TECHNICAL PROOF

Read the claim.
Then inspect the build.

The strongest privacy claim is not a sentence on this site. It is the missing Android permission in the release package, combined with a local runtime and a model that never needs a network path.

INTERNET permission absent from release

PROOF 01 / ANDROID PERMISSIONS

The keyboard cannot open an internet socket.

Android applications must request the INTERNET permission before opening network connections. SottoKey's release manifest does not request it.

REPRODUCEaapt dump permissions SottoKey-release.apk

package: com.sottokey.keyboard

release manifest:
  requested app permissions: none

service protection:
  android.permission.BIND_INPUT_METHOD

network check:
  android.permission.INTERNET — ABSENT

PROOF 02 / REQUEST PATH

Every rewrite stays inside the app process.

The keyboard captures your exact selection or a bounded paragraph window, asks the local model, validates the response, renders a diff, and waits for a human action.

InputConnection

Exact selection or paragraph window

Protected spans

URLs, numbers, email, negation checks

Local model

llama.cpp CPU runtime + verified GGUF

Validator

Reject unsafe or malformed changes

Visible diff

Insertions and deletions, no silent replace

Your decision

Keep original or Accept edit

PROOF 03 / CURRENT EVIDENCE

A versioned model, package, and measurement.

The app UI, installed model, and next model are tracked separately. Metrics remain attached to the exact package and device that produced them.

APP UIv0.4.0Current device build · captured 18 July 2026

INSTALLED MODELLFM2.5 · 350M · v3 final · Q8_0379 MB · 6 of 8 hard gates passed

P50 TOTAL490 msRedmi K20 Pro · Snapdragon 855

TTFT207 ms14 July 2026

PROOF 04 / QUALITY BOUNDARIES

The diff exists because small models drift.

The installed v3 model passed six of eight hard release gates and shipped under a documented exception. So every edit shows its work and waits for you—that is not a disclaimer, it is the interface.

Checks around the model

URLs and protected spans are checked.
Number and negation changes are validated.
Invalid output keeps the original.
The user accepts every edit.
Undo is armed immediately after acceptance.

Limits still under review

Meaning corruption missed the installed model's gate.
Spanish identity behavior also missed its release gate.
Mixed-language Professional rewriting is a known weak area.
Short ambiguous sentences are difficult for a 350M model.
Battery-per-rewrite and sustained thermal tests remain open.
The replacement model is still in evaluation.

Follow current limitations and fixes

KEEP THE CLOUD OUT OF THE CONVERSATION

Your keyboard sees enough.
It doesn't need a network.

Write, revise, and decide on your phone.

See SottoKey work Google Play status

Read the claim.Then inspect the build.