Privacy Policy — Ownword

Last updated: 8 September 2026

Ownword is a voice-first keyboard for Android. This policy describes exactly what the app does with your data. It is written from the source code rather than from intent, and the claims in it are checked automatically on every build by audit_privacy.py, which fails if the code stops matching.

The short version

• What you type stays on your phone unless you press a button that sends it, and there are four, each described below. There is no keystroke log, and nothing is sent in the background.
• Audio you dictate is worked out on the phone by a speech model you downloaded, and never leaves it. There is no server route for dictation: nothing you say can be sent, by any setting.
• There are no third-party services in this app. No advertising, no analytics brokers, no crash reporters, no SDKs of any kind.
• Nothing is sold, shared, or used to train anyone's model.
• Password fields are excluded from every feature that stores or sends anything.

What leaves your device

The app contacts exactly one server: the Exchange your account is on, which is where the speech model comes from, where your uploads go, and where the language models you ask answer from. Every request is sent over HTTPS, and every one is authenticated with your API key except the two that ask for a key in the first place - a phone that has not been given one has none to send.

Everything above is started by you, except usage reporting. Audio you record is not on this list. It is worked out on the phone by the model you chose, and the route that once sent it to a server was closed in 1.0.362.

A request for a key carries five things and no more: the email address you typed, the name you typed, the one line you typed, the app's version, and a random id for this installation. The address is the only personal detail the app ever sends, it is sent only on that one screen and only when you press Send, and it is used to set your account up and to reach you about it. The install id is made by the app, is not the Android id, and says nothing about the phone; it exists so that asking twice replaces your request instead of queueing behind it. The app says all of this above the button, before you send anything.

About text you type

Nothing you type is sent anywhere in the background, and there is no keystroke log. Four buttons send text, each only when you press it, and each is described exactly below.

Reporting a word that was not fixed

When the keyboard fails to fix a word — you meant and if and a stray key gave you andnif — you can hold that word and choose Report a missed fix. That sends that one word, so the fix can be worked out. Nothing else goes with it, nothing is recorded by typing, it does not work in password fields, and it does nothing at all if diagnostics are switched off. The button says where the word goes before you press it.

An earlier version had one - an AI Text Fix key that sent the field to the server to be rewritten. It was off by default and it has now been removed outright, so the question no longer needs an answer that begins "only if".

Summarising a page

If you copy a page and choose Summarise, what you copied is sent to your own account's language models to be summarised. Only what is on the clipboard at that moment goes, and only because you chose it. The screen says so before the request is made.

The speaker key can do the same when you switch it to Summarise - from its hold, or in Settings → Read aloud. A tap then sends the text you selected, or what you copied, or the text in the field you are typing in, in that order, to your own account's language models; the summary comes back to a screen that shows it and sends it to your own voice server to be read aloud. Its hold names each choice with its first words before anything is sent. It refuses password fields before anything is sent, and nothing about it is automatic.

Refining what you dictated

If you describe a project and tap the refine key, two things are sent to your own account's language models: the last thing you dictated, and the description you wrote for that project. They come back as one reworded version, which replaces what was on the screen.

• It happens only when you tap that key. Nothing about it is automatic, and nothing on the typing path can reach the models.
• It refuses password fields, before anything is sent.
• The projects you describe are stored encrypted on your phone. They leave only as part of a request you make, and only to your own account's server.
• Every refine is kept on the phone - what you dictated, what came back, and which project it used - so you can see exactly what was changed. It is never uploaded, it is listed under Your data with a count, and you can clear it.
• Neither the text nor the reply is written to the diagnostics log, counted in usage reporting, or recorded in any other way. The only record is the one on your phone that you can read and delete.

Asking a question

If you hold the refine key, choose Ask a question and speak, the transcription of that question is sent to your own account's language models to be answered. It is a question you chose to ask, and nothing else goes with it - not the field you were typing in, not your project descriptions.

• It happens only when you choose it and then speak. It arms one dictation and reverts, so it cannot go on diverting what you say.
• It refuses password fields before arming.

Text you select in another app

Select text in any app and its menu offers Ask Ownword; the share sheet offers it too. Only when you tap it, the text you selected goes to your own account's language models, and their answer is kept in your AI history on the phone. Nothing else on the page or the screen is read: Android hands the keyboard the selection and nothing more, and the keyboard asks for nothing more.

Share a page from your browser to Ask Ownword and the keyboard fetches that page itself - the one you shared, once, from its own site, over https - and sends its readable words to your own account's language models to be summarised. This is the only time the keyboard reaches any site other than your own server, and it happens only on that tap. The page's words are kept in your AI history on the phone, under the page's title and address, so the chat can be reopened; the page itself is not kept, and nothing is sent to the page's site but the request for it. A web address you type or paste into a chat is fetched the same way, up to two in one message, only when you send that message. And when you tap Summarise this page and the page on screen shows too few words to summarise, the page's address is fetched the same way, once, on that tap.

• The question and its answer are kept on your phone in the same history the refines are - encrypted, never uploaded, listed under Your data, and clearable.

The keyboard does keep one draft on the device: if you are part-way through writing something and the keyboard closes, the text is held so it can be put back when you return - on its own if you come straight back, otherwise offered with one tap. It is stored encrypted, only ever on your phone, only for an hour, never from a password field, and it is deleted the moment it is restored or you send or clear the message.

About usage reporting

If left enabled, the app periodically sends a summary of how it was used. That summary contains counts, durations and error codes only:

• how many characters were typed or dictated, and over how long
• how many corrections were applied, and how many you undid
• how often suggestions appeared, and how often you took one
• how long transcriptions took, and why any failed
• which keyboard layout was in use

It contains no text of any kind — not words, not transcripts, not even the lengths of individual words. Nothing in it names you, your device, or which apps you were typing in. It carries a random identifier created when the app is first run, which is gone when the app is removed — so it cannot be tied to you, and it cannot even be tied to an earlier install of the app on the same phone.

One thing worth stating exactly. The upload is authenticated with your API key, the same as everything else the app sends, and it arrives in your own storage. So the server can tell which account it came from, in the same way it can for a file you upload deliberately. Nothing inside the summary says who you are, and nothing joins the two — but we would rather write that down than let "it does not identify you" carry more weight than it can bear.

What it is used for is counting: how many installs are active, which version they are on, and whether a feature is being used at all. Never who.

You can turn it off in Settings at any time — it is on the Your data tab, beside the list of what the keyboard stores.

What stays on your device

Stored in the app's private storage, which other apps cannot read:

• your API key — encrypted with AES-256-GCM under a key held in the Android Keystore
• your recent sent messages — encrypted the same way
• anything you recently copied, so the paste key can offer it back — encrypted the same way, at most 25 clips, and each one expires after a day. Nothing is recorded while a password field is open. You can switch this off entirely in Settings
• one unfinished message, kept if the keyboard closes on a half-written one so it can be offered back — encrypted the same way, and discarded once it is restored, sent, or an hour has passed
• recent recordings — the newest 25 keep their audio and 200 their text, or as many as you set under Your data
• words and phrases the keyboard has learned from you, and the list of words you have removed from it
• the words you have written, with how often and when you first and last used each one — encrypted the same way. Words you dictate count here too, because speaking is writing, and they are marked as spoken so the app can show you which words you only ever say. A transcript itself is never kept: it is split into words, counted, and dropped, exactly as a typed word is. This is the one store that holds your actual words, and it exists so the app can show you your own language: your vocabulary, your commonest words, the phrases you use. It never leaves this phone. It is not uploaded, not included in usage reporting, and not counted there either. Nothing is recorded while a password field is open, and you can read all of it or delete all of it from Settings
• the projects you have described — what each project is, in your own words, so a dictation can be reworded to match it. Encrypted the same way. These leave the phone only as part of a refine you ask for, and only to your own account's server
• every refine you have done — what you dictated, what came back, and which project it used. Encrypted the same way, and never uploaded. It is kept because a refine replaces what was on the screen, so without it there would be no copy of what you originally said and no way to see what was changed. Read it or delete it from Settings
• your typing statistics — counts and durations only
• how long each punctuation mark takes you to reach — and one number for letters as a whole, never for individual letters. It is what decides where keys are put, so it is on your figures screen rather than only in a report we read. Counts and timings, never text
• where your taps land on each letter key — an average and a spread per key, so a key you always hit low can have its target moved to meet you. Per key, never tap by tap, never in a password field, and never uploaded. It is on your figures screen, and under Your data with its own Clear
• recent readings — the sound of the last 10 things read aloud, and the first words of each as its title, so one can play again without the network - and the sound of every summary read aloud, for as long as that summary is kept. Encrypted with AES-256-GCM, listed under Your data with a Clear
• what you send to your phone from your own portal — files you tick To phone on your portal's Exchange are saved in your phone's Downloads/Ownword folder, and text you send to the phone's clipboard is put there; the app collects only your own account's, with your key. They are yours like any download: the app keeps no copy of its own
• your to-do list — each dictation you added to it, the short things to do your models made of it, and when you ticked each one. Encrypted the same way, up to 500, and never uploaded; only what you said is sent to your models, when you add it. Tick, copy or delete them on the list, or clear it from Your data
• every summary you asked for — what it said, what it was of, where that came from (the web page's site and address, or what you copied), the text it was made from (so you can go deeper later), and when. Encrypted the same way, the newest 200, and never uploaded. Read them, play the read-aloud ones again, or delete them from Your summaries or Your data
• the voice list for read aloud — the names, languages and descriptions of the voices your server offers, kept so the list opens without asking again. Nothing of you is in it
• voices you picked — how many times you picked each voice on the echo key's list, so the ones you pick most come first. A name and a number per voice, nothing you said. Listed under Your data with a Clear
• speech models you chose to download — public files, the same for everybody, that let the keyboard work out your words on the phone itself so a recording never leaves it. Nothing of you is in them. They are listed under Your data with their size and a Remove
• your daily record — one row a day: what you typed, how long for, how much you dictated. Counts and durations only, never text. It is kept for as long as you want it, so that anniversaries and long trends are possible, and you can clear it whenever you like
• a diagnostics log — timings, counts and error codes describing how the keyboard performed. Never what you typed. On the owner's own test accounts, with Test logs turned on, it also notes how a page or chat that was read was laid out on screen - where each piece of text sat and how long it was - never the words
• copies of files you attach, kept only long enough to hand them to the app you are typing into

Automatic backup is switched off. Android would otherwise copy app data to your Google Drive; this app opts out of both cloud backup and phone-to-phone transfer, so none of the above leaves your device that way.

Uninstalling the app deletes all of it.

What is never collected

• No keystroke log. The app does not record what you type.
• No touch coordinates.
• No contacts, location, phone number, or device identifiers.
• No advertising ID.
• No record of which apps you use. The app can tell whether a field expects an email address or a password — which is how it protects passwords — but it does not record which app the field belongs to.

Permissions

There is no storage permission. Files you attach are chosen through Android's own picker, which grants access to that one file.

Your data on the server

Files you upload, and what you ask the language models, go to the account you hold with your provider. Audio you dictate does not: it is worked out on the phone. Retention, deletion and access on the server are governed by that account, not by this app, and are configurable there.

This app does not have a separate account of its own, and does not create one.

Children

Ownword is not directed at children and is not designed for use by anyone under 13.

Changes

Material changes to this policy will be published here with an updated date above, and noted in the app's release notes.

Contact

Questions about this policy or your data: me@rnsu.net