ADA / PRIVACY

Privacy policy

Effective October 31, 2026

Ada is Alexander’s privately operated AI assistant for personal and family use. This policy describes the assistant’s Google integration and this public informational website.

Who operates Ada

Alexander controls access to Ada. It runs on Hermes Agent by Nous Research and uses the dedicated Google account ada.lovelace.agent@gmail.com. It is not open for public registration. Family use does not automatically grant access to someone else’s Google account or data.

Google data and why it is used

OAuth permissions allow Ada to act on the authorized account. Actual access and actions must remain within the account owner’s instructions and the permissions granted:

• Gmail: message bodies, headers, recipients, threads, labels, and attachments as needed to read and organize email, prepare drafts, send messages, and reply.
• Calendar: calendars and event details, including times, descriptions, locations, and participants, to manage calendars and events and coordinate schedules.
• Drive: file contents, metadata, and sharing information as needed to find, organize, create, update, or otherwise manage authorized files.
• Docs and Sheets: document text, spreadsheet cells, and related content to create and edit documents and spreadsheets.
• Contacts: read-only contact details for lookup, such as finding the correct recipient. Ada does not have permission to edit contacts through this integration.

Some of this information concerns other people, such as email correspondents or event participants. Google data is confidential and is used for the assistant tasks authorized by the account owner.

Authorization and revocation

Google OAuth grants access without giving Ada the Google account password. Access and refresh tokens allow the integration to call Google APIs and maintain the authorized connection. You can review or revoke the connection in Google Account connections. Revocation stops further authorized API access once effective; it does not erase previously stored copies, undo sent messages, or reverse changes already made in Google services.

Storage in the Hermes environment

OAuth tokens and client configuration are stored in files in the private Hermes environment. Token-file access is restricted through operating-system permissions to the operator’s Windows account, system processes, and administrators. These credentials are separate from the public website and are not sent to website visitors.

Google-derived content and task results may be retained in conversation and tool history, the Hermes session database, operational logs, downloaded attachments, working files, generated documents, and saved memory or profile notes. Memory is enabled in the inspected setup. Local backup archives of the Hermes environment also exist and may contain credentials and Google-derived content. A backup is a separate retained copy.

The operator and people or processes with authorized administrative access to the environment or its backups may technically be able to access these files. Access controls are not a claim of end-to-end encryption or that data never leaves the computer.

AI processing and other disclosures

Relevant Google-derived content, instructions, conversation context, and tool results may be sent to configured third-party AI providers to perform requested tasks. The inspected primary configuration uses OpenAI through a Codex connection. A local Hermes installation does not mean inference is entirely local. If the configured provider changes, this disclosure must be reviewed before Google data is processed in a new way.

AI-provider processing is also subject to the provider’s applicable terms, account settings, and retention practices. This policy does not make an independently verified promise about the provider’s retention or model-training settings. Google-derived content must only be processed through provider arrangements compatible with Google’s applicable Limited Use requirements.

Requested actions may also disclose data to the recipients or services involved—for example, sending an email, inviting an event participant, or sharing a file. The account owner must authorize those disclosures. Contacting Ada by email sends the information you choose to include to the dedicated Gmail account and may bring it into the assistant’s workflow.

Google API Services and Limited Use

Ada’s use and transfer of information received from Google APIs must adhere to the Google API Services User Data Policy, including its Limited Use requirements. These restrictions cover Google data and information derived from it.

Permitted use is limited to providing or improving the assistant features described here. Transfers require the user’s consent and must support those features, security, or applicable legal obligations. Google data must not be sold, used for advertising, transferred to data brokers, used for credit or lending decisions, or used to train general-purpose AI models. Human review requires the user’s affirmative agreement for specific data, except where Google’s policy permits a narrow security, legal, or aggregated internal-operations exception. These are operating restrictions, not a statement of Google certification or approval.

Retention and deletion

The inspected setup does not establish a fixed automatic deletion period for Google-derived data across sessions, memory, logs, working files, and backups. Do not assume that closing a conversation or revoking OAuth deletes them. Retained information can remain until the operator removes the relevant copies.

To request access, correction, or deletion, contact ada.lovelace.agent@gmail.com. Identify the data or task involved and avoid sending passwords, tokens, or unnecessary confidential content. The operator may need to verify your authority before acting. Deletion needs to consider active records, saved memories, files, logs, and backup archives separately. Data held by Google, AI providers, or recipients is also subject to their own controls; removing a local copy does not recall information already sent. No fixed completion deadline or automatic backup-expiry period is promised.

This website

This site is informational. It has no login, collection form, analytics script, tracking pixel, advertising, or application cookies. Styles and images are served from this site; no external fonts or other third-party assets are loaded. Links to other services contact those services only when followed.

The web server and reverse proxy can process ordinary request information, including network addresses available to them, request paths, timestamps, response status, and browser details, in operational access and error logs. The existing relay can obscure the original visitor address. No fixed website-log retention period is stated. DNS is hosted by Cloudflare in DNS-only mode; website traffic is served by the operator’s existing hosting infrastructure.

Changes and contact

This policy must be updated when the implementation or data uses change. New uses of Google data require the disclosures and consent required by Google’s policy. For privacy questions or requests, contact ada.lovelace.agent@gmail.com.