Is Lexo safe, and what does it collect?

Last updated: 2026-08-01

Short answer: it collects no text, no audio, no contacts and no advertising ID, and there are no ads and no analytics. The longer answer is the part that matters, because you shouldn't take a keyboard's word for this.

Lexo is the keyboard this page is about. Thirty days free, then $9.99 once. Get it on Google Play

Which Lexo this is

This page is about Lexo Keyboard, an Android keyboard published by K4Y Apps under the package name com.lexo.keyboard. A handful of unrelated companies and apps use the name Lexo, and some of what search engines return for "Lexo" has nothing to do with this app. The package name is the thing that identifies it: if the listing you're looking at isn't com.lexo.keyboard, it isn't this.

Why the question is a fair one

A keyboard sees every password you type, every message you write, and every search you run. It's the single most sensitive app on the phone, and "trust me" is not a good enough answer from any of them, including this one. So the useful version of this page isn't a promise. It's the list of things you can check.

The five permissions

Lexo declares exactly five, and Play shows you the same list before you install:

There's no READ_CONTACTS, which a lot of keyboards ask for to learn names. There's no location, no storage, and no advertising ID.

What the internet permission actually does

Three things:

1. The one-time model download. About 1.2 GB, over Wi-Fi, verified by md5. This is the only large transfer Lexo ever makes.
2. Google Play billing, for the paid unlock after the trial.
3. Crash reporting through Firebase Crashlytics, which is off unless you turn it on at Settings › Advanced › Other › Send crash reports. Reports carry stack traces, the device model and the app version. They never carry what you typed or what you said.

How to check it yourself

This is the part I'd actually do in your position, and it takes about ten minutes:

• Point a network monitor at it. PCAPdroid and NetGuard both work without root. Past the model download, typing and dictating generate no traffic at all. If you switch crash reporting on you'll see Crashlytics check in, and switching it back off stops that too. I'd rather tell you exactly what the capture looks like than promise silence and have you catch a heartbeat.
• Turn on airplane mode and keep typing. Suggestions and dictation both keep working once the models are downloaded, which is the practical proof that they're running locally.
• Read the permission list on the Play listing before you install, and compare it to the five above.

What I can't prove to you

Lexo is closed source, built on the open-source FlorisBoard project. That's a real objection and it's worth saying plainly: you're taking my word on the source code. You are not taking my word on the behaviour. A network capture doesn't care what I claim, and neither does airplane mode. If auditable source is your bar, the comparison writeup covers HeliBoard and AnySoftKeyboard honestly, and one of those is probably the better answer for you.

The models themselves are open weight: Qwen under Apache-2.0 for suggestions, NVIDIA Parakeet under CC-BY-4.0 for speech. The runtimes are llama.cpp and sherpa-onnx. There's nothing secret on the model side.

The short version

• No text or audio leaves the phone.
• No ads, no analytics, no advertising ID, no contacts access.
• Crash reporting is opt-in and off by default.
• Five permissions, and you can check every claim above with a free network monitor.

Thirty days free with everything unlocked, no card. Then $9.99 once, not a subscription. Get it on Google Play

Related: the privacy policy, the permissions breakdown on the home page, and Android keyboards compared, including where Lexo loses.