A keyboard that can't reach the internet

I built Bloom for myself: a hexagonal keyboard with a training mode, tuned to how I type. Getting it ready for Google Play raised a question I’d never had to answer: why would anyone trust a stranger’s keyboard?

A keyboard sees everything. Passwords, messages, the search you’d rather nobody saw. Most keyboards handle that with a privacy policy, which is a promise. I wanted Bloom’s privacy to be a property you can check.

Remove the capability, not just the intent

Bloom doesn’t request Android’s internet permission. Without it, the app can’t open a network connection, whatever its code says. Bloom’s Google Play page lists its permissions, so you can confirm that before you type a single word.

Everything else is designed around that line. Suggestions come from a word list inside the app. The clipboard holds your last five copies in memory and forgets them when the keyboard closes. Password fields switch off suggestions and clipboard shortcuts. There’s no dictation, so no microphone either. The only permission Bloom asks for is vibration, for key presses.

What it costs

No dictation. No syncing a dictionary across devices. None of the AI rewrite features other keyboards are adding. Those are real losses, and for a keyboard I’d accept them every time. If Bloom ever needs the network, the privacy policy changes first, the feature ships switched off, and the app says what it sends and to whom.

The same rule at work

This is the principle I use for AI agents at work. An agent can’t misuse access it was never given. A model shouldn’t be able to choose whose data it reads, and a keyboard shouldn’t be able to choose where your words go. In both cases the safest answer isn’t a better promise. It’s taking the capability away.

Bloom’s privacy policy is short because there isn’t much to say.