Every password you've typed on your phone. Every late-night chat. Every search term. Before you hit send, your keyboard app has already seen it.

Not just "seen" it. Modern keyboards remember. They learn. They upload to the cloud.

This isn't a bug. It's baked into the architecture. A keyboard app sits below the app layer, above the OS. Every keystroke passes through it before reaching any app. It sees every key you press. It knows which app you're typing in. It can read your clipboard and your contacts.

The real problem isn't whether it collects data. It's that you have no way to verify what it collects, or where that data ends up.

Three Documented Facts

In 2022, researchers at Trinity College Dublin ran a deep analysis of network traffic from Gboard and SwiftKey. They found both apps sent far more than just keystrokes. This included the language of each word, word length, precise typing timestamps, and which app the user was typing in. SwiftKey also reported extra typing-efficiency stats - full typed words versus predicted ones accepted, swipe-typing frequency, and other behavioral metrics. Both keyboards sent users' device advertising IDs back to their respective servers.^[1]

In 2017, a third-party keyboard app called ai.type left its MongoDB database exposed online with no password. Nearly 580GB of user data was accessible to anyone. The leak included users' full names, email addresses, precise geolocation, device IMEI/IMSI numbers, contact lists, and over 8.6 million records of keystroke input - including email addresses paired with their passwords. The developer had roughly 31 million users across iOS and Android.^[2]

In 2016, Microsoft's SwiftKey suffered a serious sync failure. Users started receiving predictive text suggestions containing other people's email addresses and phone numbers. Microsoft was forced to suspend cloud sync in an emergency response.^[3]

String these three events together, and a clear pattern emerges. Keyboard data collection is systemic. It spans keystroke content, behavioral patterns, device fingerprints, and social connections. Users have almost no visibility into this, and even less control.

Two Ways Out

Given this, the practical choices are clear:

Option one: Switch to an open-source, auditable keyboard that runs entirely locally and uploads nothing.

Take AnySoftKeyboard, for example. The Trinity College Dublin study confirmed it "sends no telemetry to any server.^[1] The cost: no AI prediction, no smart suggestions, no cross-device sync. You trade convenience for security.

Option two: Keep using a commercial keyboard, but cut off its network access entirely through technical means.

This isn't about toggling off "cloud prediction" inside the keyboard's settings - that toggle only works as well as the vendor's self-restraint. It means blocking the app from making any network connection at all, at the operating system level. The keyboard still works normally. It just can't send a single byte out.

PlugOS's Answer

PlugOS is built on one principle: privacy first, zero data collection.

Its built-in keyboard runs entirely on-device. No cloud prediction. No user dictionary uploads. No telemetry. Data leakage is ruled out at the code level.

If you need to use a third-party commercial keyboard, PlugOS's built-in system-level firewall lets you set fine-grained network access rules per app. Turn off network access for your commercial keyboard with one tap. It still types normally - but every byte of data stays trapped on the device, with no way out.

This isn't "advising users to be careful." It's making data leakage structurally impossible, at the OS architecture level.

Article source

1. Kamil Swierkosz, supervised by Prof. Doug Leith. "How Private Are Android Keyboards?" School of Computer Science and Statistics, Trinity College Dublin, 2022. https://www.scss.tcd.ie/Doug.Leith/pubs/gboard_kamil.pdf

2. Tomáš Foltýn. "Virtual keyboard app exposes personal data of 31 million users." WeLiveSecurity (ESET), December 7, 2017. https://www.welivesecurity.com/2017/12/07/keyboard-app-personal-data-31-million-users/

3. "SwiftKey sync glitch leaks strangers' email addresses and phone numbers to other users." Android Authority, July 2016. https://www.androidauthority.com/swiftkey-suspends-service-data-leak-706680/