Permissions

A fresh install asks for nothing. Every permission on this page belongs to exactly one optional feature, and none is requested until the first time you use that feature. Typing needs no permission at all, and neither do prediction, autocorrect, gesture typing, emoji search or learning. Point the keyboard at no tool and you’ll never see a single prompt.

The explanation always comes first

Before Android’s own permission dialog appears, the keyboard shows its own: what it’s about to ask for, which feature wants it, what happens to the data, and whether any of it leaves the phone. Two buttons, Continue and Not now.

Not now is a real answer. It closes the dialog without asking Android for anything, and the feature stays where it was. A tool that needs the permission keeps showing its “needs permission” panel, and a setting that needs one stays off. Nothing is silently enabled behind the dialog. Dismissing it with Back, or with a tap outside, counts the same as Not now.

The explanation belongs to the feature, not to the entry point, so the microphone text is identical whether you reached it from the voice panel on the keyboard or from a settings screen. Contacts serves three features and so has three texts: it reads differently for name suggestions, for email suggestions and for the call or text chip. Notification access serves two, and reads differently for media controls and for the one-time-code chip. Each one describes what that feature actually does with it.

What each permission is for

These are the ones that produce a system prompt the first time.

Permission	Feature that wants it	What it does with it
Microphone	Voice input	Records only while you’re dictating. Audio goes to the speech recognizer picked in your Android settings, which on most phones is Google’s and may process it in the cloud. An offline Whisper model Full edition only keeps it on the phone. Nothing is stored either way.
Camera	Camera tool, OCR and QR scanning Full edition only	Opens the camera only while that panel is on screen. Photos land in the app’s private storage and go to the app you’re typing in when you insert one.
Contacts	Contact name and email suggestions, call or text chips	Reads names and addresses into memory so they complete as you type, and so autocorrect stops “fixing” them. With the call or text chip on, also reads phone numbers, so a typed name can open the dialer or messages app for that person. Never written to disk, never sent anywhere.
Location	Location tool, and Use my location for weather and the compass	Reads your position once, only when you tap, and stops. Never in the background, and the keyboard doesn’t declare background location at all. Android 12 and later let you pick Approximate, which the tool works with. The reading stays in memory for 15 minutes and is saved only if you save a place. The address lookup, which you can turn off, sends the point at your chosen precision to an address server. Building with -Pwmkb.noLocation=true leaves the permission out.
Calendar	Calendar tool, and the AI’s calendar tool	Reads your events so the tool can list them and insert one as text, only while the tool is open. If you let the AI read your calendar, it reads the days the model asks for, and those events go to your AI provider. This one never writes.
Calendar (adding events)	The AI’s Add directly for calendar events	Asked for only when you pick Add directly. The AI then adds events to the calendar you chose, and only adds: nothing in the app changes or deletes an event. Without it the AI opens your calendar app with the event filled in, and you save it there.
Photos	Screenshots in the clipboard, and the Gallery tool	For the clipboard, spots newly taken screenshots so they turn up ready to insert. Android has no screenshots-only permission, so granting it opens your photo library as a whole even though that setting only ever looks at new screenshots. The Gallery tool shows the library in its own grid while its panel is open, and sends a copy of only what you pick. On Android 14 and later you can allow only some photos. The Play Store build doesn’t declare it: there the clipboard has no screenshot setting and the Gallery tool uses Android’s photo picker, which needs no permission.
Videos	The Gallery tool, Android 13 and later	Lists your videos beside the photos in the gallery grid. Asked for together with Photos. Not in the Play Store build.
Storage	Save an image to your gallery	Android 9 and older only. Newer versions let an app write its own media with no permission, so nothing is asked for there.

Seven more are granted at install with no prompt, because Android doesn’t consider them sensitive: vibration (for haptics), internet, the audio-settings one that lets voice typing open a Bluetooth headset’s microphone when you pick it (MODIFY_AUDIO_SETTINGS, Android 11 and older only, since newer versions don’t need it, and used only while that dictation runs), the “is this connection metered?” check the model downloaders use before pulling hundreds of megabytes, the two Wi-Fi ones KDE Connect needs to find a computer on your network (CHANGE_WIFI_MULTICAST_STATE and ACCESS_WIFI_STATE, used only while that tool is switched on and running, since most phones drop discovery traffic for an app that holds no multicast lock), and the fingerprint permission behind the App lock. About that last one: it lets the app ask Android to run its own prompt and hand back a yes or a no. The fingerprint itself never reaches the keyboard, and nothing asks for a prompt unless you turn the lock on. The Clock tool declares three more for ringing: FOREGROUND_SERVICE and FOREGROUND_SERVICE_SYSTEM_EXEMPTED keep an alarm’s sound playing while it rings, and WAKE_LOCK keeps the phone awake for those minutes. All three are used only while an alarm or a timer you set is ringing, and stop the moment you answer it or it gives up by itself. The Play Store build has no ring service and doesn’t declare FOREGROUND_SERVICE_SYSTEM_EXEMPTED; there an alarm rings through a notification instead. Full builds list one more that never produces a prompt, RECEIVE_BOOT_COMPLETED. It isn’t there for anything the keyboard does: it arrives in the merged manifest from androidx.work, which ML Kit pulls in, the app schedules no WorkManager job of its own, and it registers no boot receiver. Lite builds don’t declare it at all. What the internet permission is actually used for, tool by tool, is on Network policy. The keyboard also works without it: a build made with -Pwmkb.noInternet=true leaves it out, and only the features that fetch something stop, as they do offline. Every GitHub release carries two, full · all languages and lite · English, marked nointernet. See Building.

A build downloaded from the project’s GitHub releases declares two more that no other build does: REQUEST_INSTALL_PACKAGES and UPDATE_PACKAGES_WITHOUT_USER_ACTION. They are there for one thing, the app installing a new version of itself, and that build is the only one where nobody else can do it: a Play Store build hands updates to the Play Store and an F-Droid build hands them to F-Droid. Neither of those APKs contains the permissions or the code behind them, which you can check against the merged manifest of any build. The first is a switch you turn on yourself, listed on the permissions screen as Install updates. The second lets Android skip its own confirmation once your phone knows this app is the one that updates itself; the first update always asks, and the app never downloads or installs anything you did not press a button for. The checks it runs on a downloaded file are described under Updating the app.

If Android stops asking

Refuse the same permission twice and Android stops showing that prompt entirely. It tells neither the app nor you. The next tap just returns “denied” with nothing on screen, which normally leaves you pressing a button that appears to do nothing.

The keyboard notices when that happens. Tap the button, Android answers “denied” before any prompt could have been read, and the explanation comes back with a line saying Android has stopped asking. The button becomes Open system settings and drops you on the app’s own permission page, where the choice still lives. Grant it there and the feature works the next time you open it.

The keyboard always asks first and only sends you to Settings once Android has refused on its own, because nothing it can check beforehand tells those two cases apart. That’s what keeps Ask every time working. Set the camera or the microphone to it in Android’s settings, and the grant button on the camera or voice panel brings up the system prompt with its Only this time choice. Android takes that grant back soon after you stop using the keyboard, and the panel asks again next time. This is standard Android 11 behaviour, so custom ROMs built on it work the same way.

The ones that aren’t permissions

Notification access, usage access, display over other apps, the accessibility service and the two clock grants aren’t permissions Android will prompt for. Each is a switch on a system Settings screen, and all the app can do is take you there. The keyboard shows the same kind of explanation first, for the same reason. All of them stay off until you turn them on yourself.

The system screens for all of them carry broad, alarming warnings, because the categories are powerful. What this app uses is much narrower:

Access	Feature	What the keyboard uses it for
Notification access	Media controls and the one-time code chip	Android only hands the play/pause/skip controls of the current media session to apps holding this. For media the listener reads nothing at all: no notification, title, sender or content. It exists purely so the platform will surface the session. The code chip is the one thing that ever reads notification text, only while you’ve turned it on, and only to find a verification code. Nothing is stored and nothing leaves the phone either way.
Display over other apps	The floating keyboard button and the floating AI button	Draws those small round buttons over other apps. One opens and closes the keyboard, the other opens an AI chat. The buttons are the only windows it draws, and the permission itself can’t see or read anything on screen.
Alarms and reminders	Clock alarms and timers, Android 12 and later	Lets an alarm ring at the exact minute. Without it, Android may hold an alarm back by some minutes while the phone sleeps; it still rings. Nothing is read.
Full-screen notifications	The Clock ring screen, Android 14 and later. Not in the Play Store build, which doesn’t declare it	Lets a ringing alarm or timer put its screen, with Snooze and Dismiss, over the lock screen. Without it, the ring shows as a notification. Used only while one of your alarms rings.
Usage access	“Show source app” on clipboard entries	Reads which app was in front at the moment you copied something, so the clip can show where it came from. Not your history, not time spent anywhere. Kept with the clip, on this device.
Accessibility service	Keyboard gestures under a screen reader	Marks the key grid as bypassing TalkBack’s touch handling, which is the only way an app can keep its own gestures there. It subscribes to no accessibility events, can’t read window content, and covers nothing outside the keys. See Screen readers. The Play Store build doesn’t contain the service, so there it’s one fewer.
Accessibility service	Screen reading for the floating AI button	A second, separate service. Each time you tap the AI button it reads the text of the app on screen once and puts it in the chat that opens, where you see it before anything is sent. It reads nothing at any other time, skips password fields, performs no actions and keeps nothing. Where the chat goes depends on the AI provider you picked. Not in the Play Store build.

All of them are revoked the same way they were granted, from the relevant system Settings screen, and the features fall back cleanly: media controls show their “needs access” panel, clips are saved with no source app, the floating buttons stop appearing, the AI button’s chat opens without the screen’s text, and the gestures mode behaves like Explore by touch.

Options

WM Keyboard › Privacy › Permissions

The app has a permissions screen of its own, at the top of Privacy. It’s an inventory rather than a funnel. Every permission that does something you can turn on or off appears there in three groups: the ones Android prompts for, the special-access grants, and the four install-time ones the app declares for itself. Each row shows Granted, Not granted or Automatic on the right. What the screen leaves out is the handful of manifest entries with no control behind them, listed under Details & edge cases below.

Tap a row you haven’t granted and you get the same explanation-then-prompt flow the feature itself would run, so this is the one place you can grant something ahead of the feature that wants it. Tap a row that’s already granted and the app’s own page in Android’s Settings opens, because that’s the only place a grant can be taken back. Field by field, it’s on Permissions settings.

Nothing stops you going to Android’s page directly instead: Settings → Apps → WM Keyboard → Permissions. Notification access, usage access, display over other apps and accessibility each sit on their own system screen rather than in that list, which is why the in-app screen keeps them in a group of their own.

Details & edge cases

• Revoking a permission never breaks the keyboard. Every feature behind one is optional and checks at the moment it’s used. A revoked permission turns that one panel back into its “needs permission” state and leaves everything else alone. Typing is never affected.
• Two dictionary permissions are declared but do nothing on any current phone. The app lists READ_USER_DICTIONARY and WRITE_USER_DICTIONARY for the “Add words to the system dictionary” setting described on Your data on device. Since Android 6, the system grants the active keyboard access to that provider without a permission, so these are inert on anything modern and only matter on much older releases.
• Reading your SIM’s country isn’t a permission either. The Suggested for you group on the Languages screens asks Android for the SIM’s and the network’s country code (getSimCountryIso and getNetworkCountryIso), which any app may do without asking, alongside your phone’s system language list. Both are used only to order that list, both are read on the spot rather than stored, and neither leaves the device. Nothing else about the SIM is touched, not the number, the carrier account, the IMEI or anything else identifying. A phone with no SIM falls back to the region on its locale. See Suggested languages.
• Listing your installed apps isn’t a permission. The keyboard-mode editor can bind a mode to specific apps, and app names can be offered as suggestions. Both need to see the list of launcher activities. Android 11 and later hide that list unless an app declares which kinds of apps it wants to see, which this app does narrowly: launcher activities, mail apps for the bug-report row, and two entries naming Google Play services itself (the com.google.android.gms package and its com.google.android.gms.fonts provider) so the document scanner and the downloadable Noto fonts can be left out cleanly on a phone that has no Play services. It doesn’t use the blanket “query all packages” permission.
• The camera permission covers the scanners, but the document scanner is Google’s own screen. OCR and QR scanning Full edition only run in a keyboard panel and use the permission above. Document scanning hands off to the full-screen scanner supplied by Google Play services, which manages its own camera access and returns the pages when it’s done.
• Nothing here is asked for on behalf of an analytics or ad SDK. No permission on this page is requested by an analytics library or an ad network, because the app contains none. The only permissions a third-party library contributes at all are the three install-time ones described above, which arrive in full builds from androidx.work as a transitive dependency of ML Kit. See Privacy at a glance for what that claim rests on and how to check it yourself.