hermes-relay/user-docs/privacy.md

layout, title, description

layout	title	description
doc	Privacy Policy	Privacy policy for the Hermes-Relay Android app

Privacy Policy

Hermes-Relay · Effective date: September 12, 2026

Hermes-Relay is a native Android app that connects to your own Hermes Agent host. This policy describes how the app handles your data.

Summary

Hermes-Relay has no hosted cloud service and sends no analytics. The app connects only to servers that you configure; those servers may send chat, voice, attachments, and optional Assistant screen context to the AI providers you configure.

Google Play Track

The Google Play build ships Hermes Bridge Core and does not include AccessibilityService or MediaProjection Device Control. It cannot tap, type, swipe, send SMS, place calls, access contacts or location, or perform unattended phone control. If you select Hermes as Android's Digital Assistant, a compatible unlocked assistant-button invocation may provide bounded visible text and an available screenshot for one Standard voice turn. That context is sent to your configured Hermes server and AI provider. Ordinary wake, power-button, assistant, and keyguard invocations do not request screen context.

The sideload build is a separate distribution track for users who intentionally install Device Control outside Google Play.

Data Storage

All data is stored locally on your device in the app's private sandbox:

Data	Storage Method
Server URLs, preferences	Android DataStore (app-private)
API key, relay session tokens	AES-256-GCM encryption via Android Keystore
Performance counters	Android DataStore (local only)
Notification trigger rules and activity log	Android DataStore (local only)
Pending Android Assistant context	App-private cache until one turn is accepted, the session exits or is cancelled, or one-hour stale cleanup runs; a failed preflight retains it for retry

Chat messages are not cached on your device. They are loaded from your Hermes server on demand and exist only in memory while the app is running.

Network Connections

The app connects only to endpoints you configure:

• Your Hermes API server — HTTP/SSE for chat streaming
• Your relay server — WSS for terminal/TUI relay, Bridge Core status, explicit Relay media/enhancements, notification companion, and session management. Ordinary inbound files use the authenticated Dashboard route.
• Your relay voice routes — HTTP(S)/WSS for speech-to-text, voice settings, realtime voice sessions, and text-to-speech audio when you use Voice mode
• Your Hermes Dashboard/Gateway or API route — Android Assistant turns, including bounded visible text and an available screenshot when compatible firmware supplies screen context

No connections are made to Google, Anthropic, or any other third-party service by the app. There is no telemetry, no crash reporting, no DNS prefetching, and no background network activity to hosted services.

Permissions

Google Play build:

Permission or access	Purpose	Required
Internet	Connect to your Hermes servers	Yes
Network State	Detect connectivity for reconnect behavior	Yes
Camera	QR code scanning for server pairing	No
Microphone	Voice mode speech-to-text and opt-in local “Hey Hermes” detection	No
Display over other apps	Optional user-started Voice Overlay, with microphone notification and Stop voice	No
Notification Access	Optional notification companion metadata forwarding to your paired relay	No
Android Digital Assistant role	Optional assistant session; compatible unlocked assistant-button invocations may include one-turn screen context	No

Notification Access is granted and revoked from Android system settings. When enabled, Hermes-Relay forwards posted-notification package, title, text, subtext, timestamp, and notification key to your paired relay. It does not forward notifications to a Hermes-Relay cloud service. If you separately enable Notification triggers, matching happens locally on the phone; the MVP action writes a local activity-log entry and posts a local “Ask Hermes?” prompt. It does not send a new AI request or reply in another app automatically.

If you select Hermes as Android's default Digital Assistant and separately enable background “Hey Hermes,” local sherpa-onnx keyword spotting uses the microphone while the mode is enabled. Pre-activation wake audio is not sent to Hermes, Relay, or a hosted service. The Digital Assistant listener and the notification-based experimental listener cannot be active together.

Both builds declare foreground-service permissions for user-started voice and connection tasks. Both offer an optional voice-only overlay. Sideload Device Control adds accessibility, wake lock, MediaProjection screenshots, contacts, location, SMS and calls; these Device Control permissions are absent from Play.

Voice Overlay is optional in both builds. Start it explicitly from Voice Focus while Hermes-Relay is visible and unlocked. It requires microphone access, display-over-other-apps access and an enabled microphone notification with Stop voice. Audio goes to the configured Hermes server; the overlay does not read or control other apps. Stop voice, closing the overlay, screen lock, task removal or loss of required access ends the overlay voice session. Returning to the app keeps foreground protection until the app is resumed. Granting permissions never starts a session.

Third-Party Services

Hermes-Relay includes no advertising, tracking, or analytics services. The app is built with Android platform components and open-source libraries.

::: info Note Your Hermes server may connect to AI providers such as OpenAI or Anthropic server-side. That network activity is outside the scope of this app and governed by your server's configuration. :::

Data Export & Deletion

From the app's Settings screen, you can:

• Export a full connection backup. The file includes server URLs, preferences, API keys, relay session tokens, device IDs, and dashboard cookies so restored connections can work without manual re-entry. Keep it private.
• Import a saved configuration
• Full reset to permanently delete local data including encrypted credentials

Uninstalling the app removes all stored data from your device.

Children's Privacy

Hermes-Relay is not directed at children under 13. We do not knowingly collect information from children.

Changes to This Policy

Updates will be posted on this page with a revised effective date. Significant changes will be noted in the app's release notes.

Contact

Questions about this policy: GitHub Issues

Open Source

Hermes-Relay is MIT licensed. All source code is publicly auditable.