Privacy policy

PictoKeyboard is a pictogram keyboard for Android. It is set up by a parent, carer or therapist, and used by someone with speech or typing difficulties to say what they mean in any app on the phone.

This policy is short because the app does very little, and everything in it is checkable against the source code, which is public.

Last updated: 11 August 2026

What the person types never leaves the phone. Not to us, not to anyone. There is no analytics, no crash reporting, no advertising and no tracking of any kind in this app.

What the keyboard can see, and what it does with it

An Android keyboard is technically able to observe the text field it types into. Because that is a serious capability, here is exactly how PictoKeyboard uses it.

Text is delivered to the app being typed into. That is the whole purpose of a keyboard, and it goes nowhere else.
The app keeps a count, on the device, of how often each pictogram is used, so the most-used symbols can be offered first. That is a tally of pictograms, not a record of what was said, and it never leaves the phone.
Password fields are excluded from that tally entirely.
When an app asks the keyboard not to learn from a field — Android's IME_FLAG_NO_PERSONALIZED_LEARNING, which is how incognito modes and sensitive fields signal this — PictoKeyboard honours it and records nothing.

There is no key logging, no cloud prediction, and no upload of typed content of any kind.

Sentence help, if you switch it on

Sentence help turns the words that were tapped into a full sentence. It is off unless a caregiver turns it on, and turning it on downloads a language model to the phone, once — see below.

The sentence is written on the phone. The words go to a model running in a separate process on this device, and the sentence comes back from it. Nothing that is typed is sent anywhere, at any point, on or off. This is the whole reason the model is a several-hundred-megabyte download instead of a web request.

Deleting the model removes it and the space it took, and the keyboard goes back to behaving exactly as it did before.

The person the bell calls

A caregiver can enter one name and one phone number, so that a red bell on the keyboard can call for help. Both are stored on the phone and nowhere else, they are never sent to us or to anyone, and the app does not read your contacts to get them — you type them in. Clearing the number removes the bell.

Information that does leave the phone

There are two destinations, and neither of them is us. PictoKeyboard has no server, no account and no sign-in: there is nowhere for your information to be sent, which is a stronger promise than a policy saying we would not send it. Both destinations below are the app fetching something — nothing you write is uploaded to either.

ARASAAC, for searching and fetching pictograms

The pictograms come from ARASAAC, the Aragonese Centre of Augmentative and Alternative Communication. The app contacts them for two things, both while a board is being built:

Searching their library. The word you type into the pictogram search box is sent to ARASAAC so they can look it up — the same way any dictionary search works. This is the search box on the setup screens; it is not anything typed with the keyboard.
Fetching an image the app has not already stored. That request names the pictogram wanted. Images are cached on the phone afterwards, so the same one is never fetched twice.

Both carry the device's IP address, as any web request does. Neither carries an account, a device identifier, or anything typed with the keyboard — there is no identifier of any kind to send. ARASAAC is an independent public body and its own terms apply to its service.

Hugging Face, only if sentence help is switched on

The language model behind sentence help is downloaded from Hugging Face, where its publisher hosts it. This happens once, and only if a caregiver switches the feature on; an install that never does never contacts them at all.

It is a download and nothing else: the request names the model file, and carries the device's IP address as any web request does. No account, no device identifier, and nothing typed on the keyboard is sent — the phone is collecting a file, not reporting anything. Once it has arrived the feature works with no connection.

We do not sell data, we do not share it with advertisers, and there are no third-party recipients beyond the two named above. We hold no account of yours because there are none to hold.

Sharing a board is something you do, not something we do. A board can be exported as a single .pkb file and sent through whatever you already use — a message, an email, a memory card. It goes from your phone to the person you chose, and never through us.

Children

PictoKeyboard is meant to be operated by an adult on behalf of the person using it, and the setup screens sit behind a PIN for that reason. We do not knowingly collect personal information from children — we never ask for the name, age, diagnosis or any other detail of the person speaking with the keyboard, and there is nowhere for such a thing to be sent.

Deleting your data

Everything the app holds — boards, pictograms, photographs, settings and the usage tally — is on the phone and nowhere else. Uninstalling PictoKeyboard, or clearing its data in Android's app settings, removes all of it. There is no request to make of us and no account to close, because there is nothing of yours anywhere but the device in your hand.

That cuts both ways: nothing is backed up for you. A phone that is lost or reset takes the boards with it. Export them from the app as a .pkb file and keep it somewhere safe — that file is the only copy there will be.

Android's automatic backup is switched off

Android offers apps an automatic backup to the user's Google Drive, and it is on by default. PictoKeyboard turns it off. Boards, settings, the usage tally and above all the photographs you have added — somebody's kitchen, their bus stop, their grandmother — are not copied to Drive or to any other cloud account.

On Android 12 and later, one exception is deliberately kept: when you set up a new phone and transfer your data across from the old one, PictoKeyboard travels with it. That is a direct handover between two devices you own, at a moment you chose, and nothing goes to a server on the way. It is not a backup you can fall back on, though — a phone that is already lost or broken cannot transfer anything, which is why the exported file above matters.

Permissions the app asks for

Internet and network state — to fetch pictogram images from ARASAAC while a board is being built, and to download the sentence-help model if that is switched on. Once they are stored the keyboard works with no connection at all.
Phone calls — asked for only when a caregiver has actually entered a number for the keyboard's bell, and only so that pressing the bell places the call itself. Refusing it is a supported answer: the bell then opens the phone app with the number filled in, and somebody presses the call button by hand. The app never reads your call log and never places a call you did not press the bell for.

That is the complete list. In particular the app requests no camera permission — when a photograph is added to a board, the phone's own camera app takes the picture and hands back the result — and no contacts permission: the assistance number is typed in, not looked up.

Pictogram licensing

The pictograms are the property of the Government of Aragón and were created by Sergio Palao for ARASAAC, which distributes them under CC BY-NC-SA 4.0.

Changes

If this policy changes, the date above changes with it. Every revision is public and timestamped in this document's history.

Contact

Questions about this policy, or about data held about you, can be sent to pictokeyboard@duck.com.