Privacy is structural.
Not a promise in small type.

WHAT IS PROCESSED

The selected text, or the paragraph around your cursor.

An explicit selection is rewritten exactly when it fits the 2,000-character model budget. Without a selection, SottoKey captures the current paragraph. Longer paragraphs use a visible sentence-boundary window around the cursor; the remaining sentences stay untouched.

The model processes that text in memory. SottoKey checks the result, marks the changes, and waits for you to choose Keep original or Accept edit.

For automatic next-word suggestions, SottoKey reads at most the last 1,024 characters before the cursor plus the current composing prefix. That bounded context is processed only by the selected on-device English or Spanish prediction model and is not persisted, added to training data, or supplied to Google Play Billing.

WHAT MAY BE STORED LOCALLY

Only the pieces that make a keyboard yours.

• Theme, size, language, and behavior preferences.
• Encrypted personal dictionary words and learned word pairs.
• Per-key touch offset averages, without text.
• Latency, backend, model version, and outcome codes—never text.
• Encrypted clipboard snippets and email addresses you explicitly save.
• Encrypted email templates you explicitly create or save.
• Verified Play product IDs and the last ownership-query time in a tamper-evident local Billing cache.

Temporary clipboard history stays in memory, is capped, expires, skips sensitive clips, and can be disabled.

Google Play handles purchase and product data through the Play Store service. SottoKey supplies no typed content to Billing.

IMPORTANT LIMIT

The host app must identify a sensitive field.

SottoKey disables intelligence when Android identifies a password-class field. If another app fails to mark a payment or sensitive field correctly, no keyboard can reliably infer that missing classification. Incognito mode remains available as an explicit local override.

WEBSITE DATA

This website does not receive your keyboard text.

The guided demo is deterministic and does not accept arbitrary input. The launch website uses no advertising cookies, session replay, fingerprinting, or third-party font/script CDN. Standard infrastructure logs may temporarily contain request metadata such as time, path, and network address for security and operation.

If a beta or support contact method is added, its form will disclose the exact information and processor before submission.

DELETE YOUR DATA

Clear it locally, or uninstall completely.

Settings provides controls for learned words, temporary clipboard history, saved snippets, saved email addresses, email templates, and adaptive touch learning. Uninstalling SottoKey removes its app-private data because no account exists elsewhere.

Screen capture follows Android defaults. Screenshots are allowed for reporting visual issues, so avoid capturing private text you do not intend to retain or share.