event-writing capability.

2. Why the data is used

• Identify eligible starred messages and prevent repeated processing.
• Produce local email summaries and proposed tasks/events for the owner.
• Support private review, user-requested search, scheduling assistance and approved actions.
• Maintain limited operational state and receipts for reliability, duplicate prevention and recovery.

The application does not sell Google user data, use it for advertising, or use it to train general-purpose AI models.

3. Local processing and permitted sharing

In the Aegis starred-email workflow, original message and attachment content is processed on the owner’s systems using local Gemma. Google authorization tokens are kept separately from the model’s tools and context.

The owner explicitly permits derived email summaries and task/event proposals to be sent to Bono for its dashboard and daily summary. Bono can use cloud AI providers, such as Anthropic or OpenAI, according to the operator’s configuration. These shared derived fields are therefore processed in the cloud and may pass through the operator’s configured AI gateway.

Original message bodies, raw source quotations, MIME/HTML and attachment contents are excluded from that automatic handoff. Personal-calendar event details and availability are also excluded. Other assistant profiles are not automatic recipients of the private proposals.

Cloud providers process permitted shared fields under their applicable terms and the owner’s account settings. This policy does not represent those providers as offering zero retention. The operator should configure their data controls consistently with the authorized use.

Separate Google, task or calendar services receive the exact data necessary for an owner-approved action. Displaying a proposal does not itself authorize an external task/calendar write.

4. Storage, retention and security

Private records, processing checkpoints and proposal/action receipts may be stored on owner-controlled systems for review, duplicate prevention and recovery. They are retained until the owner deletes them or an explicitly configured retention policy removes them. Removing a star stops future eligibility but does not automatically delete a summary or action already created.

Google tokens and client credentials are kept in protected service storage rather than public pages, source repositories or model prompts. The deployment separates reader credentials from the reasoning process and restricts network access. Access to private records is limited to the operator and authorized services; system administrators remain trusted.

Records already shared with Bono or created in external task/calendar services may be retained there under those services’ settings. Local deletion or OAuth revocation does not automatically erase those copies.

5. Authorization, revocation and deletion

The owner chooses the Google account, authorizes the requested scopes, and can pause processing or disconnect the integration. Google authorization can be revoked through Google Account connections. Revocation prevents future access with that grant; it does not automatically delete existing application records. Revoking a shared Google application may also affect other connections under that app.

To request access, correction or deletion of application-held records, or to disconnect Aegis without disturbing another connection, contact bono.homelab@gmail.com. The operator will verify the requester’s authority and handle the request, including identifying any copies that remain in external services or retained recovery backups.

6. Google API Services User Data Policy

Bono Hermes’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Access is limited to the authorized user-facing productivity features described here.

7. This public website

This website contains app information and this privacy policy. It does not request Google authorization, display private mail, or collect mailbox content. No advertising or analytics script is included in these pages. Hosting and network providers may process ordinary request metadata, such as IP addresses and user-agent strings, for delivery and security.

8. Updates and contact

Changes to the workflow or permitted data sharing should be reflected in this policy before activation. The effective date above identifies the current version.

Support and privacy contact: bono.homelab@gmail.com.