Privacy policy

vta.dev is one person’s home server. Two apps here use Google sign-in: Hermes, which works only with my own Google account, and Homelab Access, which learns who you are so it can decide whether to let you in. Nothing either of them gets from Google is sold, used for advertising or used to train AI models.

Who runs this

vta.dev, Hermes and Homelab Access are run by one private individual for personal, non-commercial use. In this policy, “I” and “me” mean that person. You can reach me at hello@vta.dev.

Hermes

Hermes is a personal AI assistant running on my home server. It is connected to my Google account only. Nobody else can connect their account to it.

Google data Hermes can access

• Gmail: reading messages, applying labels, archiving, and sending messages I ask it to send. Scopes gmail.readonly, gmail.modify, gmail.send.
• Google Calendar: reading events, and creating or changing them. Scope calendar.
• Google Drive, Docs and Sheets: finding, reading, creating and editing files. Scopes drive, documents, spreadsheets.
• Google Contacts: looking up names, email addresses and phone numbers. Read only. Scope contacts.readonly.

How Hermes uses it

Only to carry out tasks I give it, either in a chat or as a job I schedule: summarising new mail, drafting a reply, adding an event, updating a spreadsheet. For each task Hermes reads only what that task needs.

Who else sees it

• OpenAI. Hermes runs on an OpenAI model. The parts of my data a task needs are sent to OpenAI as part of the request and processed under my OpenAI account, with model training turned off.
• My chat apps. Hermes’s replies can quote my mail or files. They reach me through Telegram or through a private web chat hosted on this server.

No one else receives it. It is not sold, rented, or shared with advertisers or data brokers.

Where it’s kept, and for how long

The Google access token is stored on my home server, in Hermes’s own data directory. Hermes also keeps chat history and notes there, which can include parts of my Google data. They stay until I delete them. Revoking Hermes in my Google account stops all further access at once.

Homelab Access

Homelab Access is the Google sign-in in front of the few services on this server that are reachable from the internet. It runs on Cloudflare Access.

Google data Homelab Access receives

Your email address, your name, your profile picture and your Google account ID. Scopes openid, email, profile. It does not see your password, mail, files, contacts or calendar, and it can’t change anything in your Google account.

How it’s used

To check whether your email address is on the list of people I’ve allowed into the service you opened. If it is, Cloudflare sets a sign-in cookie so you aren’t asked again on every page. If it isn’t, the request ends there and nothing reaches my server.

Who else sees it

• Cloudflare runs the sign-in and keeps a log of each attempt: email address, IP address, time and which service. Cloudflare handles this under its own privacy policy and keeps the log for as long as my Cloudflare plan provides. I can read that log.
• The service you open. Some services create an account from your name and email the first time you sign in, so they can show who did what. That account stays on my server.

This website

vta.dev sets no cookies. It counts visits with Cloudflare Web Analytics: a small script from Cloudflare reports which page you opened, the site that linked to it, your browser, device type and country, and how fast the page loaded. It uses no cookies or local storage and does not follow you to other sites, and I see only totals. The site is delivered through Cloudflare, which processes your IP address to serve pages and block attacks.

Google API Services User Data Policy

Hermes’s and Homelab Access’s use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data from Google APIs is:

• used only to provide the features described above
• never used for advertising, and never sold
• never used to develop, improve or train AI or machine-learning models
• transferred to others only as described on this page, or when the law requires it

Removing access and deleting data

• Anyone can remove an app’s access at myaccount.google.com/connections. For Homelab Access, that only means you’ll be asked to approve it again next time you sign in.
• To be taken off the access list, or to have an account on one of the services deleted, email hello@vta.dev. I’ll do it within 30 days.

Changes to this policy

When this page changes, the date at the top changes with it.

Terms of use

• The services on vta.dev are private. Use them only if I’ve invited you.
• They come as they are, with no promise that they’ll be available, fast or free of errors.
• Don’t try to get around the sign-in, share your access with others, or use the services to break the law.
• I can remove anyone’s access at any time.