IeumOffice Privacy Policy

Last updated: October 29, 2026 · Policy by article · Complete list of data flows: PRIVACY.md

This is a translation for your convenience. If it differs from the Korean original, the Korean original applies.

IeumOffice is a desktop program that opens, edits and saves documents on your own PC. The project runs no server of its own, so the app sends nothing to IeumOffice or to its maintainers. It has no usage analytics or telemetry.

Privacy policy by article

This policy is set out under Article 30 of Korea's Personal Information Protection Act. Schools can cite these article numbers when they check the required standards for learning-support software. The sections after it explain the same points in more detail, feature by feature.

Article 1 (General provisions and how data is handled)

The developer of IeumOffice (the "operator") handles users' personal information according to this policy in running the IeumOffice program and its website (ieumoffice.com).

IeumOffice is a desktop program you install and use on your own PC, and the operator runs no server. There is no sign-up or login, and no usage analytics or telemetry.
Documents, settings and AI chat history are stored only on your PC (on Windows, %APPDATA%\IeumOffice) and are not sent to the operator. Even if you open a document with students' writing or a class list, the operator does not receive its content.
When you use AI features, document content is sent directly from your PC, under your own account, to the AI service you chose (Anthropic's Claude, OpenAI's ChatGPT or Codex, the provider of an API key you entered, and so on). This transfer happens under your own agreement with that company, and the operator cannot receive or see it. Parts of a document you hid from AI are not sent.
The only personal information the operator handles directly is what users choose to send: the feedback survey, email inquiries and the question helper on the website. Article 2 lists the items. Posts on GitHub Issues are published publicly on GitHub and follow GitHub's policies.

Article 2 (Personal information handled)

Channel	Items	How it is collected
Feedback survey	Required: type of feedback Optional: details, app information (version, operating system, display language), an email address for a reply	Entered by the user in a Google Form
Email inquiries	The sender's email address and display name, the message and its attachments	Mail the user sends to pblsketch@gmail.com
Website question helper	Question, answer, titles of the help pages used as sources, time (text that looks like an email address, phone number, Korean resident registration number or card number is masked before it is stored)	Entered by the user in the question window

The IeumOffice program sends no personal information to the operator. The website uses no cookies or visitor analytics tools, and the question helper's log keeps no IP addresses or browser details. The operator does not collect unique identifiers such as resident registration numbers, or sensitive information.

Article 3 (Purposes)

Feedback survey: checking and reproducing bugs, improving features, and replying if you left an email address
Email inquiries: reading the inquiry and replying
Question helper: answering questions, and finding the questions it could not answer so the help pages can be filled in

The information is not used for any other purpose, and never for advertising, sale or user profiling. If the purpose changes, the operator takes the necessary steps under Article 18 of the Personal Information Protection Act, such as asking for separate consent.

Article 4 (Retention and destruction)

Feedback survey responses and email inquiries: destroyed one year after handling (such as a reply) is finished.
Question helper log: deleted automatically after 90 days.
If you ask for deletion, the information is destroyed without delay, even before that period ends.

Destruction means permanently deleting the rows of the survey response sheet and the mail so that they cannot be recovered. Nothing is kept on paper. No other law requires any of this information to be kept.

Article 5 (Provision to third parties)

The operator does not provide personal information to third parties, except in the cases set out in Articles 17 and 18 of the Personal Information Protection Act (your separate consent, a specific provision of law, compliance with a legal obligation, and so on). The AI transfers in Article 1 are sent by you, from your own account, to a service you chose; they are not provided by the operator.

Article 6 (Outsourcing and transfer abroad)

The operator entrusts the handling of personal information to the services below, which are located outside Korea.

Recipient (contact)	Task entrusted	Items transferred	Country, timing, method	Retention
Google LLC (privacy inquiry form)	Storing survey responses and question logs (Google Forms, Google Sheets), receiving inquiry mail (Gmail)	The survey, mail and question log items in Article 2	Google data centers in the United States and elsewhere / sent over the network when you submit the survey, send mail or ask a question	The periods in Article 4
Vercel Inc. (privacy@vercel.com)	Hosting the website, running the question helper's server function	The question and the recent conversation in the same window	Vercel data centers in the United States and elsewhere / sent over the network when you ask a question	Not stored (discarded as soon as it is processed)
Anthropic PBC (privacy@anthropic.com)	Writing the question helper's answers (Claude)	The question and the recent conversation in the same window	United States / sent over the network when you ask a question	Deleted within 30 days (Anthropic's API policy), not used for training

If you do not want your information transferred abroad, don't use the survey, email or the question helper. You can still use the IeumOffice program without any limit, and no information goes to the operator.

Article 7 (Your rights and how to use them)

You can ask at any time to see, correct or delete the personal information the operator handles about you, or to stop its handling. Send the request to pblsketch@gmail.com; you will be told the result within 10 days of receipt.
You can also make a request through a legal representative or someone you have authorized.
Tell us when you submitted the survey, or when you asked a question and what it was, and the record will be found and handled. The operator does not receive names or account information, so only that information is used to confirm it is you.
You manage the documents, settings and chat history stored on your PC yourself. You can delete chat history in the app, and deleting the data folder (%APPDATA%\IeumOffice) removes all of it.

Article 8 (Personal information of children under 14)

IeumOffice is made for adults, including teachers, to use for their work. There is no sign-up and the operator does not receive student information, so it collects no personal information of children under 14.
Documents with students' writing or student information are stored only on the PC that opened them and do not go to the operator.
AI features run on the AI company account you connected yourself and follow that company's age limits (for example, Anthropic's Claude is for users 18 and older). When you hand a document with student information to AI, we recommend hiding names and other identifying details with Hide from AI, or deleting them, first.
The survey, email and question helper are channels for adult users. If we learn that a child under 14 has sent personal information, we treat it as information given without a legal representative's consent and destroy it without delay.

Article 9 (Security measures)

Administrative: the items handled are kept to the minimum in Article 2, and only the operator reads survey responses, mail and question logs, which are not shared with anyone else.
Technical: traffic between the site and the survey, mail and AI services is encrypted with HTTPS. Before a question is logged, text in the form of an email address, phone number, resident registration number or card number is masked, and no IP address is kept. The program sends nothing to an operator server, and the Google Drive sign-in token is encrypted with the operating system's protection and stored on your PC.
Physical: the operator runs no server or server room of its own; storage relies on the data center protection of the processors in Article 6.

Article 10 (Privacy officer and remedies)

Privacy officer: 박준일 (developer of IeumOffice) · pblsketch@gmail.com
IeumOffice is run by an individual developer, so there is no separate phone line; inquiries are taken by email.

You can also report a privacy violation or ask for advice at these Korean agencies.

Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
Supreme Prosecutors' Office: 1301, www.spo.go.kr
Korean National Police Agency: 182, ecrm.police.go.kr

Article 11 (Changes to this policy)

If this policy changes, the changes and their effective date are posted on this page, and the last-updated date at the top is revised. You can see past changes in this page's change history. This article-by-article policy takes effect on October 29, 2026.

What leaves your PC

Data leaves your PC only in the cases below, and even then it goes directly from your PC to the service named. How each service handles what it receives follows that service's terms and the settings of your account there.

AI chat. What you typed, the document content the request works on, the files and images you attached, skills (the text of those you pick or the AI uses, and the title and description of those the AI may use on its own), and the conversation are sent to the AI provider (your Claude or ChatGPT subscription, an API-key provider you chose, or a free connection through OpenRouter or Google). Each request goes directly under your own account.
Search and pictures. When the AI or ieumoffice search searches the web, the search terms go to the search service; when you insert a picture by address, the request goes to the site that hosts it.
Checking for a new version. The installed app asks GitHub for the list of public releases.
Importing skills. Files are downloaded from a public GitHub repository only when you import a skill by its GitHub address under Settings → Skills, confirm an install the agent window suggested, or press the update check. No sign-in information is sent.
Send feedback. Only when you press it, the app shows and copies the product version, operating system and display language, then opens a Google Form. Document content, paths and accounts are not included.
Google Drive (if you connected it). Explained separately below.

Every other data flow (the OpenRouter connection, Gemini key check, PDF read by AI and translation, image generation, picture and video analysis, Markdown image upload, the "Make a new document" window, agent mode, and so on) is listed in the tables in PRIVACY.md.

Google Drive

Connecting Google Drive is optional and starts only when you press Connect Google Drive under Settings → Integrations. Sign-in happens on Google's own page in your system browser. IeumOffice has no Google sign-in form of its own and never receives or stores your Google password.

Google user data IeumOffice accesses

IeumOffice requests the single scope https://www.googleapis.com/auth/drive.file, which reaches only the files you choose. It can open and edit only the files you choose in Google's file picker and the files IeumOffice created; it cannot see the rest of your Drive. With it the app accesses:

Account display: the connected account's name and email address, used only to show in Settings which account is connected.
File metadata of the files you chose: name, type, size, modified time, checksum, parent folder ID, and whether you can edit it. It is used for the app's "Files you chose" list, the search within it, and the AI's search.
File content: the files you open, the files you attach to the AI panel, and, if you turned it on, the files the AI reads.

The app writes to Drive only when you press Save: it uploads the edited document to that Drive file, or, if you choose (and when a Google document is saved as an Office file), as a new file beside it or in My Drive. IeumOffice never deletes, moves or shares Drive files, and it does not touch data in other Google services such as Gmail or Contacts. It creates no aggregated or anonymized data from Drive.

How the data is used

Drive data is used only for features you see: showing file lists and search results, opening a file in an editor, saving your changes back to Drive, and, if you turned it on, letting the AI find and read the files you chose to answer your request. It is not used for advertising, sale, lending or credit decisions, or user profiling, and IeumOffice does not use it to develop or train AI models. The project runs no server and never receives Drive data, so no one, including its maintainers, sees your Drive data.

Who receives it

Google: Drive requests go directly from your PC to Google, under your account.
The AI provider you chose, only when you hand a document opened from Drive to the AI, attach a Drive file to the AI panel, or let the AI search and read the files you chose: the list of files found and the text read go to that chat's AI provider. That is the one you picked: Anthropic (Claude), OpenAI (ChatGPT or Codex), or the provider of an API key you entered. It goes directly from your PC under your account. Parts you hid with Hide from AI stay hidden.
No one else. Drive data is not transferred or sold to IeumOffice, its maintainers, advertisers, data brokers or any other third party.

Google does not allow Drive data to go to an AI service that uses it to train its models. So IeumOffice does the following:

Before you can connect Drive, the app asks you to confirm that model training is off in the AI accounts you use with Drive files, and shows where to turn it off (Claude: Settings → Privacy; ChatGPT and Codex: Settings → Data controls → "Improve the model for everyone"). Until you confirm, you cannot connect, choose files, or hand Drive files to the AI.
The Anthropic and OpenAI APIs (key providers) do not use API inputs for training by default.
Free AI connections (Gemini, OpenRouter free models) cannot turn training off, so they are never given Drive files. While a free connection is in use, attaching from Drive, the AI's Drive reading, and AI requests from a document opened from Drive all stop.

How the data is protected

No project server is involved; traffic between your PC and Google is encrypted with HTTPS.
Sign-in uses PKCE and an address that only opens on this PC (127.0.0.1), so other programs cannot intercept the result.
The refresh token that keeps you signed in is encrypted at rest with the operating system's protection (Windows' protection for your user account, the macOS keychain, or a desktop keyring on Linux). Where it cannot be encrypted, it is not saved. The access token stays in memory only, and tokens and file content are never passed to editor windows or written to logs.
The AI's Drive tools are read-only: the AI cannot change, delete, move or share Drive files.
So that an AI misled by text inside a document cannot carry Drive content elsewhere, once Drive content is in a chat, that chat stops using web search, image search, pictures fetched by address and reading a page by address.

Retention and deletion

The sign-in token stays on this PC until you disconnect. Disconnect deletes the token file and asks Google to revoke it. You can also remove the app's access at any time under Third-party connections in your Google Account.
Copies of Drive files you opened (drive-cache in the data folder) are deleted when the app starts if you have not opened them for a month and they hold no change still to be uploaded. Files downloaded to attach to an AI chat are deleted after a week.
Drive content that went into an AI chat stays in that chat's history on this PC and is deleted with the chat. What was sent to an AI provider follows that provider's retention policy.
Deleting the data folder (%APPDATA%\IeumOffice on Windows) removes all of the above. The project keeps no Drive data of its own, so there is nothing to delete outside this PC.

Google API data policy compliance

IeumOffice's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements, and IeumOffice does not use that data to develop, improve or train generalized AI or machine-learning models.

What stays on your PC

Your documents, and helper files some editors keep next to a document.
AI chat history and settings (the data folder, %APPDATA%\IeumOffice on Windows).
Your Google Drive sign-in (google-drive.json), encrypted with the operating system's protection (Windows' protection for your user account, the macOS keychain, or a desktop keyring on Linux) and deleted when you disconnect. If this PC cannot encrypt it, it is not saved and the connection lasts until the app closes.
Copies of the Drive files you opened (drive-cache in the data folder) and the temporary folder for AI attachments.
Your ChatGPT connection, if you connected ChatGPT in the app (chatgpt-connection.json): the sign-in OpenAI gave this app and IDs for this installation and your OpenAI account, no email address. It is encrypted with Windows' protection for your user account or, on Linux, your desktop keyring; on macOS and on Linux without a keyring it is stored unencrypted. Disconnecting asks OpenAI to end the sign-in and deletes it from this PC. It is separate from the Codex program's login, and the app never sees your ChatGPT password.

PRIVACY.md's "What stays on your PC" section lists everything that is kept locally, where, and when it is deleted.

This site's question helper

Everything above is about the IeumOffice app. The Ask a question window at the bottom right of this site (ieumoffice.com) works separately. When you send it a question, the question and the last few turns of that window's conversation go through the site's server function (Vercel) to Anthropic's Claude. Claude writes the answer from what it finds in IeumOffice's help and guide pages.

To find questions the helper cannot answer and add to the help pages, the question, the answer, the titles of the pages it used and the time are kept in the maintainer's Google Sheet for 90 days and then deleted. No IP address or browser details are kept, and anything that looks like an email address, phone number, Korean resident registration number or card number is masked before it is stored. Only the maintainer sees the log. To have a question deleted, write to the contact below or pblsketch@gmail.com with when you asked and what.
Nothing is stored in your browser. The conversation exists only on that page and is gone when you close it.
Anthropic states that it does not use API inputs and outputs to train models by default and deletes them within 30 days.
To stop floods of questions in a short time, the server briefly counts questions per IP address. The count lives only in the server's memory and then disappears.
Please don't include personal information or document content.

Contact

github.com/pblsketch/ieumoffice/issues or the feedback survey.