Building a keyboard with no server, and everything we lost

"No data collection" is usually written as a benefit. It is also a list of things you do not get to build. This is that list, from the inside, with what stood in for each.

Crash reporting

Gone. There is no crash reporter, because a crash reporter is a network client. When the keyboard falls over on somebody's phone, I do not find out unless they tell me, and a keyboard that has crashed is a hard thing to write an email from.

What replaced it: an unusual amount of testing before release, including a unit-test suite that runs the press-effect engine against a stubbed canvas so every style's maths is exercised without a device, and a last-background-error entry the settings page shows you, on the phone, so at least the person holding it can see what went wrong. The Play Console still reports crash rates that Android itself collects with the user's consent; that is Google's telemetry, not the app's, and it is the only aggregate signal I have.

Analytics

Gone, and this one I miss. I do not know which of the thirty-one themes is popular. I do not know whether anybody uses the Tesla press effect or whether the dark sound pack was worth the week. Every product decision is made on taste and on what people write in reviews and email.

What replaced it: the numbers the keyboard already counts for its own purposes, days used and words typed, which it keeps on the phone and shows you on the stats page. They never leave. They do decide one thing: when to ask for a Play rating, which is done only after the install is five days old, has seen five distinct days of typing and five hundred words, at most three times ever, to everybody who gets there, with no "are you enjoying it?" gate, because Google's review guidelines forbid the gate and because I think it is a cheap trick.

Remote configuration and A/B tests

Gone. Nothing in the keyboard can change without an update you install. There are no server-side flags, no staged rollouts of a feature inside a build, no experiment groups. The research that shaped this app found "update roulette", a keyboard changing under people without a version bump, was a top reason for switching away from the big ones. Not having the machinery is the cleanest way to never do it.

A theme gallery

Gone, and this one was nearly faked. An early draft of the Play listing mentioned a community gallery at a URL that did not exist. It was removed before submission. There is no gallery, because a gallery is a server that receives uploads.

What replaced it: themes and whole scenes travel as short text codes you paste into any chat, and complete builds including a background picture travel as one file. The share sheet is the gallery. Anything that can carry a file can carry a keyboard.

Cloud sync and account restore

Gone. No account, so nothing to sign into on a new phone. What replaced it: a backup file you own, readable JSON inside a zip with your imported font, photo, sound and GIFs alongside, optionally wrapped in AES-256-GCM with a passphrase you choose. Restore is "open the file". The Pro unlock restores through Play Billing itself, which is Google's server, not mine; how that works.

Cloud dictionaries and downloadable language packs

Gone. All thirty languages ship inside the package, about 6.5 megabytes compressed, and the engine opens only the one or two you selected. The cost is APK size on every install, paid once, for people who will only ever use one language. The languages post has the sizes and sources.

GIF search

Gone. GIF search is a query to somebody's server with what you typed in it. What replaced it: a private GIF library. You add files, the keyboard inserts them into apps that accept images, and no search leaves the phone. It is a worse GIF experience than a search box and it is the only one I could make honestly.

Server-side AI

Gone, obviously. What replaced it: Android's own AICore where the phone has it and a deterministic rules engine where it does not. Which phones have which.

What was actually gained

A short list, against a long one. Every claim on this site is checkable on the phone. Nothing can change without a release. The listing's data-safety form says "collects nothing" and the justification is a permission list rather than a paragraph. And, for what it is worth to me, I cannot be subpoenaed for something I never received.

The listing says "I have no idea who you are and it is absolutely ruining my analytics." That is a joke with a straight face. There are no analytics to ruin.