Why a keyboard is the most sensitive app on your phone
A keyboard sees everything you type: messages, searches, addresses, and in some fields your passwords and card numbers. That’s why Android shows the same warning for every keyboard you turn on:
“This input method may be able to collect all the text you type, including personal data like passwords and credit card numbers.”
The warning is accurate, but it doesn’t tell you the part that matters: whether the keyboard can send that text anywhere. Researchers at the Citizen Lab have called it overbroad for exactly this reason, because it treats a keyboard that sends nothing the same as one that uploads every keystroke.
What “no internet permission” means
Android apps must declare the permissions they need. Network access is the android.permission.INTERNET
permission; an app that doesn’t declare it cannot open network connections. Flikzi declares no permissions at all.
That design has consequences, and we chose all of them on purpose:
- Suggestions and autocorrect run on the phone. The English engine and its word list, and the pinyin engine and its dictionary, ship inside the app.
- No account and no sync. There is nothing to sign in to, and nothing is backed up to a server.
- No analytics and no ads. Flikzi has no way to report how you use it, and it’s paid for instead of funded by ads.
- No voice typing. Good speech recognition usually needs a server, so Flikzi doesn’t have it.
What does Flikzi remember? Your settings, your recent emoji and the skin tones you picked. All of it is stored in the app’s private storage on your phone and removed when you uninstall the app.
One honest footnote: the Contact button inside the app opens your own email app. Anything you send that way is an email you write and send yourself. And like every app, if you’ve allowed usage and diagnostics on your phone, Android and Google Play may tell us that the app crashed; those reports come from Android itself and describe the crash, not your text.
How to check it yourself
You don’t have to take our word for it. On your phone:
- Open Settings and tap Apps.
- Find and tap Flikzi, then tap Permissions.
- Android shows No permissions requested.
Before you install, you can also check on Google Play: open the listing, tap About this app, and scroll to App permissions. The exact menu names vary a little between phone makers.
Why this matters: cloud keyboards have leaked before
Keyboards that send text to a server can only be as safe as that connection. In 2023 the Citizen Lab found that Sogou Input Method, a Chinese keyboard used by hundreds of millions of people, encrypted keystrokes so weakly that someone watching the network could read what was typed; Tencent fixed it in July 2023. In 2024 the same team tested cloud-based pinyin keyboards from nine vendors and found that eight of them had flaws that could expose keystrokes to eavesdroppers.
A keyboard with no network access doesn’t have this class of problem, because there is no transmission to get wrong.
How Flikzi compares
Most popular keyboards use the network for good reasons: voice input, translation, GIF search, backup and model updates. If you rely on those, a connected keyboard will suit you better. If you want the keyboard itself to be unable to send anything, you have a few options. Flikzi is one; open-source keyboards such as FUTO Keyboard, HeliBoard and FlorisBoard are others.