Legal
What Pilcrow knows, and what it does not.
The short version. The keyboard cannot send what you type anywhere, because it contains no code that could. What it learns about your writing stays on your device, and you can read and delete every line of it. The app reaches the internet for four things — language packs, asking the App Store whether a newer version exists, purchase verification, and feedback you choose to send — and none of them involves your text. There is no account, no analytics in the app or keyboard, no advertising, and no profile of you anywhere. This website counts visits with Google Analytics only if you allow it.
1. Who we are
The data controller for the little processing described below is pilcrowtype keyboard, established in the EU, reachable at info@pilcrowtype.com. We have not appointed a data protection officer, because the scale of processing does not require one; the address above reaches a person.
2. The keyboard
The Pilcrow keyboard extension is the part that appears when you type. It contains no networking code. It cannot open a connection, send a request, or reach a server, with Full Access on or off. This is a property of the software, not a policy we promise to follow, and it is why we can say plainly that nothing you type is transmitted to us or to anyone else.
iOS shows a standard warning when you enable any third-party keyboard, saying that it may transmit what you type. That warning is generic and is shown for every keyboard. It does not describe this one.
The keyboard does not read the content of your screen, other apps, your photos, your microphone or your location. iOS hides third-party keyboards in password fields and shows its own, so what you type there never reaches Pilcrow at all.
Contacts are consulted, never collected. So that a name you use every day stops being corrected into something else, the keyboard checks names against the contacts iOS makes available to it. Nothing about a contact is copied into its dictionary, written to a file, or sent anywhere — and it has no way to send anything.
3. What it learns, and where it lives
To be useful, the keyboard remembers things about how you write. Every one of them is stored on your device and nowhere else:
- Words you type that its dictionaries do not know, after you have typed them twice — or once, if you add them yourself.
- Phrases: short sequences of words you have written together more than once, so it can finish them.
- Spellings you prefer, for example an accented form you consistently choose.
- Corrections you accepted, refused, or made by hand, so it applies them or leaves your words alone next time.
- Where your thumbs land: for each key of a layout, how far from its centre your presses tend to fall, as a running average. It adjusts the invisible hit area of that key. It is an aim correction, not a log of keystrokes, and it is only ever updated from a word that the keyboard did not change and that its dictionaries know.
- Clips: text you paste through the keyboard’s clipboard panel, so you can paste it again. At most twenty, each removed after an hour unless you pin it, and never read from your clipboard behind your back — only what you paste through the keyboard is kept. The panel’s Clear button removes them. It needs Full Access.
- Shortcuts you write yourself: a trigger and the text it expands to.
- Typing statistics: counts of words typed, corrections made and undone, suggestions taken and keystrokes saved. Counts only, never the words, and none while nothing may be remembered — in private fields, password fields or with learning off. Reset them in the app under Settings › Typing statistics.
- The language you were last writing in, so the next field starts there.
- Settings, such as your enabled languages, layout, theme and options.
The words, phrases, spellings and corrections can be read and deleted one entry at a time, from the keyboard itself — hold any suggestion — or from the app’s Dictionary tab. Forget everything deletes all of them, the aim correction included, on your device, instantly. Setting a field to don’t learn here, or turning learning off, stops new entries being recorded. Entries also expire on their own: a word learned from a couple of sightings and not written again for a long stretch of typing is removed.
These records are not backed up to any service of ours. They are included in your normal device backup to iCloud or your computer, under Apple’s terms, like the data of any other app.
4. Full Access
Full Access is an iOS switch. For Pilcrow it changes three things: the keyboard can play haptic feedback, it can show a clipboard panel and offer to paste something you have just copied, and it can write into a container shared with the app, which is what lets the app display the word list the keyboard has learned. With Full Access off, learning still happens and the list is still yours to read and edit from inside the keyboard.
Full Access does not give this keyboard network access, because the keyboard has no network code. It does not change what is collected. Leave it off if you would rather; we recommend it.
5. The companion app
The Pilcrow app on your home screen talks to the internet for four purposes, and no others.
- Language packs
- When you enable a language that is not built in, the app downloads its dictionary and model from our file host at
packs.pilcrowtype.com, and later checks that host for updates. These requests carry no information about you or your typing. Like any web server, the host may record standard connection data — IP address, time, the file requested — for security and capacity. We do not use it to identify you and do not combine it with anything else. - Whether a newer version exists
- Now and then the app asks Apple’s public App Store lookup service which version of Pilcrow is on sale, so it can tell you when a language update needs a newer app. The request names the app, not you, and carries nothing about your typing. It goes to Apple, not to us.
- Purchases
- See section 6.
- Feedback you choose to send
- See section 7.
The app contains no analytics, no advertising, no crash-reporting service, no session recording and no account system. We do not know who you are.
6. Purchases
Pilcrow is free to download and fully unlocked for three days from the first time you type with it. After that it can be unlocked with a one-time purchase or a monthly plan. Payment is handled by Apple through the App Store under Apple’s terms; we never see your card, your name or your Apple Account.
To know whether an install has been unlocked, the app uses RevenueCat, a purchase-verification service. RevenueCat receives an identifier for your copy of Pilcrow, your purchase and subscription status, and basic technical information such as the app version and iOS version. The identifier is the one the App Store gives the app for your copy, which stays the same when you reinstall or install on another device signed in to the same Apple Account, so your purchase follows you without tapping Restore; where the App Store does not provide one, it is a random identifier generated on your device. It carries no name or email and is used only to keep your purchase with you. RevenueCat does not receive your name, your Apple Account, or anything you type. The keyboard extension does not contain the RevenueCat software; only the app does.
The three free days are measured by the keyboard itself, on your device. No clock is checked with a server.
7. Feedback you send us
The app has a form for reporting a bug or asking for something. Nothing is sent from it unless you write a message and tap send. When you do, we receive:
- What you wrote. Only that. Your draft is not pre-filled with anything you typed elsewhere, and no text from any other app is attached.
- Your email address, if you enter one — optional, and used only to reply to you.
- Diagnostics: the app and iOS version, whether the install is in its free days or unlocked, and the handful of settings that change what the correction engine does. These are the things a report like “it corrected X to Y” cannot be reproduced without. Themes, key heights and haptics are deliberately left out.
The report is turned into an email to us by a small server of ours and is not stored in a database. That server records the sending IP address briefly in order to rate-limit abuse. Please do not paste anything confidential into a bug report.
8. Who else touches anything
| Who | What for | What they get |
|---|---|---|
| Apple | Distribution, payment, and answering the app’s check for a newer version | Everything about your purchase, and the standard connection data of that check. We see none of it. Apple’s own privacy policy applies. |
| RevenueCat | Purchase verification | An identifier for your copy of Pilcrow (the App Store’s, or a random one), purchase status, app and OS version. |
| Cloudflare | Hosting the language packs, this site, and the feedback endpoint | Standard connection data such as IP address and time of request. |
| Counting visits to this website, only if you allow it (section 17) | The pages you view, how you arrived, your browser and device type, an approximate location derived from your IP address, and a random identifier stored in a cookie. | |
| An email provider | Delivering a feedback report to our inbox | The contents of the report you chose to send. |
That is the complete list. Nobody receives anything you type, because nothing you type ever leaves the device.
9. Where the data sits
Everything Pilcrow learns stays on your device, wherever you are. The small amount of data described above is processed on servers that may be located outside the EEA, including in the United States — Cloudflare’s edge network serves the request nearest you, RevenueCat is a U.S. company, and Google, if you allow analytics on this site, may process it in the United States under the EU–U.S. Data Privacy Framework. Where a transfer out of the EEA happens, it is made on the basis of the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism, agreed with that provider.
10. Why we are allowed to
| What | Legal basis (GDPR Art. 6) |
|---|---|
| Serving a language pack, and the connection data that comes with it | Performance of a contract, and our legitimate interest in running a secure, working file host. |
| Asking the App Store for the current version | Our legitimate interest in telling you when an update is needed for your languages to keep working. |
| Verifying a purchase through RevenueCat | Performance of the contract you enter when you buy. |
| Reading and replying to feedback you send | Your consent, given by sending it, and our legitimate interest in fixing our software. Withdraw it by asking us to delete the message. |
| Rate-limiting the feedback endpoint by IP | Our legitimate interest in preventing abuse. |
| Counting visits to this website with Google Analytics | Your consent, given by pressing Allow. Withdraw it with the Cookies button at the foot of any page. |
What the keyboard learns about your writing never becomes personal data held by us, because we never hold it.
11. How long we keep it
- What the keyboard learned: on your device, for as long as you keep it. It expires on its own, you can delete any line of it at any moment, and deleting the app removes all of it.
- Feedback: kept in our inbox for as long as it is useful for fixing the thing it reports, and no more than 24 months. Ask and we will delete it sooner.
- Server connection logs: kept by our hosting provider for a short period for security and capacity purposes, in line with its own retention policy, and not used by us for anything else.
- Purchase status at RevenueCat: for as long as the purchase record needs to exist, under its retention policy.
12. Security
Everything Pilcrow learns is held in your device’s own protected storage and benefits from iOS file protection and device encryption. Every network request the app makes uses HTTPS. Downloaded language packs are checked against a published hash before they are installed, so a tampered file is rejected. The feedback endpoint is rate-limited and accepts nothing but a short report.
If a breach ever occurred that was likely to result in a risk to your rights, we would notify our lead supervisory authority — the data protection authority of the EU member state in which we are established — within 72 hours of becoming aware of it, and tell affected people directly where the law requires it. Given that we hold almost nothing about anybody, the realistic worst case is the contents of a feedback message.
13. What we do not do
- We do not collect, transmit or store what you type.
- We do not sell, share or license data about you, because we hold none. We have never received a request to disclose any, and we would have nothing to hand over.
- We do not track you across apps or websites, and we do not use advertising identifiers.
- We do not require an account, an email address or a phone number.
- We do not train models on your text. The language models in Pilcrow are trained before release on public text, ship inside the app, and run entirely on your device.
- We do not make automated decisions that produce legal or similarly significant effects about you.
14. Your rights
Under the General Data Protection Regulation, and the national law implementing it where we are established, you have the right to access, correct, delete and port personal data held about you, to object to or restrict its processing, and to withdraw consent you have given.
Because Pilcrow keeps your data on your device and not with us, you exercise most of these rights directly, without asking us: open the Dictionary tab, or hold a suggestion on the keyboard, to read, edit or delete anything it has learned; use Forget everything to clear it; delete the app to remove all of it. Nothing needs our permission and nothing waits on a queue.
For the little we do hold — a feedback message and its reply — write to info@pilcrowtype.com and we will answer within 30 days. Because we hold no account, we may ask you to write from the address the message came from; that is the only way we can tell it is yours, and we will not ask for identity documents.
You also have the right to lodge a complaint with a supervisory authority: either the authority for your own country of residence, or our lead authority, which is the data protection authority of the EU member state in which we are established. Write to us and we will name it for you.
15. If you are in California
Under the CCPA and CPRA you have the right to know what personal information is collected, to have it deleted, to correct it, to opt out of its sale or sharing, and not to be discriminated against for exercising those rights.
In the twelve months before the date above we collected no category of personal information from users of Pilcrow beyond what section 5 describes, and we sold and shared nothing — not to anyone, for any purpose, including cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes that require an opt-out. There is therefore no “Do Not Sell or Share My Personal Information” link to offer; the answer is already no. Exercise any of these rights at the address in section 19.
16. Children
Pilcrow is not directed at children under 13, or under the age of digital consent where you live, and it does not knowingly collect personal data from anyone of any age. Since the keyboard collects nothing and stores what it learns only on the device, a child using it is not sending data to us. If you believe a child has sent us a feedback message, write to us and we will delete it.
17. This website
This site uses Google Analytics to count visits — which pages are read and how people find them — only if you allow it. Until you press Allow, nothing from Google loads and no cookie is set; pressing No thanks, or not answering, keeps it that way. The only thing stored before you answer is your answer itself, in your browser’s local storage, so that we do not ask again.
If you allow it, Google Analytics sets the cookies _ga and _ga_QKMSHHEK34, which hold a random identifier and last up to two years, and receives the data listed in section 8. We have turned off Google signals and advertising personalisation, so the data is not linked to a Google account or used for ads. Google keeps it for at most fourteen months, the longest Google Analytics allows. Google’s own privacy policy applies to its processing.
You can change your mind at any time with the Cookies button at the foot of every page, or here: . Withdrawing deletes the cookies from this site and stops the counting. If your browser sends a Global Privacy Control signal, we treat it as No thanks and never ask.
The site uses no other scripts, no tag manager besides Google’s analytics tag, no advertising, no embedded fonts from anyone else and no other third-party content. Our host records standard server logs as described above. None of this concerns the keyboard, which has no analytics and no networking code whatever you choose here.
18. Changes
If this policy changes, the new version will be published here with a new effective date and version number, and the app will link to it. Material changes will be flagged in the app before they take effect.
A change that let the keyboard transmit your text would not be a change to this policy. It would be a different product, and we have no plan to build it.
19. Contact
pilcrowtype keyboard, EU
info@pilcrowtype.com
Ask at the address above for the name and contact details of our lead supervisory authority, or complain to the authority for your own country of residence.