Why a keyboard is the most sensitive app on your phone
A keyboard sees everything you type: messages, searches, addresses, and in some fields your passwords and card numbers. That’s why Android shows the same warning for every keyboard you turn on:
“This input method may be able to collect all the text you type, including personal data like passwords and credit card numbers.”
The warning is accurate, but it doesn’t tell you the part that matters: whether the keyboard can send that text anywhere. Researchers at the Citizen Lab have called it overbroad for exactly this reason, because it treats a keyboard that sends nothing the same as one that uploads every keystroke.
The promise: your typing stays on your phone
Everything Flikzi does with your text happens on the phone. It doesn’t send what you type to us or to anyone else, not to improve suggestions, not for analytics, not ever. That is the promise, and it doesn’t depend on whether the app happens to be online.
That design has consequences, and we chose all of them on purpose:
- Autocorrect and suggestions run on the phone. The word lists of all the languages, the pinyin engine and the Japanese dictionary ship inside the app.
- No account and no sync. There is nothing to sign in to, and nothing is backed up to a server.
- No analytics and no ads. Flikzi doesn’t report how you use it, and it’s paid for instead of funded by ads.
- Voice typing stays on the phone. Flikzi uses the speech recognition that Android runs on the device (Android 12 and later), so your voice is turned into text there. On a phone that can’t do that, the mic can open the phone’s own voice keyboard, such as Google voice typing. That keyboard is not Flikzi and its maker may receive the sound, so Flikzi asks before it opens it for the first time. If the phone has neither, the mic tells you so.
- No translation, GIF search or cloud backup. Those need a server, so Flikzi doesn’t have them.
What does Flikzi remember? Your settings, the words it learns from your typing so that your own words and names come first, which word you type after which, the email addresses you type, where on each key your taps tend to land (a few numbers per key, no text), the pinyin readings you pick, your recent emoji and the skin tones you picked. With Flikzi Pro it also keeps a clipboard history and your text shortcuts. All of it is stored in the app’s private storage on your phone, never sent to us, and removed when you uninstall the app. Nothing is learned in password fields, or where an app asks keyboards not to learn (incognito tabs); in email fields only whole addresses are learned; and Forget learned words in settings clears what it learned.
One honest footnote: the Contact button inside the app opens your own email app. Anything you send that way is an email you write and send yourself. And like every app, if you’ve allowed usage and diagnostics on your phone, Android and Google Play may tell us that the app crashed; those reports come from Android itself and describe the crash, not your text.
No internet permission
Android apps must declare the permissions they need. Network access is the android.permission.INTERNET
permission; an app that doesn’t declare it cannot open network connections. Flikzi doesn’t declare it, so you don’t
have to take our word for any of this. On your phone:
- Open Settings and tap Apps.
- Find and tap Flikzi, then tap Permissions.
- Tap ⋮ at the top, then All permissions.
- Android lists Contacts, Microphone and Google Play billing service. An app that can go online also shows “have full network access” here. Flikzi doesn’t.
Before you install, you can also check on Google Play: open the listing, tap About this app, and scroll to App permissions. The same three are listed, and network access is not among them. The exact menu names vary a little between phone makers.
Two optional permissions, both off until you want them
Flikzi asks for two permissions, and only when you turn on the feature that needs one. Neither can send anything anywhere, because Flikzi has no network access to send it with.
- Microphone, for voice typing. Android asks the first time you tap the mic. Your voice is turned into text by the speech recogniser on your phone, and Flikzi gets only the text.
- Contacts, for the setting Contacts’ email addresses, which is off until you turn it on. Flikzi then reads your contacts’ names and email addresses on the phone, to offer an address while you type one. It doesn’t store them.
Say no to either and everything else works as before. The third entry, Google Play billing service, lets the Play Store app handle buying Flikzi Pro; Flikzi itself never goes online.
“No internet” is how Flikzi keeps the promise today, not the promise itself. A later version may use the network for something that has nothing to do with your typing. If that happens, what you type still stays on your phone, the permission will show on this same screen, and the privacy policy will say exactly what is sent before that version ships.
Why this matters: cloud keyboards have leaked before
Keyboards that send text to a server can only be as safe as that connection. In 2023 the Citizen Lab found that Sogou Input Method, a Chinese keyboard used by hundreds of millions of people, encrypted keystrokes so weakly that someone watching the network could read what was typed; Tencent fixed it in July 2023. In 2024 the same team tested cloud-based pinyin keyboards from nine vendors and found that eight of them had flaws that could expose keystrokes to eavesdroppers.
A keyboard that never sends your typing doesn’t have this class of problem, because there is no transmission to get wrong.
How Flikzi compares
Most popular keyboards use the network for good reasons: voice input, translation, GIF search, backup and model updates. If you rely on those, a connected keyboard will suit you better. If you want a keyboard that keeps your typing on your phone, you have a few options. Flikzi is one; open-source keyboards such as FUTO Keyboard, HeliBoard and FlorisBoard are others.