Privacy Policy

1. Who operates Hermesh and what this policy covers

Hermesh is operated by YIPENGFEI, an individual based in Beijing, China ("we", "us"). The operator is responsible for the personal information described in this policy. The main hosted server is in the United States.

This policy covers hermesh.io, its hosted account and relay services, mcp.hermesh.io, and information the Hermesh apps and command-line tools send to those services. Files and sessions stored only on your computers remain under your control. An independently operated, self-hosted relay and the AI products you choose have their own operators and privacy practices.

2. Information we handle

Account information. Your account identifier, sign-in provider and provider identifier, email address and verification status, display name, avatar URL, and account creation and sign-in times. You can choose an email code instead of Google or GitHub. Providing the information needed for your chosen sign-in method is necessary to create and use an account.

Connection and security information. IP addresses, browser user-agent, sign-in and account actions, connection times and events, owner and device identifiers, public certificates, signed permissions and revocations, and pairing requests. Connected machines report a name and Hermesh version; their online status follows the connection. The center does not collect machine CPU, memory, disk or load history.

Hosted MCP information — only if you use hosted MCP. The connected product, its client identifier and redirect addresses, your connection status, permissions, authorization records and tokens, and an encrypted copy of the connection private key. The gateway also processes the readable tool requests and results described in section 3. Direct agent connections do not send readable session content to the hosted relay or give it their endpoint private keys.

Notifications and correspondence. If you enable iPhone notifications, the service handles an Apple push device token, a notification public key, registration details, and encrypted notification payloads. If you contact us, we receive what you send and the information needed to reply. Please avoid sending passwords, private keys or unrelated personal information.

3. Session content and the hosted MCP exception

Direct agent connections. An agent connecting with its own Hermesh identity uses an end-to-end encrypted tunnel to the machine. Prompts, output, file contents and diffs inside that tunnel are not transmitted in plaintext to the hosted relay. The relay does not hold the endpoint private keys and cannot decrypt this session content; it still handles connection metadata. The hosted MCP exception below does not apply to these direct connections.

Hosted MCP is different. When you connect a product through mcp.hermesh.io, our gateway holds that connection’s private key and acts as the agent. It can process readable tool requests and results, including project and session information, prompts, output and diffs that the connection is permitted to access. Its key is encrypted in the database, but this does not prevent the running gateway from decrypting and using it. The connected AI product also receives the information returned to it.

You approve the connection and its access on your Mac. Within that access, the gateway can act for the connection; a compromise of the hosted gateway can therefore expose its accessible content and permissions. This exception does not give the gateway the private keys of your other agents or your owner devices.

The gateway processes session content to carry out requests and return results. Its database does not keep a separate archive of tool request or response bodies. This does not mean content is never stored: your computers and the AI product can retain it, and information you include in support correspondence or diagnostic errors can enter support or operational records.

You can disconnect a hosted MCP app from Access in the console or revoke its access from your Mac. Disconnecting prevents further authorized use; it does not erase information already received by the connected product or delete sessions on your computers. You can instead use a direct agent connection or operate your own relay and MCP gateway. With a self-hosted MCP gateway, your gateway holds the connection key and processes readable requests and results; Hermesh’s hosted MCP service does not process that content. Self-hosting an MCP gateway is not the same as a direct agent connection.

4. Google and GitHub sign-in

Google sign-in requests only openid, email and profile. We receive the Google account identifier, email and its verification status, name and profile picture URL. We use these to authenticate you, associate sign-in methods with the right account, display your profile, and send account security notices to a verified email. These permissions do not give Hermesh access to Gmail messages, Google Drive files or contacts.

GitHub sign-in uses your numeric GitHub identifier, profile name or login, avatar URL and, when available, your primary verified email. It does not request access to private repositories. If both sign-in methods have the same verified email, a new method may be associated with your existing account; otherwise the service asks you to create an account or sign in and link it.

Provider tokens are used during sign-in and are not stored for ongoing access to Google or GitHub APIs. We store the identity and profile information described above. Our use of Google user information is limited to the purposes disclosed in this policy.

You can unlink a sign-in method in Account after ensuring another method remains. You can also remove Hermesh from Google Account permissions. Unlinking or revoking Google access does not delete your Hermesh account, previously saved profile information or existing Hermesh browser sessions; sign out those sessions separately and request deletion if desired.

5. Why we use information

We use account and connection information to provide sign-in, connect and authenticate devices and agents, enforce the permissions you approve, and send requested notifications and account security messages. For direct agent sessions, the relay forwards end-to-end encrypted traffic without reading its content. Only hosted MCP processes readable tool requests and results on Hermesh’s gateway, within your approved access.

We also use the information needed to prevent abuse, investigate errors and security incidents, maintain and restore the service, handle your requests, and meet applicable legal obligations. Access by the operator or a service provider is limited to information available to it and needed for these purposes. These purposes do not give us the keys or ability to decrypt direct agent session content.

Where a legal basis is required, we assess each activity under applicable law: performing the service you request, complying with legal duties, and, where legally available, legitimate interests in security and reliable operation. Where consent is required, including for particular disclosures or cross-border processing, it must be obtained separately as required. Reading this policy or continuing to use the site does not by itself supply that consent.

6. Limits on use

We do not sell personal information, share it for targeted advertising, or use account information or hosted MCP session content to train AI models. We do not run advertising trackers or cross-site advertising profiles on this website.

These commitments apply to Hermesh’s own use. The AI services and coding tools you choose process information under their own terms, settings and privacy policies; review those before connecting them. We do not make their retention or model-training choices for them.

7. Who receives information

Infrastructure and security providers. Alibaba Cloud hosts the main service and database in the United States. Cloudflare provides network proxying, abuse protection, Turnstile human checks and encrypted backup storage in R2. These providers process the network and service information needed for their roles. Website and hosted MCP HTTPS traffic passes through Cloudflare’s proxy, where HTTPS protection terminates. Direct agent session content remains end-to-end encrypted inside that transport; neither the relay nor its hosting and proxy providers receive its plaintext or endpoint private keys. Hosted MCP content has the different boundary described in section 3.

Sign-in and email providers. Google or GitHub receives your sign-in request when you choose it and provides the identity information described in section 4. Browsers can contact them to load profile pictures. AWS SES, currently configured in Singapore, handles email addresses and the sign-in codes and security notices we send. Cloudflare Turnstile receives browser signals and, during verification, the IP address to prevent automated abuse. Support mail sent to [email protected] is forwarded by Cloudflare Email Routing to the operator’s Gmail mailbox, so Cloudflare and Google process the correspondence and its attachments for delivery and handling.

Products and devices you connect. Authorized agents, machines and AI products receive information needed for the access you approve. Apple Push Notification service receives the destination device token, delivery metadata and encrypted notification payload when notifications are enabled. The payload is encrypted for your device; Apple’s own delivery practices apply.

Legal and organizational disclosures. We may disclose information we actually hold where required by applicable law or a valid legal process, or where lawfully necessary to investigate abuse and protect users and the service. This does not mean we can decrypt direct agent session content: the relay does not hold its endpoint private keys. Any transfer to a successor operator must have a lawful basis and appropriate notice or consent where required; this policy is not blanket permission to sell or repurpose information.

8. Where information is processed

The operator is in China and may access service information there for administration and support. The main server and database are in the United States. Encrypted R2 backups are stored in the Asia-Pacific region. Email delivery is configured in Singapore. Cloudflare, Apple, sign-in providers and the AI products you select may process information in other countries according to their service arrangements.

Session content and other information differ. Direct agent session content remains end-to-end encrypted while passing through the relay, including when the relay is in another country. Using the US relay does not give Hermesh readable access to that content. With hosted MCP, the US gateway processes readable requests and results within your approved access, which can include personal information you supply. Account information, IP addresses, connection metadata and correspondence are handled separately as described above; their processing locations also matter even when you do not use hosted MCP.

Applicable international-processing requirements depend on the people served, the information involved, its origin and the processing activity. The operator’s location and US hosting alone do not establish that a particular separate consent or transfer mechanism is required. Where applicable law requires recipient disclosures, separate consent, an assessment or a transfer mechanism, those requirements must be met. We do not claim that a particular certification, regulatory assessment, standard contract or adequacy decision is already in place.

9. How long information is kept

Accounts and records. Account profiles, sign-in identities and active permissions are retained while needed to operate the account, until a verified deletion request is processed. Account audit events older than 90 days are removed by routine cleanup. Operational container logs rotate by size, so they do not have a universal 30-day limit. Support correspondence is reviewed at least monthly and kept only as necessary to resolve requests, investigate security issues or meet documented legal duties.

Temporary sign-in data. Email codes and third-party sign-in flows expire after 10 minutes. Browser sessions expire after 14 days without renewal and are renewed while used. Routine cleanup removes expired sessions, sign-in flows and pending identities; email-code challenge records are eligible for cleanup one day after expiry. Expiry stops use and is not a promise of immediate erasure.

Connection records. The service routinely removes connection-log entries older than 30 days. Ended MCP connections are eligible for removal after 30 days; ending a connection removes its usable private key from the active connection record. Expired MCP tokens and temporary authorization records are removed by routine cleanup.

Backups. These are backups of the hosted database, not a backup of your local session files. Backups do not decrypt or create plaintext copies of direct agent tunnel traffic. The configured backup schedule keeps local database backups for approximately 14 days and encrypted R2 copies for approximately 35 days. R2 copies are protected against deletion during an initial 30-day lock. Deleting an active record therefore does not immediately remove it from existing backups. Backups must remain restricted to recovery and expire through the backup schedule; deletion requests must be reapplied if a backup is restored.

Local and third-party copies. Your local files, sessions and any copies held by AI products are subject to your controls and those products’ policies. Deleting a Hermesh account does not delete those independent copies.

10. Cookies and browser choices

We use hermesh_session for sign-in, normally for 14 days with renewal while active, and short-lived hermesh_login, hermesh_oauth_state and hermesh_pending cookies for email and third-party sign-in, normally for 10 minutes. These are used to secure and complete authentication.

hermesh_lang remembers a selected language for up to one year. hermesh_last_login remembers the last sign-in method for up to one year; it is not itself a credential. You can clear cookies in your browser; blocking authentication cookies can prevent sign-in. Browser or security-provider controls may separately affect Turnstile.

We do not use analytics or advertising cookies on this website. We do not change our own processing in response to the legacy Do Not Track header; our no-sale and no-targeted-advertising practices apply regardless of that signal. Third-party sign-in, security and AI providers have their own practices, which this statement does not override.

11. Your choices and privacy requests

In Account you can manage linked sign-in methods and end browser sessions; in Access you can disconnect MCP apps. Access granted to agents can also be revoked on your Mac. Resetting your owner identity is not account deletion: it clears that identity’s hosted associations but leaves the account and sign-in information.

Depending on applicable law, you may request access to, a copy of, correction of, or deletion of your personal information; withdraw consent where processing depends on it; request restriction or portability where available; and object to processing where that right applies. You may complain to the competent privacy regulator and seek a review of a refused request. Mandatory rights are not limited by this policy or by its language.

There is currently no self-service account-deletion button. Email [email protected] to request access, a copy, correction or deletion, or to ask for review of a refused request. We verify control through an existing sign-in method or verified account address; do not send passwords or private keys. We aim to acknowledge requests within five working days and complete them within fifteen working days, or earlier where applicable law requires. We explain any permitted extension, refusal or information that must be lawfully retained.

A verified account-deletion request covers account and saved provider profile data, sessions, associated hosted permissions, relevant connection and audit records, push registrations and MCP credentials. A restricted record of the deleted account identifier is kept while needed to reapply deletion to recovery copies or meet a documented legal duty. A backup is not brought back into service until those deletions are reapplied. Removing a Google permission or an MCP connection alone is not an account-deletion request. Manage copies already shared with an AI product with that product as well.

12. Security

Direct agent session content uses end-to-end encryption; the hosted relay does not hold the endpoint private keys and cannot decrypt it. Hosted MCP is different: its connection keys are encrypted in storage but available to the running gateway, which can read authorized requests and results. HTTPS and encrypted backups protect transport and storage; they do not make hosted MCP end-to-end encrypted between the AI product and your machine. Device notification content uses the device encryption described above. The service also uses scoped permissions and hashed browser-session and MCP tokens. These measures reduce risk; no service or encryption claim guarantees that compromise is impossible.

Touch ID and device authentication are handled on your trusted device by the operating system. The hosted service receives signed approvals, not your fingerprints or biometric templates. If a personal-information incident occurs, we will take action and provide notices where required by applicable law.

13. Children’s information

Hermesh is intended for developers aged 18 and above. It is not designed for children and does not knowingly solicit their personal information. If you believe a child has provided information, contact [email protected] so that we can assess and remove it or take other steps required by applicable law.

14. Changes to this policy

We will update the date when this policy changes and give a prominent notice of material changes on the website or through account contact information where appropriate. If a new use or disclosure requires consent or another legal step, we must complete it before that processing begins. English and Simplified Chinese versions are provided; translation differences do not reduce your rights under applicable law.

15. Contact

Operator: YIPENGFEI, Beijing, China. Privacy contact: [email protected], forwarded to the operator’s Gmail mailbox by Cloudflare Email Routing.