Lexo
← All writing

How to check what your Android keyboard sends, and what the checks can't prove

Last updated:

A keyboard sees everything you type, so "we respect your privacy" is not an answer. Here are five checks you can run on any Android keyboard in an afternoon, easiest first, and what each one can and can't prove. The only guarantee is a keyboard that doesn't hold the INTERNET permission at all. Lexo isn't one of those, and the last section says so.

I make Lexo, so I ran the checks on it too and report the result as it came out. Thirty days free with everything unlocked, then $9.99 once. Get it on Google Play

Menu paths and behavior come from Google's, Android's and the tools' own documentation (linked), read on 2026-10-04. Device results are from my Pixel 9 Pro XL on Android 17, using read-only adb commands. Menus differ by Android version and phone maker.

1. Read Play's Data safety section, then discount it

  1. Open the app's Play Store page.
  2. Under Data safety, read the summary, then tap See details.

Google's help page explains that developers use this section to describe what their app collects and shares. Treat it as the developer's claim, not a finding. Google's developer policy page is blunt that its review process is "not designed to verify the accuracy and completeness" of the declarations. The user-facing page also says developers needn't declare data as collected in some cases where it leaves the device, such as when it's only processed ephemerally or sent end-to-end encrypted. So "no data collected" doesn't mean "nothing was sent." Test it with the checks below.

2. Check for the INTERNET permission

This is the strongest check, because Android's documentation defines INTERNET as "Allows applications to open network sockets". A keyboard without it can't open its own connections. The catch is that INTERNET is an install-time permission, and per Android's permissions guide the system grants those automatically at install, so you never see a prompt. You need a different way to look.

  1. On the phone, turn on Developer options and USB debugging, and connect it to a computer with adb installed.
  2. Find the package name with adb shell pm list packages. Gboard is com.google.android.inputmethod.latin and SwiftKey is com.touchtype.swiftkey.
  3. Dump its permissions: adb shell dumpsys package PACKAGE | grep -E "permission|versionName". Look under "requested permissions" and "install permissions" for android.permission.INTERNET.

On my phone on 2026-10-04: Gboard 18.4.1, Microsoft SwiftKey 9.13.16.5 and Lexo 2.0.37 all list INTERNET as granted. Holding the permission tells you a keyboard can reach the network, not that it does anything bad with it. The useful signal runs the other way: a keyboard without it can't open its own connections.

Don't be thrown by extra lines: the installed list can include entries the app's own manifest doesn't declare. On Lexo I saw the Play billing and licensing permissions and an ACCESS_LOCAL_NETWORK entry. Android's local network documentation says apps targeting below Android 17 that hold INTERNET get an implicit grant for it.

No computer? Exodus Privacy reports list the permissions and trackers it finds in an app. It's a scan of one build, so check the version.

3. Look at Android's per-app data usage

  1. On a Pixel, open Settings > Network & internet > SIMs > App data usage, as Google describes it. Other makers move this screen.
  2. Note the keyboard's figure for the period shown.
  3. Use the keyboard heavily for a day on mobile data, then compare.

Google's page is about mobile data, so Wi-Fi use may not show up there. For a keyboard that claims to work locally, a typing-heavy day should leave the number near zero, apart from a download or billing check you can account for.

4. The airplane-mode test

  1. Turn on airplane mode and confirm the Wi-Fi and mobile icons are off.
  2. Type for a few minutes in a notes app. Use suggestions, glide typing and dictation if it has them.
  3. Whatever still works was running on the phone. Whatever fails needed a server.

This shows what a keyboard needs. It does not show what it sends once you reconnect, because a keyboard could queue things for later. Pair it with the next check.

5. Watch the traffic with a local VPN app

PCAPdroid is open source and captures other apps' traffic without root. Its README says it simulates a VPN to do this and processes the data locally, with no remote VPN server. NetGuard is a no-root firewall that allows or denies each app's network access, and per its README traffic logging is a paid feature.

  1. Install PCAPdroid from F-Droid or Play, tap the play button and accept the VPN dialog. Turn off any real VPN first, because PCAPdroid's README lists capturing while other VPN apps run as a rooted-device feature.
  2. Set the app filter to your keyboard so the capture is only its traffic.
  3. Type several paragraphs and dictate a few sentences, then wait a minute.
  4. Open the Connections tab. Each row is a connection with the host name, volume and status. A keyboard that sends what you type would show traffic that grows with how much you typed.
  5. Repeat later in the day and after a reboot. Batched uploads and daily check-ins fire on timers, not keystrokes.

Most traffic is encrypted, so you're judging hosts, timing and volume, not reading messages.

What none of this proves

The right pick if you want the guarantee

HeliBoard's README says it does not use the internet permission and calls it "100% offline," and the manifest on its main branch agrees: when I read it on 2026-10-04 it requested user-dictionary read and write, contacts, vibrate and boot-completed, and no INTERNET. If you want that guarantee rather than a test result, use HeliBoard. Six keyboards compared and HeliBoard versus Lexo cover the tradeoffs.

Running the checks on Lexo

Lexo (com.lexo.keyboard) doesn't pass check 2. Its own manifest declares five permissions: VIBRATE, RECORD_AUDIO, POST_NOTIFICATIONS, INTERNET and ACCESS_NETWORK_STATE. INTERNET is there for the one-time model download, Google Play billing, opt-in crash reports, an optional usage tally that is off unless you turn it on, and one anonymous request after install carrying only the Play install source tags and the app version. My claim is narrower than "offline": nothing you type or say leaves the phone, and once setup is done, typing and dictating generate no network traffic. Checks 3 to 5 test that on your own phone, and the safety page says what a capture should look like. Lexo is closed source, which is a real limit. It's also paid: 30 days with everything on, then $9.99 once, and after the trial it has no suggestion strip, autocorrect, glide typing or dictation without the unlock.

Questions

Does a keyboard without the INTERNET permission leak nothing?

It can't open its own network connections, since Android defines INTERNET as the permission that lets applications open network sockets. That makes it the one check the operating system enforces. It says nothing about what the keyboard stores on the phone.

Is Play's "No data collected" label proof?

No. Google says its review is not designed to verify the accuracy and completeness of developers' declarations, and the rules let some data that leaves the device go undeclared, such as data processed only ephemerally.

Can I check a keyboard without a computer?

Mostly. Data usage, airplane mode and PCAPdroid all run on the phone, and Exodus Privacy reports open in a browser. Only reading the permission list directly needs adb.

Does Lexo hold the INTERNET permission?

Yes. It uses it for the model download, Google Play billing, opt-in crash reports, an optional usage tally and one anonymous post-install request. If you want a keyboard that has no INTERNET permission, HeliBoard is the pick.

Lexo is the keyboard this section is about. Thirty days free, then $9.99 once, no subscription and no ads. Get it on Google Play

More: all the writeups, what each keyboard says it collects, offline dictation options, and fixing voice typing without internet.