Hermes Link Privacy
Effective October 30, 2026
Hermes Link is provided by BrightPath Ventures. Questions: pedro.ignacio@brightpathventuresgroup.com.
Direct connection to your desktop
You choose the HTTPS gateway and connect using your existing Hermes dashboard credentials. The app sends your username and password to that gateway for sign-in. Your password is not saved. A session token is kept in your device’s Keychain. The gateway and any private network service you choose, such as Tailscale, process connection information under their own terms.
Your prompts, selected images, tool approval decisions and requested files pass between the app and your configured desktop. Hermes and the model or tool providers configured on that desktop process your content under their own settings and privacy policies. BrightPath does not operate your Hermes model or collect conversation content through an analytics service in this build.
On-device storage
Recent text from up to 20 opened chats may be saved for offline reading, up to 256 KB per chat. It is encrypted on the device with a key stored in Keychain and excluded from device backups by the app. Saved data is separated by gateway, profile and credential. A changed sign-in credential can require saving the history again.
Favorites and recency are part of the saved library. Images and file bodies are not included in the offline cache. Explicit file previews use temporary files; files you save or share through system controls remain in the destination you choose. An unconfirmed outgoing message is retained in Keychain so you can reconcile its delivery without automatic resending.
Use Saved history & privacy to clear cached messages or turn off offline reading. Sign out to remove the connection’s saved library and token. These actions do not delete conversations from Windows. Resolve or explicitly clear any unconfirmed outgoing message separately. Delete desktop content through Hermes itself.
Apple purchases
Apple handles purchase and payment processing. Hermes Link checks verified StoreKit transactions to determine trial and unlock access. BrightPath does not receive your payment-card details. Purchase restoration uses the Apple Account signed in to the App Store. Apple’s privacy policy applies to Apple’s processing.
Tracking, support and notifications
This build includes no advertising or analytics SDK and does not track you across other companies’ apps or websites. If you email support, the information you choose to provide is used to answer that request. Do not email passwords, tokens or sensitive transcripts. Support correspondence is kept while needed to address the request and associated records, then removed when no longer required, subject to legal obligations.
Closed-app push notifications are not active in the current build. If a future optional relay is introduced, its device identifiers, retention, delivery data and deletion controls will be described before activation. This policy does not authorize sending chat content to a new service.
Contact and changes
For privacy or support requests, email pedro.ignacio@brightpathventuresgroup.com. Include the app version and a general description; keep credentials private. We will update this page when data handling changes.
Unsent drafts and setup codes
Unsent text and references to images staged on your desktop are encrypted on this device alongside the saved library, separately for up to 20 conversations (16,000 characters and four staged images per draft). Draft recovery remains active when offline history is disabled. These drafts are not sent until you choose Send. Attaching an image uploads it to your desktop before you send the message. Signing out removes local drafts; unconfirmed delivery reminders are retained securely until you explicitly review them.
QR/setup codes contain only an HTTPS gateway address and Hermes profile. The bundled desktop generator works locally and does not transmit those details to a hosted QR service. Importing a code does not authenticate or send credentials; review the address before signing in.
Shared inbox, prompts and conversation controls
The iPhone/iPad share extension copies selected content to an app-group container accessible to Hermes Link and its own extension. It does not receive dashboard credentials and does not send data to Windows or a model provider. Inbox files use device file protection and are excluded from backups. Up to 10 items or 50 MB are retained until you remove them; text is limited to 16,000 characters and each item can include four supported images of up to 5 MB. This inbox is separate from account-bound history, so signing out does not remove it. Clear inbox removes those local copies.
Copying an inbox image to a conversation explicitly uploads it to your configured Windows desktop. Copies remain in the inbox until removed. Saved prompt templates and the completion-sound preference are stored in the encrypted per-connection library and removed with that library on sign-out. Context/speed/effort information comes from the desktop and is not sent to a separate analytics service. A context-compaction request can make a model-provider call under your Windows configuration after you confirm it. An unconfirmed context-change reminder is retained securely until reviewed, to avoid repeating the operation unintentionally.
The completion sound uses a bundled local audio file and does not record audio or use the microphone. No notification relay is activated by this feature.
Folder browsing, inventory and session settings
Opening a Windows folder requests its visible child file names and local paths from your configured connector. Previewing a supported file downloads its contents to this device. These actions do not send a prompt or upload files to a model provider. Skills, tools, MCP and scheduled-task views request read-only inventory for the selected default desktop profile.
Model and working-folder changes send a conversation-scoped request to your desktop after confirmation. Model changes can affect which configured provider processes subsequent work and its charges. An unresolved settings-change request is retained in Keychain with its original target and request identifier until it is confirmed or you explicitly clear the reminder. Clearing a reminder does not undo an operation on Windows.