Case study · Built by our founder and team
YuMe
A privacy-first mobile app for people recovering from gambling addiction: an anonymous peer community, real-time chat, and coach matching, built on an evidence-based harm-reduction model where every user is anonymous by default and their data is end-to-end encrypted.
The story
YuMe is Rehan Hussain’s product and idea. Our founder joined as tech lead and mobile architect and built the app end to end alongside a small team: a backend engineer wrote the APIs and a UI/UX designer worked on the interface, all under Rehan. It is founder-portfolio work delivered for YuMe, not an Inseed-direct client project, and it is the privacy and encryption story the team leans on.
The people YuMe serves are working through gambling addiction, a deeply personal and often stigmatized problem. They needed real support: a community of others going through the same thing, chat, and access to a coach or counsellor. But asking someone in that position to attach their name to any of it is a good way to make sure they never open the app twice.
So the hard requirement was there from the start. Give people genuine community and clinical support while keeping them anonymous by default and their data private, and let anonymity and rich social plus clinical features coexist without either one undermining the other.
What we built
Every user gets a randomly generated username during onboarding and is fully anonymous by default. From there, disclosure is progressive and entirely user-controlled: someone can reveal their identity to a single person, to a chosen group, or to the whole community, and only when they feel ready. When they want therapy or counselling, they can gradually share more personal detail into the system on the same terms.
The community feed, chat, and coach matching all sit on top of that identity model rather than around it. Posts and messages are keyed to a user’s pseudonymous handle, never their real identity, and coach matching pairs a user with the right kind of coach for their situation without requiring them to reveal who they are.
The privacy guarantee is not a policy line, it is built into the data path. Sensitive content is end-to-end encrypted so the platform keeps its promise at every level of disclosure, which is what lets the social and clinical features exist at all.
Architecture
The mobile app is React Native in TypeScript, with Redux and React Query for state (plus some Context API) and Firebase Auth for phone number, Apple, and Google sign-in. The backend is NestJS on PostgreSQL, deployed on AWS Elastic Beanstalk and built by the backend engineer on the team. That split let the mobile side own the identity and encryption work while the services layer stayed lean.
The identity model is the load-bearing piece. Anonymous-by-default usernames with progressive, user-controlled disclosure meant the app had to let people selectively share real information with a coach, or reveal themselves to others, without ever breaking the privacy guarantee for everyone else. The mapping from a pseudonymous handle to a real identity stays encrypted and is only unlocked under the disclosure rules the user sets.
The encrypted community feed is where the two hardest requirements meet. Posts are encrypted client-side with the Virgil Security SDK before they reach the Stream (GetStream) SDK that powers the feed, and decrypted on each reader’s device, so content stays encrypted in transit and at rest while Stream still delivers new posts in real time. Comments, replies, and reactions attach to a post’s anonymous handle, so Stream threads them correctly without exposing the author.
Selected screens
Stack
One decision worth telling
A normal social feed assumes plaintext content and a known author. YuMe needed the opposite: every post encrypted, every author anonymous by default. That complicates all the usual feed mechanics at once, from smooth scrolling while decrypting many posts, to real-time delivery, to moderation on content the server cannot read, to threading replies without exposing who wrote them.
The approach was to keep encryption on the client and delivery on Stream. Content is encrypted with the Virgil Security SDK before it ever hits Stream and decrypted on each device that reads it, so Stream handles real-time fan-out and threading against pseudonymous handles while never seeing readable content or a real identity. It is the clearest example of what the whole build required: making a strong privacy guarantee sit underneath ordinary-feeling community features.
Outcome
“YuMe is all about seamless social interactions, and Inseed understood that from day one. Their intuitive designs have made our platform more engaging than ever.”
What we would do differently
Most agencies skip this section. We include it because honest hindsight is the kind of credibility you cannot buy.
The identity model touched every feature, from the feed to chat to coach matching, so anything that changed it late rippled everywhere. Locking the anonymous-by-default handle and the progressive-disclosure rules as the first foundation, before building on top, is what we would protect most on a repeat.
Decrypting many posts on the client while keeping scrolling smooth is real work that a plaintext feed never has to think about. Treating that as a first-class performance problem from the start, rather than tuning it once the feed filled up, would have made the encrypted feed feel effortless sooner.
When the server cannot read content, the usual moderation levers do not apply, and that constraint is easy to underestimate on a community product for a vulnerable audience. Designing client-side and community moderation alongside the encryption, rather than after, is the honest lesson.
Related work
Built by our founder
HIPAA-grade telehealth, built solo on mobile, live for 2+ years.
Read the case studyBuilt by Inseed
Zero to App Store in under 4 months. Past 3,000 users in the next 3.
Read the case studyAnonymous identity, end-to-end encryption, real-time community, and coach matching. Tell us what you are shipping and we will tell you what the first four weeks can de-risk.
Book your audit