Separate two questions first
Most confusion here comes from treating one question as two, or two as one.
Where is my voice processed? Either the audio is sent to a server and text comes back, or a model on your phone does the work and nothing is transmitted.
What does the keyboard do with my text? Every keyboard sees what you type, because that is what an input method is. The question is whether any of it leaves the device and whether it is stored somewhere.
An app can be careful about one and careless about the other. Judge it by the marketing language and you will be surprised; judge it by these two questions and you will not.
Two architectures, two different answers
These are two ways of putting the software together, not two levels of good faith.
If recognition happens on a server, your audio must travel there. That means it exists, briefly at least, on hardware belonging to someone else, and what happens to it afterwards is governed by that company's policies. None of that is visible from your phone. For most people, most of the time, this is fine, and the companies involved are subject to real legal obligations. It is also the only way to get the very largest models, which handle difficult audio better than anything that fits on a handset.
If the model is a file on your phone, there is no transmission to reason about. No upload, no server-side copy, no retention period, no jurisdiction question. Guarantees of that kind are stronger than a policy, because they come from how the software works rather than from a promise about how a company behaves. Policies change. An app with no network path cannot start sending your audio without shipping a new version that asks for the permission, and that is visible in the store listing.
The reason any of it matters is that some sentences are not like others. A password hint spoken aloud. A colleague's medical situation. A client's commercial terms. Anything covered by an agreement you signed. Those are the cases where "it is transmitted, then handled according to a policy" is a different answer from "it is not transmitted".
Four things local processing does not fix
Local processing settles one question and leaves four others exactly as they were.
The app you are typing into. Once the words appear in a message, a note or a form, they belong to that app. A keyboard's involvement ends at the moment the text lands, exactly as if you had typed it. If the messaging app you use keeps everything on a server, dictation locally does not change that.
Anyone within earshot. Speaking a private message aloud in a shared office is a bigger exposure than any software question, and no app can fix it.
Your device being compromised. If something malicious is already running with high privileges, the keyboard is not the weak point.
The recording being useful evidence of what you wrote. Local dictation means your voice was not transmitted. It does not mean the resulting message is private from its recipient.
Anyone selling voice typing as a security product rather than a privacy property is overstating it, and that includes us.
Dictation is not an always-listening assistant
A lot of the worry attached to this question belongs to a different product, and separating them makes the answer much less alarming.
An assistant listens continuously for a wake word. Doing so is its job, and it is why the microphone indicator is a live question with those.
Dictation does not work that way. The microphone opens when you press the key and closes when you stop; a key exists for exactly that reason. Between those two moments nothing is listening, and on Android the system shows an indicator whenever any app has the microphone open, so you can see it for yourself and take nobody's word for it.
That distinction also explains why dictation can run locally while assistants mostly cannot. Writing down a sentence you deliberately spoke is a bounded task on input you chose to give. Answering an arbitrary question requires knowledge of the world, which is not something a phone can hold.
Password fields
Android tells a keyboard when a field holds a password, and a careful keyboard changes behaviour there.
LocalType disables voice input in password fields entirely, so a password cannot be dictated by accident. Dictating becomes habitual once you are used to it, and login screens sit next to everything else on a phone, in the same apps, reached by the same taps.
Check that any keyboard you install does the same, whichever one you choose. The check is quick: open a login screen and look at whether the microphone key is still on the keyboard.
When it is your employer asking
If you dictate work correspondence, this is the version of the question that turns up in practice.
The concern is rarely about a company misbehaving. It is about data leaving a controlled environment at all, because a policy or a contract says it should not. Client material, patient details, anything under a confidentiality agreement.
Server-side dictation means the audio crosses to a third party, which is a question their compliance people have to answer even if the answer turns out to be fine. On-device dictation does not raise the question, because nothing was transmitted and there is no processor to name.
Airplane mode, and what LocalType does with it
Voice typing is as secure as its architecture. If the audio is transmitted, you are trusting a company and a policy. If it is not transmitted, there is nothing to trust, because there is nothing in transit. Neither is wrong, but you should know which one you are using, and the demonstration is short: switch the network off, dictate a sentence, and see whether words appear.
That is also the whole answer to give a compliance officer who asks you to demonstrate it, and it beats reading a policy or comparing marketing claims.
In LocalType the recognition is a model file in storage only the app can read, and it runs on the handset. There is no cloud path in the app at all, so there is no mode to verify before saying something sensitive. No account exists anywhere, so nothing ties the keyboard to a person. There is no advertising in the product, and no behavioural tracking inside it. No archive of your recordings is kept, because the audio becomes text and is finished with. The app's data is deliberately excluded from Android's cloud backup, with the consequence that a new phone starts empty. Words you add to the dictionary stay on that device. Internet access is requested once, to fetch the speech model you choose, and never again.
And the limit from earlier still applies in full: once your words are in the app you were writing in, they follow that app's rules, not ours.