Privacy policy

This policy describes the personal Herena deployment and its OAuth callback relay.

Access and purpose

The local assistant uses Gmail read-only access to read messages and metadata needed for email briefings. Calendar data is accessed for requested calendar operations, including changes only when requested and authorized. Optional Workspace features access data only for configured, authorized tasks. Grant only needed scopes; this relay does not implement these assistant features itself.

Processing and delivery

Relevant email, calendar, or other authorized task content may be processed by the configured AI provider. Briefings and responses may be delivered to the configured Discord destination, where people with channel access may see them. The operator must review that destination and the provider settings before use. Provider retention and model-training practices depend on the selected provider, account terms, and configuration; this project has not verified any provider's training restrictions. Discord and hosting providers also have their own policies.

Credentials and relay retention

Access and refresh tokens, client secrets, and PKCE verifiers stay locally on the client; do not send them to this relay. The relay temporarily holds OAuth authorization codes or errors, transaction state, a result-secret digest, provider, and expiration metadata in-memory. It does not exchange tokens or store mailbox or calendar content.

The transaction TTL starts at creation (default 300 seconds, configurable from 1 to 3600). Successful result retrieval deletes the transaction immediately. Expired records are inaccessible and removed through lazy cleanup on subsequent requests; without traffic they can remain in memory until a request or restart. A restart or shutdown loses all transactions. There is no relay database or backup.

The application does not log requests and the supplied server command disables access logs. Hosting and reverse-proxy logs and browser history are separate; operators must ensure they do not retain sensitive callback URLs or credentials. These pages contain no analytics, tracking scripts, or external assets.

Control and deletion

You can revoke Google access in your Google Account's third-party connections settings and stop the local assistant. Delete locally stored tokens and saved content separately. Local client history, AI provider records, and Discord messages are not deleted by relay expiration; manage those through their respective storage settings and deletion controls. Contact the operator for help with access or deletion.