Privacy policy
Effective September 13, 2026
Scope and operator
Pennyworth is a private personal-assistant integration operated by its owner using Hermes Agent. It is used with the owner's authorized Google accounts, not offered as a public account-registration service. This policy covers the assistant's handling of Google user data and these information pages. It does not describe The Phoenix Board's separate products or services.
Google data accessed
Depending on permissions granted for each account and the task requested, Pennyworth can access Gmail message headers, senders, recipients, subjects, bodies, labels, and relevant attachments; and Google Calendar event titles, dates, times, locations, descriptions, attendees, and reminder information. Permissions differ by account. Where granted, email sending or modification and calendar editing are available, but changes require the owner's approval.
Google OAuth credentials, including refresh tokens, allow the assistant to request authorized access without the owner repeatedly signing in. The assistant does not need the owner's Google password or multifactor-authentication codes.
How data is used
Data is used to perform the owner's personal-assistant tasks: summarize correspondence, identify follow-ups, plan appointments, provide reminders, answer questions, and carry out approved actions. Google data is not used by this integration for advertising, sale, data brokerage, or training a general-purpose AI model.
AI processing and message delivery
Relevant email or calendar content may be included in requests to the AI providers configured for the assistant, including OpenAI. The provider used can change with the owner's configuration. Requests and responses are subject to the applicable provider's processing and retention terms; processing is not confined to the owner's computer.
Assistant replies and reminders, which may contain relevant personal information, can be delivered through Telegram and retained in that conversation. The assistant may also process information through other services when the owner explicitly requests a task involving those services. This is not public disclosure, but it does mean the services used may receive task-related data. Service providers may process data outside the owner's country.
Storage and retention
OAuth credentials and assistant state are stored in the owner's managed environment. Relevant content can also remain in conversation history, operational logs, reminder state, selected memory notes, and backups where configured. These records do not currently have a single automatic deletion deadline; they may remain until the owner removes them. AI-provider and messaging-service retention is governed separately by those services.
Credentials and private assistant records are not part of this public website. Google data is not intentionally published on these pages.
Control, revocation and deletion
The owner can revoke Pennyworth's Google permissions at Google Account connections. Revocation stops future authorized API access but does not automatically erase previously stored assistant history, memories, messages, logs, or backups.
The owner can request deletion of locally retained assistant data through their private assistant channel. Deletion must also address relevant memories, logs, and configured backups. Telegram messages and data retained by AI providers may require separate deletion controls or requests to those services. Deleting an assistant record does not delete the original Gmail message or Calendar event unless the owner separately authorizes that action.
Public website
These static pages are hosted by Cloudflare. They have no registration forms, Google sign-in flow, embedded analytics scripts, advertising, or mailbox/calendar content. Cloudflare processes connection information such as IP addresses and request metadata to deliver and protect the website, under its privacy policy.
Google API Limited Use
Pennyworth's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Questions and changes
For questions, access concerns, or deletion requests, contact the operator using the support email displayed on Pennyworth's Google OAuth consent screen or the owner's established private assistant channel. Material changes to data practices require updating this policy and, where required, obtaining renewed authorization. The effective date above identifies the current policy.