Hermes Connector — Privacy Policy
Last reviewed: 2026-10-20. Applies to Hermes Connector 0.2.6 (Chrome extension) and its local companion.
Hermes Connector lets a Hermes agent running on your computer read and control the Chrome tabs that you explicitly attach to one of its sessions. This policy explains which data the extension handles, where that data goes, and the controls available to you.
Publisher: Corsen AI. Contact: [email protected].
The short version
Hermes Connector works only on your computer. Corsen AI does not operate a relay, an analytics service, an account system or a telemetry endpoint for the extension, and receives none of the data described below.
The extension talks only to your local Hermes installation, over loopback addresses (127.0.0.1 or localhost). What Hermes then does with page content depends on your Hermes configuration, as explained under "Where data goes".
Data the extension handles
To provide its single browser-control purpose, the extension can handle:
- Website content from attached tabs: visible text, accessibility structure, element labels, and the screenshots you request.
- Browsing activity for attached tabs: their URL and title. When you open Tabs, current tab titles and URLs are displayed locally so you can choose which tabs to attach.
- Text and navigation instructions sent by your locally configured Hermes agent.
- Hermes profile and session identifiers, titles and activity timestamps, received from the local Hermes Connector companion over the authenticated loopback connection, or read from your local Hermes Web dashboard (or, on older Hermes releases, the Desktop backend). Working directories, costs and message content are never transferred.
- A random browser identifier, tab bindings, the loopback addresses you choose, and the local Connector pairing credential, stored in Chrome local storage.
- In Web-dashboard mode only, an ephemeral Hermes local session token, read into memory from the Web dashboard (or legacy Desktop backend) and returned only to that same Hermes loopback HTTP API. The extension never stores it.
The extension does not read website cookies or website/browser login storage. Password, one-time-code and payment-field values are redacted from accessibility snapshots. Visible page text and screenshots can still contain sensitive information, so attach only tabs you are comfortable sharing with your Hermes configuration.
Where data goes
The extension communicates with the separately installed Hermes Connector companion over an authenticated loopback WebSocket (ws://127.0.0.1 or ws://localhost). It receives session identifiers, profile names, titles and activity timestamps from that companion, or reads session metadata from the local Hermes Web dashboard and loads the dashboard you selected, over HTTP loopback. Page data is sent only to that local Hermes installation, to perform the action you requested. The ephemeral session token is sent only back to that same loopback Hermes API. None of this data is sent to Corsen AI.
What Hermes does after receiving page content depends on your Hermes configuration. A local model can keep processing on your device. If you have configured Hermes to use a remote model or another service, Hermes may transmit the content to that provider under the provider's terms. Corsen AI does not select or receive that transmission.
Storage and retention
The extension stores its random browser identifier, local addresses, the local Connector pairing credential and the profile/session-to-tab bindings in Chrome local storage until you clear the extension's data or remove the extension. It does not persist page snapshots, page text, screenshots or form content. The local companion keeps the pairing credential and the browser-binding preference under your Hermes home. Hermes itself may retain chats or tool results according to your Hermes settings.
Publisher access and Limited Use
Corsen AI does not receive, sell, rent, monetize or use this data for advertising, profiling, creditworthiness or any purpose unrelated to the extension's single browser-control function. Corsen AI personnel cannot access locally processed data. There is no telemetry.
Hermes Connector's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Security
The companion listens only on loopback. The extension and the companion use a persistent high-entropy secret with role-bound mutual HMAC authentication; the secret itself is never sent over the WebSocket. Each Hermes profile and session is routed only to the tabs explicitly attached to that exact scope. A session with no attached tab is refused instead of falling back to another tab.
Permissions
| Permission | Why it is needed |
|---|---|
<all_urls>, scripting | Read and act on the page in a tab you attach, which can be on any website. Chrome also requires broad host access for a screenshot you request. |
storage | Keep the local pairing credential, browser identity, settings and tab bindings on your device. |
sidePanel | Show the connector controls and session status, or your local Hermes Web dashboard, beside the page. |
alarms | Keep the local connection available while a Hermes task is running. |
debugger | Chrome does not allow this permission to be optional. The extension attaches the debugger only after you turn on Trusted input, and then only for reliable clicks, typing, keys, hover and dialogs in the selected tab. Chrome shows its debugging banner while attached. |
Your control
Tabs are inaccessible to Hermes Connector until you attach them to a specific Hermes session. You can detach a tab, turn off Trusted input, clear the extension's storage, disable the companion plugin or uninstall the extension at any time.
Changes
This policy changes only when the extension's handling of data changes, and the review date at the top is updated. Previous versions are available on request to [email protected].
Contact
Questions about this policy: [email protected].
Hermes Connector is an unofficial community extension by Corsen AI. It is not affiliated with or endorsed by Nous Research or Google.