Every keyboard triggers the same stern dialogue
Enable any keyboard and Android says something to the effect that it may be able to collect everything you type, including passwords and card numbers.
That warning appears for every keyboard, including the one your phone shipped with. It is not an accusation about the app you are installing, but a description of what the input method mechanism makes possible. Android shows it because the system cannot know what any particular keyboard does with the capability.
So the question is not whether the app in front of you is dangerous. It is what that app would be able to do, and what it does.
Settings, then a day in airplane mode
Two checks answer that, and neither of them involves reading a policy document.
Open Android's settings, go to the list of installed applications, find the keyboard and read the permissions it has been granted. Then look further down the same screen for internet access, which is listed among the app's details rather than presented as a prompt you ever agreed to. A keyboard with no network permission is making a promise it has no mechanism to break.
Then use it for a day with mobile data and Wi-Fi both switched off. Type, correct a word, search for an emoji, change language, dictate if it dictates. Anything that stops working needed a connection. Anything that carries on never did.
The second check catches what the first cannot. A keyboard can hold the internet permission for a feature you never touch, and it can hold it for something that runs whenever you type, and the permission list looks identical in both cases.
Selecting a keyboard is the permission
There is no dialogue for the central capability, because the capability is the job.
When a keyboard is active, the system routes text input through it. It receives your keystrokes, and it can read text around the cursor in the field you are editing, which is how autocorrect knows what you were writing and how next-word suggestions work at all.
It also gets told what kind of field you are in. Knowing that, a keyboard can show a number pad for a phone number, an email layout for an address, and it behaves differently in a password field.
None of that arrives through a permission prompt. There is no separate "read your typing" permission, because reading your typing is the entire function, and Android hands it over the moment you pick the keyboard.
The reverse is also true, because the warning invites people to imagine more than the mechanism allows.
It does not see the screen. An input method receives text input and the field it is editing, not a picture of what you are looking at.
It does not run when it is not open. When no text field is active, the keyboard is not receiving anything.
Other apps' data, your photos, your messages and your files stay out of reach, unless the keyboard separately requested and received a permission for them.
And it cannot quietly move itself into the role. Android asks for two deliberate steps, enabling the keyboard in the system settings and then selecting it as the active one, and both of those are yours to take.
Reading the permission list line by line
Separate from the input method mechanism, a keyboard app requests ordinary Android permissions, and these are the ones to look at closely.
Internet. Not shown as a prompt, but visible in the app's details. This is the one that matters most, because a keyboard with no network access cannot transmit anything regardless of what it can see. Legitimate reasons exist: downloading dictionaries or speech models, translation features, syncing your learned words. Each is a convenience with a cost.
Microphone. Requested the first time you use voice input. Straightforward: dictation needs it, typing does not, and denying it leaves an otherwise working keyboard.
Storage. Usually for the keyboard's own files, not for your documents. Modern Android scopes this tightly.
Contacts. Some keyboards offer to learn names from your address book so it stops correcting them. Genuinely useful and genuinely a large amount of personal data, so it deserves a deliberate decision. Do not tap yes out of reflex.
Vibration and notifications. Cosmetic. Not worth thinking about.
Notice which of those produced a question and which did not. Microphone, contacts and location put a dialogue in front of you. Internet never does, so it is the one you have to go and look for.
Play Store, sideload, source code
Where the app came from matters as much as what it asks for.
An app from the Play Store has been through Google's review, which is a meaningful filter and not a guarantee. An app from an alternative store or a direct download has not, and Android will warn you about installing from unknown sources, which is a reasonable warning to take seriously for a keyboard in particular.
Neither route changes what the app can technically do once it is your active keyboard. The permission model is identical. What differs is who checked it first and how updates arrive.
For open-source keyboards the calculation is different again, because the code itself can be read, and that is a stronger form of verification than either store provides. Open code makes a genuine argument for them, and the answer to "which keyboard is safest" therefore depends on whether you personally are going to read anything.
LocalType comes through Google Play and runs on Android 8.0 and newer. Its source is not published, so it sits in the first of those three descriptions and not the last one.
Three items, and the reason for each
Microphone, requested the first time you use the key, and used only while you are dictating. Without it the keyboard still types normally.
Internet, for exactly one purpose: fetching the speech model you picked. That model is the part that turns your voice into text, it is between 60 and 539 MB depending on which size you choose, and it is too large to ship inside the app. After it is on the phone, no part of the product asks for the network again. You can confirm that by dictating in airplane mode, and we would rather you did than took our word for it.
Local storage, for the model itself, your settings and the words you add yourself.
Nothing else is on the list. There is no contacts permission, so your address book is not read. There is no account, so nothing is tied to an identity. There is no advertising in the product and no behavioural tracking inside it, so nothing is being collected to send even if there were somewhere to send it.
The model file sits in storage no other app can open, no archive of your recordings is kept, and the app's data is deliberately excluded from Android's cloud backup. In password fields the microphone key does not appear at all, and the keyboard does not learn from what you type there.
We do read the words around your cursor
LocalType reads the words around your cursor. It has to, because that is how autocorrect and next-word suggestions function, and any keyboard claiming otherwise is either not doing those things or not telling you the truth.
What it does with them is keep them on the device. Words you add yourself stay there and are handed to the speech model as context, so the surnames and product names you use come out spelled the way you spell them.
Nothing is uploaded, because there is no service on the other end to upload it to. That is a narrower claim than "we cannot see your typing", and it is the one that still holds with the network switched off.