Privacy Policy
Effective date: July 21, 2026 • Last updated: July 21, 2026
Operator: Radness Co. (Eugene O’Dell) • Website: https://radness.co
Privacy contact: [email protected]
Summary. Hermes Citadel is a personal AI agent and productivity tool operated by Radness Co. When you connect Google (for example Gmail), Hermes Citadel uses OAuth to access only the Google account data you authorize, so the agent can help you read, search, organize, and act on email and related Workspace data at your direction. We do not sell personal data. Google user data is used only to provide and improve user-facing Hermes Citadel features, consistent with the Google API Services User Data Policy and its Limited Use requirements.
1. Who we are
This Privacy Policy describes how Radness Co. (“we,” “us,” or “our”), operated by Eugene O’Dell, collects, uses, stores, and shares information in connection with:
- the website at radness.co (including games and related pages); and
- the Hermes Citadel application and integrations, including Google OAuth access to Gmail and other Google Workspace APIs that you choose to authorize.
For privacy questions or requests, email [email protected].
2. Scope and relationship to Google
Hermes Citadel’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Hermes Citadel is an independent product of Radness Co. and is not affiliated with, endorsed by, or sponsored by Google LLC.
When you sign in with Google, Google’s own privacy policy also applies to Google’s processing: https://policies.google.com/privacy.
3. Information we collect
3.1 Information you provide
- Contact details you send us (for example email address and message content when you contact support).
- Optional names or nicknames submitted to public game leaderboards (for example Dope Wars high scores).
- Configuration and preferences you set for Hermes Citadel (labels, automation rules, agent instructions).
3.2 Google account data (only if you connect Google)
If you authorize Hermes Citadel via Google OAuth, we may access Google user data only within the scopes you grant. Depending on configuration, this may include:
- Identity: email address and basic profile identifiers associated with the Google account (for example
userinfo.email, OpenID).
- Gmail: message metadata and content, labels, drafts, send capability, and certain settings when scopes such as Gmail read/modify/send/labels/settings or full mail access are granted.
- Google Calendar: calendar lists and event data when calendar scopes are granted.
- Google Drive (read-only, if granted): file metadata and content needed for features you request.
- Contacts (read-only, if granted): contact names and addresses needed for features you request.
- Google Sheets (if granted): spreadsheet content you ask Hermes to read or update.
We request only the scopes needed for the Hermes features you enable. You can revoke access at any time in your Google Account permissions: https://myaccount.google.com/permissions.
3.3 Website / technical data
- Standard server and tunnel logs (IP address, user agent, request path/time, approximate location derived from IP by infrastructure providers).
- Optional client-side diagnostics events used to fix bugs on radness.co.
- Game scores and related stats you submit to leaderboards.
We do not use third-party advertising cookies on radness.co. Essential hosting/CDN (Cloudflare) may process connection data to deliver the site securely.
4. How we use information
We use personal data to:
- Provide Hermes Citadel features you request — for example searching and summarizing email, drafting or sending messages you approve, managing labels, reading calendars, and related Workspace productivity actions.
- Operate and secure radness.co — serve pages and games, maintain leaderboards, prevent abuse, debug outages, and protect systems.
- Communicate with you about support requests, security issues, or material policy changes.
- Comply with law and enforce our Terms of Service.
Google user data — Limited Use commitments
- Google user data is used only to provide or improve user-facing features that are prominent in Hermes Citadel.
- We do not sell Google user data.
- We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based ads.
- We do not transfer Google user data to third parties except as needed to provide the user-facing features you request (for example the language model provider that processes a prompt you initiate), for security, to comply with law, or as part of a merger/acquisition with prior notice where required — and always consistent with Google’s Limited Use rules.
- We do not use Google user data for creditworthiness or lending decisions.
- Human review of Google user data (for example specific email contents) occurs only with your direction/consent, for security/abuse investigation, to comply with law, or in aggregated form for internal operations as permitted by applicable law and Google policy.
- We do not use Google user data to train generalized AI/ML models in a way that violates Google’s Limited Use requirements. If a model provider processes content to fulfill your request, that processing is for providing the Hermes Citadel feature you asked for, not for unrestricted model training on your Gmail data by Radness Co.
5. Legal bases (EU / UK GDPR)
If you are in the European Economic Area, United Kingdom, or a similar jurisdiction, we process personal data under these legal bases where applicable:
- Contract — to provide Hermes Citadel and website features you request.
- Consent — for Google OAuth access and optional processing you opt into; you may withdraw consent by revoking Google access or contacting us.
- Legitimate interests — securing our services, preventing abuse, and improving reliability, balanced against your rights.
- Legal obligation — where we must retain or disclose information to comply with law.
6. Your privacy rights
6.1 EU / UK (GDPR)
Subject to applicable law, you may have the right to access, rectify, erase, restrict, or object to certain processing, and the right to data portability. You may also lodge a complaint with your local supervisory authority. To exercise rights, email [email protected].
6.2 United States (including California CCPA/CPRA)
Depending on your state, you may have rights to know/access, delete, correct, and opt out of certain data practices. We do not sell personal information and we do not share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that require a right to limit under CPRA beyond providing the services you request. To submit a request, email [email protected]. We will verify requests reasonably and will not discriminate against you for exercising your rights.
6.3 Global controls
- Revoke Google access: Google Account permissions.
- Request deletion of Hermes Citadel-stored tokens, caches, or derived notes about your account by contacting us.
- Stop using the website and games at any time.
7. How we share information
We share personal data only as needed to operate Hermes Citadel and radness.co:
| Category | Examples | Purpose |
|---|
| Infrastructure | Cloudflare (tunnel/CDN/DNS), hosting on our servers | Deliver and protect the website and agent services |
| AI model providers | Configured LLM APIs used by Hermes Citadel | Generate answers/actions for prompts you initiate; may process content you include (which can include email excerpts you ask Hermes Citadel to handle) |
| Google | Google OAuth and Workspace APIs | Authenticate you and perform authorized API calls |
| Legal / safety | Authorities or advisors | When required by law or to protect rights, safety, and security |
Service providers are expected to process data only on our instructions and with appropriate safeguards. We do not authorize them to use Google user data for advertising.
8. Storage, retention, and security
- Location: Hermes Citadel credentials and operational data for this deployment are stored on systems controlled by Radness Co. (including servers used to run Hermes). Infrastructure providers (for example Cloudflare) may process traffic globally.
- OAuth tokens: stored to maintain your connected session and refreshed as needed; deleted or invalidated when you revoke access or request deletion.
- Email/content: processed to fulfill your requests; not kept longer than needed for the feature, debugging you request, security, or legal obligations. Ephemeral agent context may be retained in local logs/session history for a limited time for continuity and troubleshooting.
- Leaderboard entries: retained until removed by us or upon a valid deletion request.
- Security: access controls, least-privilege configuration, encrypted transport (HTTPS/TLS), and secret storage practices. No method of transmission or storage is 100% secure; please use strong account protections and revoke access if you suspect compromise.
9. International transfers
If you access Hermes or radness.co from outside the country where our servers or providers operate (including the United States), your information may be processed in the United States and other countries that may have different data-protection laws than your home country. Where required, we rely on appropriate safeguards and your consent/contractual necessity for such transfers.
10. Children
Hermes Citadel and Google-connected features are not directed to children under 13 (or under 16 where a higher digital-consent age applies). We do not knowingly collect personal information from children. If you believe a child has provided personal data, contact us and we will take appropriate steps to delete it.
11. Automated decision-making
Hermes Citadel uses automated systems (including AI models) to generate suggestions and perform actions you request. It is not used to make legal or similarly significant decisions about you without human involvement. You remain responsible for reviewing outbound emails and other actions before approving them when confirmation is required.
12. Do Not Track / Global Privacy Control
There is no industry-wide standard for DNT signals. We honor applicable opt-out rights described above. Because we do not sell personal information or engage in cross-context behavioral advertising, GPC signals do not change a sale/share practice that we do not perform.
13. Third-party links and games
radness.co may include games and links that process limited data (scores, technical logs). Third-party sites have their own policies. This Privacy Policy applies to Radness Co. services described here.
14. Changes to this policy
We may update this Privacy Policy to reflect product, legal, or operational changes. We will post the updated policy at https://radness.co/privacy and revise the “Last updated” date. Material changes affecting Google user data practices will be reflected here before or when those practices change.
15. Contact
Radness Co. / Eugene O’Dell
Email: [email protected]
Web: https://radness.co • Hermes Citadel app page: https://radness.co/hermes
This document is provided for transparency and Google OAuth verification support. It is not formal legal advice. Consider having counsel review before relying on it for regulated deployments.