What data does Gboard collect about keystrokes and how long is it retained?
Executive summary
Gboard’s official position is that it does not collect or send the exact keystrokes a user types—except when a user explicitly performs a Google search or uses features that transmit input—while the keyboard does store learned words and usage metadata to improve predictions [1] [2] [3]. Independent analyses and privacy guides show Gboard can and does collect metadata (language, word length, app context, timing) and that optional telemetry or cloud-sync features can cause some typed content or summaries to be transmitted, but public sources reviewed do not provide a clear, single statement on how long any transmitted or retained data is kept [4] [5] [6].
1. What Google says: keystrokes are not retained or sent (with important exceptions)
Google’s public explanations—cited by reporting such as WIRED—state that Gboard “doesn’t retain or send any data about your keystrokes,” and that the company only sees text you submit through Gboard features that explicitly send data (for example, pressing the G button to search) [1]. Community Q&A and security forum summaries echo Google’s confidentiality claims that ordinary typing is not transmitted to Google servers except for explicit search submissions [2]. These are the company-controlled positions and anchor how many privacy guides and help threads explain default behavior [7] [5].
2. What independent researchers and security analysts have observed: metadata and samples are collected
Security researchers and telemetry studies find that popular keyboards—including Gboard—send metadata about typed words such as language, word length, exact input time, and which app received the text, and that some “small samples” or telemetry can be transmitted to improve predictions or models [4]. Kaspersky’s analysis specifically notes that disabling Gboard’s “Share usage statistics” option significantly reduces what is transmitted, implying that telemetry settings materially change what leaves the device [4]. Trusted Reviews and other explainers likewise report that machine‑learning powered keyboards commonly send back samples to companies to refine prediction engines [8].
3. On-device learning, syncing and “learned words” — local retention with optional cloud sync
Gboard “remembers words you type to help you with spelling or to predict searches,” and that learned‑word dictionary is stored on the device, with settings allowing users to delete that data or to sync learned words with a Google account if enabled [3] [5]. Guides on stopping data collection point out users can turn off permissions and delete learned words from the app, which affects what Gboard retains locally [5]. Commonsense privacy evaluations emphasize Gboard’s mixed privacy posture: it does not sell personal information but may participate in personalized advertising ecosystems and third‑party data sharing described in its public policies [6].
4. Diverging claims and alarmist reporting: an example of stronger accusations
A 2025 Medium piece asserts Gboard “collects and analyzes everything you type — passwords, credit card details” and claims keystrokes are logged even in incognito mode [9]. That article presents an alarmist interpretation that conflicts with Google’s published positions and with technical writeups that found no bulk exfiltration of all keystrokes; the sources examined here do not substantiate the claim that Google systematically harvests every character typed without exception, though they do document telemetry and optional uploads under specific settings [1] [4] [3].
5. What is missing from public reporting: explicit retention timelines
None of the sources reviewed provide a definitive, auditable timeline for how long Gboard retains on‑device learned words, telemetry samples, or any data that may have been uploaded when features are enabled; product help articles describe deletion controls but do not publish precise retention windows for server‑side copies or synced dictionaries [5] [1]. Because retention periods are not clearly documented in the cited material, definitive statements about how long Gboard keeps any transmitted or synced data cannot be made from these sources alone.
6. Practical takeaways based on the public record
From the available reporting, the most defensible summary is: Gboard claims it does not send raw keystrokes to Google except for explicit actions like searches, it stores learned words locally and can sync or send telemetry under optional settings, metadata about typing has been observed to be transmitted in some modes, and public sources do not provide clear retention-period disclosures for any server‑side data that might be created [1] [2] [3] [4] [5]. Users seeking minimal exposure should turn off Share Usage Statistics, avoid enabling cloud sync for learned words, and use the app’s “Delete learned words and data” controls; the sources reviewed corroborate these mitigations but do not quantify residual retention times [4] [5].