Styles make fights <| sep |> we ' ll save you ! <| sep |> The answer is , in theory , yes it is totally feasible to do it , IIRC when you add a new keyboard , it does warn you that you need to trust the keyboard application as you could be inputting confidental data with it , you are taking it on trust that it is taking your keystrokes and just passing them to the Android equivalent of a keyboard driver and not elsewhere as well . Again , in theory , however , the Android permissions should prevent this from occurring . In the particular case I linked , Swiftkey has a custom dictionary that can be synced to a cloud account so that you can have the same predictions across multiple devices . Somehow , in the back end , these sync messages were getting mixed up so that users were receiving saved words from others custom dictionaries . If you ' re that worried about it , don ' t input your plaintext i . e . your messages into any electronic device , encrypt them by hand and only enter ciphertext . Or you could write your own keyboard application . But then how do you know that the keyboard driver you are hooking into isn ' t itself compromised . So you could write your own driver , but how do you know that the hardware itself isn ' t compromised ? . It ' s turtles all the way down .