Privacy Policy
Last updated:
HAM (“Hermes Agent Mobile”, the “App”) is a native Android client that connects to a Hermes agent server you choose — either a managed Hermes Cloud instance (operated by Nous Research) or a server you host yourself. The App is a thin client: it does not run its own backend, and its developer does not operate any server that receives your data. This policy explains what the App handles on your device and where that data goes.
HAM is an independent, third-party open-source project. It is not affiliated with, endorsed by, or an official product of Nous Research; “Hermes” and “Nous” are referenced only to describe the servers and sign-in the App is compatible with.
The short version: HAM sends your data only to the Hermes server you configure. The developer collects nothing, runs no analytics, and has no server that your data passes through. There is no third-party telemetry.
1. Who receives your data
All content you send or receive through the App — messages, prompts, transcripts, attachments, and voice audio — travels directly from your device to the server you configure, over a connection you choose (local network, VPN, or an HTTPS reverse proxy you control). The App’s developer does not receive, store, or have access to any of it. How your server stores and processes that data is governed by your own server configuration and any policies that apply to it.
2. Data the App handles
| Category | Purpose | Where it goes |
|---|---|---|
| Messages, prompts & transcripts | Conversing with your agent and displaying session history | Your configured server only |
| Attachments & shared files (images, PDFs, text) | Sending content you choose into a session | Your configured server only |
| Microphone audio | Voice dictation and hands-free voice conversation, only while you are actively recording | Your configured server only; not stored by the App after transmission |
| Server connection settings & credentials | Authenticating to your server | Stored locally on your device (see §4) |
| App preferences (model, reasoning effort, voice, UI) | Remembering your choices | Stored locally on your device |
3. Microphone & audio
The App requests the RECORD_AUDIO permission to support two optional, user-initiated features:
- Dictation — transcribing your speech into the message composer.
- Hands-free voice conversation — continuous speaking, playback, and barge-in, including with the screen off, using a foreground microphone service with a persistent, stoppable notification.
The microphone is captured only while you have actively started recording or a voice session. It is never accessed silently or in the background without an active, user-started session and its visible notification. Audio is streamed to your configured server for processing and is not retained by the App after transmission. If you never use these features, no audio is ever captured. You can revoke the microphone permission at any time in Android Settings.
4. How credentials are stored
Server URLs, usernames, passwords, cookies, and trust decisions are stored locally on your device, encrypted using the Android Keystore system, and are scoped to the specific server origin they belong to. WebSocket authentication tickets are treated as single-use, in-memory values and are not persisted. The App does not transmit your credentials to anyone other than the server you are authenticating to.
5. What the App does not do
- No analytics, advertising, tracking, or usage telemetry of any kind.
- No third-party SDKs that collect personal data.
- No developer-operated backend — the developer never receives your data.
- No selling or sharing of data (there is no data collected to sell or share).
- No logging of credentials, tokens, cookies, tickets, prompts, transcripts, attachments, or connection strings.
6. Permissions and why they are requested
INTERNET— to connect to your Hermes server.RECORD_AUDIO— for the optional voice features described in §3.POST_NOTIFICATIONS— to show turn-completion and voice-session notifications.FOREGROUND_SERVICE/FOREGROUND_SERVICE_MICROPHONE/FOREGROUND_SERVICE_DATA_SYNC— to keep an active voice session or a streaming turn running reliably with a visible notification.WAKE_LOCK— to maintain capture and network continuity during an active screen-off voice session.
7. Children
The App is a general-purpose developer/operator tool and is not directed to children under 13.
8. Data retention & deletion
Data stored locally by the App (connection settings, preferences, and any cached transcripts) is removed when you delete the relevant server connection, clear the App’s storage, or uninstall the App. Data that reached your server is subject to your own server’s retention — the developer has no ability to access or delete it.
9. Changes to this policy
If this policy changes, the “Last updated” date above will change and the revised policy will be posted at this URL.
10. Contact
For questions about this policy, contact: CONTACT_EMAIL.