Ieum
Security Philosophy & Policy

Typical large messenger companies permanently store massive amounts of conversation logs in their main server databases to analyze users or comply with requests from external organizations.

Ieum is different. Ieum's server acts only as an encrypted connection path (Relay Queue) between terminals. Messages (both 1:1 and multi-party group chats), photos, and WebRTC call connections are completely disintegrated on the network server as soon as the delivery is successful and the other device confirms read/receipt.

All messages and files transmitted are subject to the highest level of End-to-End Encryption (E2EE) through X25519-based elliptic-curve cryptography and AES-256-GCM. This means that even server administrators or Internet Service Providers (ISPs) cannot decrypt the contents. Flawless security is maintained through a secure symmetric key exchange method even in group chat rooms where hundreds of people gather.

The moment you collect phone numbers, emails, or social security numbers, you are at risk of being tracked. Ieum does not require any such identifying information and issues a unique anonymous ID solely through a mathematical Proof of Work (PoW) within the smartphone.

All control and restoration authority over the account depends entirely on the 12 English words (mnemonic key) provided at signup. Without this key, even the developers cannot access or restore the account.

The biggest problem with the latest cloud AI services is that my private prompts are sent to the servers of external companies. Ieum strictly adheres to the On-Device Local AI principle.

• Text Translation and Correction: It operates safely even without an internet connection by using an ultra-small language model installed on the smartphone. Text is not sent to external APIs (Google, OpenAI, etc.).
• AI Document Library (GraphRAG): The original PDFs uploaded by the user, the Vector DB extracted from them, and the knowledge graph elements are kept 100% only in the local storage inside the smartphone.

ieum requests only the minimum smartphone access permissions to provide users with a smooth and secure messenger environment. ieum never collects any original data (photos, voice, location, etc.) obtained through access permissions on its central server without authorization or provides it to third parties.

All data is used only once for P2P encrypted communication or stays safely inside the user's device for offline Local AI operations.

• 1. Camera
  - Purpose: Profile photo shooting, QR code scanning to add friends, WebRTC-based P2P video calls, and AR (cosplay) sticker tracking.
  - Security: Recorded video and photo data are end-to-end encrypted (E2EE) during video calls, transmitted only to the other party, and are not stored on the server.
• 2. Microphone
  - Purpose: WebRTC-based P2P voice and video calls.
  - Security: Call voice data is encrypted and transmitted directly (P2P) only between the calling parties; no one, including ieum servers, can eavesdrop.
• 3. Storage / Photos
  - Purpose: Sending photos and files in chat rooms, backing up/restoring encrypted offline chat histories, and loading files like PDFs for Local AI Vault (GraphRAG) analysis.
  - Security: AI document analysis is performed 100% On-Device, and the contents of the documents are not sent to external clouds or AI companies. Files sent via chat are completely destroyed from the server queue as soon as the recipient receives them.
• 4. Location
  - Purpose: 'Find Nearby Friends' radar function, 'Real-time Location Sharing' in chat rooms.
  - Security: Location information is used temporarily only when the user activates the feature. We do not secretly track the user's movements in the background or leave location records on the server.
• 5. Notifications
  - Purpose: Encrypted new message alerts, voice/video call (including CallingTalk) receiving alerts.
  - Security: All processing to display message contents as notifications takes place inside the device; only a secure identifier is transmitted through the push notification server without exposing the content.

(※ For optional access rights such as location information, you can normally use the app's basic messenger functions excluding the relevant features even if you do not grant permission.)

Ieum provides users with all the means to defend themselves.

• Two-way Instant Destruction: Not only 'Bomb Messages', but even if you choose [Delete for Everyone] for a message already sent, the message is permanently destroyed not only from your device but also from the other party's smartphone memory. Data ownership fully belongs to the user.
• Cloud Storage Control: Through the 'Storage Management' menu, users can directly check their files or encrypted backups safely stored in the cloud and delete them remotely.
• Double Security (Passcode): In addition to unlocking the smartphone, you can set a numeric passcode within the app to physically block access to the Ieum messenger itself.