# Permissions

> Every permission the keyboard can ask for, which feature wants it, and what happens if you say no.

URL: https://wmkeyboard.pages.dev/privacy/permissions/
Section: Privacy & security

A fresh install asks for nothing. Every permission on this page belongs to exactly one optional feature, and none is requested until the first time you use that feature. Typing needs no permission at all, and neither do prediction, autocorrect, gesture typing, emoji search or learning. Point the keyboard at no tool and you'll never see a single prompt.

## The explanation always comes first

Before Android's own permission dialog appears, the keyboard shows its own: what it's about to ask for, which feature wants it, what happens to the data, and whether any of it leaves the phone. Two buttons, **Continue** and **Not now**.

**Not now** is a real answer. It closes the dialog without asking Android for anything, and the feature stays where it was. A tool that needs the permission keeps showing its "needs permission" panel, and a setting that needs one stays off. Nothing is silently enabled behind the dialog. Dismissing it with Back, or with a tap outside, counts the same as **Not now**.

The explanation belongs to the feature, not to the entry point, so the microphone text is identical whether you reached it from the voice panel on the keyboard or from a settings screen. Contacts serves three features and so has three texts: it reads differently for name suggestions, for email suggestions and for the call or text chip. Notification access serves two, and reads differently for media controls and for the one-time-code chip. Each one describes what that feature actually does with it.

## What each permission is for

These are the ones that produce a system prompt the first time.

| Permission | Feature that wants it | What it does with it |
|---|---|---|
| Microphone | [Voice input](https://wmkeyboard.pages.dev/tools/voice/), and [Music ID](https://wmkeyboard.pages.dev/tools/music-id/) | Records only while you're dictating. Audio goes to the speech recognizer picked in your Android settings, which on most phones is Google's and may process it in the cloud. An offline Whisper model google keeps it on the phone. Nothing is stored either way. Music ID records only while its panel listens, up to twelve seconds per tap; the clip is sent only to the recognition services you switched on, then dropped. |
| Camera | [Camera tool](https://wmkeyboard.pages.dev/tools/camera/), [OCR and QR scanning](https://wmkeyboard.pages.dev/tools/scanner/), the [AI chat's](https://wmkeyboard.pages.dev/tools/ai-chat/#the--menu) **Take a photo** | Opens the camera only while that panel is on screen. Photos land in the app's private storage and go to the app you're typing in when you insert one. **Take a photo** hands over to your camera app, which needs the permission granted first; the photo joins your next chat message. |
| Contacts | [Contact name and email suggestions](https://wmkeyboard.pages.dev/smart/contacts/), [call or text chips](https://wmkeyboard.pages.dev/smart/chips/#calling-or-texting-a-contact), and guest suggestions in the [Calendar tool](https://wmkeyboard.pages.dev/tools/calendar/#guests) | Reads names and addresses into memory so they complete as you type, and so autocorrect stops "fixing" them. With the call or text chip on, also reads phone numbers, so a typed name can open the dialer or messages app for that person. The calendar's guest box looks up the names you type only while it is open. Never written to disk, never sent anywhere. |
| Location | [Location tool](https://wmkeyboard.pages.dev/tools/location/), and **Use my location** for [weather and the compass](https://wmkeyboard.pages.dev/tools/instruments/) | Reads your position once, only when you tap, and stops. Never in the background, and the keyboard doesn't declare background location at all. Android 12 and later let you pick **Approximate**, which the tool works with. The reading stays in memory for 15 minutes and is saved only if you save a place. The address lookup, which you can turn off, sends the point at your chosen precision to an address server. Building with `-Pwmkb.noLocation=true` leaves the permission out. |
| Nearby devices | The [Send files](https://wmkeyboard.pages.dev/tools/send/) tool's direct link between two phones, Android 13 and later | Lets the keyboard open a Wi-Fi for another phone, or join the one another phone opened, when you press **Receive here** or **Scan a code** in the tool. Asked for only then; declared as never used for location, and the keyboard reads no position with it. On Android 12 and older the same two buttons ask for Location instead, because that is where Android keeps Wi-Fi Direct and hotspots there. Devices already on the same Wi-Fi need neither. |
| Calendar | [Calendar tool](https://wmkeyboard.pages.dev/tools/calendar/), and the AI's [calendar tool](https://wmkeyboard.pages.dev/tools/ai/#the-keyboards-own-tools) | Reads your events so the tool can list them, open one and insert it as text, only while the tool is open. If you let the AI read your calendar, it reads the days the model asks for, and those events go to your AI provider. This one never writes. |
| Calendar (changing events) | The [Calendar tool's](https://wmkeyboard.pages.dev/tools/calendar/#adding-an-event) Save, Edit and Delete, and the AI's **Add directly** for [calendar events](https://wmkeyboard.pages.dev/tools/ai/#adding-calendar-events) | Asked for the first time you save or delete an event in the Calendar tool, or when you pick **Add directly** for the AI. The tool then writes only the events you save, change or delete yourself; the AI only adds, to the calendar you chose. Without it both hand the event to your calendar app, filled in, and you save it there. |
| Photos | Screenshots in the [clipboard](https://wmkeyboard.pages.dev/tools/clipboard/), and the [Gallery](https://wmkeyboard.pages.dev/tools/gallery/) tool | For the clipboard, spots newly taken screenshots so they turn up ready to insert. Android has no screenshots-only permission, so granting it opens your photo library as a whole even though that setting only ever looks at new screenshots. The Gallery tool shows the library in its own grid while its panel is open, and sends a copy of only what you pick. On Android 14 and later you can allow only some photos. The Play Store build doesn't declare it: there the clipboard has no screenshot setting and the Gallery tool uses Android's photo picker, which needs no permission. |
| Videos | The [Gallery](https://wmkeyboard.pages.dev/tools/gallery/) tool, Android 13 and later | Lists your videos beside the photos in the gallery grid. Asked for together with Photos. If Photos was already granted for the clipboard, the gallery shows a banner and asks for Videos when you tap **Allow videos**. Not in the Play Store build. |
| Storage | Save an image to your gallery, or an edited photo over its original | Android 9 and older only. Newer versions let an app write its own media with no permission, so nothing is asked for there. |
| Storage (file manager) | The [file manager](https://wmkeyboard.pages.dev/tools/files/), Android 7 to 10. Not in the Play Store build | Asked for together when a tool first opens the file manager, and covers all of shared storage. From Android 11 the same thing is **All files access**, below. |
| AnkiDroid | **Add to Anki** on the [Look up](https://wmkeyboard.pages.dev/tools/look-up/#anki) card, when it adds straight to a deck | A permission AnkiDroid defines, asked for only the first time you send a word straight to a deck. It covers your whole AnkiDroid collection; the keyboard uses it only to make its own deck and note type, to check whether a word is already there, and to add the word you sent. Nothing leaves the phone. Without it, the card opens AnkiDroid's note editor filled in, for you to save. Only on a phone with AnkiDroid. |

Seven more are granted at install with no prompt, because Android doesn't consider them sensitive: vibration (for haptics), internet, the audio-settings one that lets [voice typing](https://wmkeyboard.pages.dev/tools/voice/#choosing-the-microphone) open a Bluetooth headset's microphone when you pick it (`MODIFY_AUDIO_SETTINGS`, Android 11 and older only, since newer versions don't need it, and used only while that dictation runs), the "is this connection metered?" check the model downloaders use before pulling hundreds of megabytes, the two Wi-Fi ones [KDE Connect](https://wmkeyboard.pages.dev/tools/kde-connect/) needs to find a computer on your network (`CHANGE_WIFI_MULTICAST_STATE` and `ACCESS_WIFI_STATE`, used only while that tool is switched on and running, since most phones drop discovery traffic for an app that holds no multicast lock), and the fingerprint permission behind the [App lock](https://wmkeyboard.pages.dev/reference/settings/app-lock/). About that last one: it lets the app ask Android to run its own prompt and hand back a yes or a no. The fingerprint itself never reaches the keyboard, and nothing asks for a prompt unless you turn the lock on. The [Clock](https://wmkeyboard.pages.dev/tools/clock/) tool declares three more for ringing: `FOREGROUND_SERVICE` and `FOREGROUND_SERVICE_SYSTEM_EXEMPTED` keep an alarm's sound playing while it rings, and `WAKE_LOCK` keeps the phone awake for those minutes. All three are used only while an alarm or a timer you set is ringing, and stop the moment you answer it or it gives up by itself. The Play Store build has no ring service and doesn't declare `FOREGROUND_SERVICE_SYSTEM_EXEMPTED`; there an alarm rings through a notification instead. Every build but F-Droid's lists one more that never produces a prompt, `RECEIVE_BOOT_COMPLETED`. It isn't there for anything the keyboard does: it arrives in the merged manifest from androidx.work, which ML Kit pulls in, the app schedules no WorkManager job of its own, and it registers no boot receiver. Lite builds don't declare it at all. The [Send files](https://wmkeyboard.pages.dev/tools/send/) tool adds two more of the same kind, `CHANGE_WIFI_STATE` and `CHANGE_NETWORK_STATE`: they let it open the Wi-Fi Direct group or local hotspot another phone joins, and ask for the separate network that link uses. Neither reads where you are, and neither is used until you start a transfer to a phone nearby. Android's app info screen lists all of these under names like "control Wi-Fi" or "view network connections", which sound broader than the one thing each is used for here. What the internet permission is actually used for, tool by tool, is on [Network policy](https://wmkeyboard.pages.dev/privacy/network/). The keyboard also works without it: a build made with `-Pwmkb.noInternet=true` leaves it out, and only the features that fetch something stop, as they do offline. Every GitHub release carries one, in English and an all-languages version, marked `nointernet`. See [Building](https://wmkeyboard.pages.dev/development/building/#a-build-with-no-internet-permission).

A build downloaded from the project's GitHub releases declares two more that no other build does: `REQUEST_INSTALL_PACKAGES` and `UPDATE_PACKAGES_WITHOUT_USER_ACTION`. They are there for one thing, the app installing a new version of itself, and that build is the only one where nobody else can do it: a Play Store build hands updates to the Play Store and an F-Droid build hands them to F-Droid. Neither of those APKs contains the permissions or the code behind them, which you can check against the merged manifest of any build. The first is a switch you turn on yourself, listed on the permissions screen as **Install updates**. The second lets Android skip its own confirmation once your phone knows this app is the one that updates itself; the first update always asks, and the app never downloads or installs anything you did not press a button for. The checks it runs on a downloaded file are described under [Updating the app](https://wmkeyboard.pages.dev/reference/settings/about/#updating-the-app).

One more is declared but never asked for, and no app can be granted it by itself: `INTERACT_ACROSS_USERS`. It is for [sync with your private space or work profile](https://wmkeyboard.pages.dev/privacy/backup/#sync-between-devices). Before Android 17 that sync works without it. Android 17 and later keep apps in different profiles from reaching each other, and the only way to let the two copies of the keyboard through is to grant this permission to each with `adb shell pm grant`, from a computer. The **Other profile** location shows the exact command when it's needed. Granted, it's used for that one connection between the two copies on the phone, and for nothing else.

`WRITE_SECURE_SETTINGS` is declared the same way, for the app launcher's [Android freeform windows](https://wmkeyboard.pages.dev/tools/app-launcher/#androids-freeform-windows) row. No app can be granted it by itself; you grant it with `adb shell pm grant` from a computer, or the keyboard grants it through Shizuku or root if you allowed those. It is used to turn two developer options on or off, **Enable freeform windows** and **force activities to be resizable**, and for nothing else.

The app launcher can also use [Shizuku or root](https://wmkeyboard.pages.dev/tools/app-launcher/#shizuku-and-root), if you set them up and allow the keyboard. Neither is a permission Android lists: Shizuku asks in its own dialog, and your root manager in its own. Through them the keyboard runs window commands only (opening an app floating or in split screen, resizing its window, finding its task, and the two freeform settings above), reads Android's battery estimate for the keyboard itself on [About › Resources](https://wmkeyboard.pages.dev/reference/settings/about/#seeing-what-the-keyboard-holds-in-memory), and, for the experimental emulated window, passes the touches you make on that window to the app inside it.

The F-Droid and GitHub builds can use the same door for more, under [Privacy › Permissions › Shizuku or root](https://wmkeyboard.pages.dev/reference/settings/permissions/#shizuku-or-root), behind a switch that is off by default. With it on, one tap can set the keyboard as your keyboard, grant the permissions above, allow notification access, turn on the screen-reading service, grant `WRITE_SECURE_SETTINGS`, or pick the keyboard's spell checker for every app. Each grant appears in system Settings exactly as if you had made it there. One more switch lets the AI reply panel read the chat on screen through `uiautomator` as it opens. It reads the visible text of the app in front once, keeps it only in the panel, and deletes the dump file in the same command that writes it. The Play Store build has none of this.

## If Android stops asking

Refuse the same permission twice and Android stops showing that prompt entirely. It tells neither the app nor you. The next tap just returns "denied" with nothing on screen, which normally leaves you pressing a button that appears to do nothing.

The keyboard notices when that happens. Tap the button, Android answers "denied" before any prompt could have been read, and the explanation comes back with a line saying Android has stopped asking. The button becomes **Open system settings** and drops you on the app's own permission page, where the choice still lives. Grant it there and the feature works the next time you open it.

The keyboard always asks first and only sends you to Settings once Android has refused on its own, because nothing it can check beforehand tells those two cases apart. That's what keeps **Ask every time** working. Set the camera or the microphone to it in Android's settings, and the grant button on the camera or voice panel brings up the system prompt with its **Only this time** choice. Android takes that grant back soon after you stop using the keyboard, and the panel asks again next time. This is standard Android 11 behaviour, so custom ROMs built on it work the same way.

## The ones that aren't permissions

Notification access, usage access, display over other apps, all files access, the accessibility service and the two clock grants aren't permissions Android will prompt for. Each is a switch on a system Settings screen, and all the app can do is take you there. The keyboard shows the same kind of explanation first, for the same reason. All of them stay off until you turn them on yourself.

The system screens for all of them carry broad, alarming warnings, because the *categories* are powerful. What this app uses is much narrower:

| Access | Feature | What the keyboard uses it for |
|---|---|---|
| Notification access | [Media controls](https://wmkeyboard.pages.dev/tools/media/) and the [one-time code chip](https://wmkeyboard.pages.dev/smart/one-time-codes/) | Android only hands the play/pause/skip controls of the current media session to apps holding this. For media the listener reads nothing at all: no notification, title, sender or content. It exists purely so the platform will surface the session. The code chip is the one thing that ever reads notification text, only while you've turned it on, and only to find a verification code. Nothing is stored and nothing leaves the phone either way. |
| Display over other apps | The [floating button](https://wmkeyboard.pages.dev/reference/settings/floating-button/), [tools in a floating box](https://wmkeyboard.pages.dev/tools/overview/#tools-in-a-floating-box), and the app launcher's [emulated window](https://wmkeyboard.pages.dev/tools/app-launcher/#emulated-window-experimental) | Draws that small round button over other apps, with its quick menu and the cross you drop it on to hide it, and the box a tool floats in. It opens and closes the keyboard, asks the AI or opens a tool, whatever you set it to. If you pick the app launcher's experimental emulated window, it also draws that window, with the app you opened in it. Those are the only windows it draws, and the permission itself can't see or read anything on screen. |
| All files access | The [file manager](https://wmkeyboard.pages.dev/tools/files/), Android 11 and later. Not in the Play Store build, which doesn't declare it | Lets the keyboard browse shared storage, so a tool can pick a file without leaving the app you are in. The grant itself covers every file there; Android has no narrower one for browsing. The keyboard reads only the folders you open and the names you search for, and changes a file only when you rename, move, copy or delete it in the file manager. No file leaves the phone unless you send it with a tool. Refuse it and picking a file opens Android's picker. |
| Alarms and reminders | [Clock](https://wmkeyboard.pages.dev/tools/clock/) alarms and timers, Android 12 and later | Lets an alarm ring at the exact minute. Without it, Android may hold an alarm back by some minutes while the phone sleeps; it still rings. Nothing is read. |
| Full-screen notifications | The [Clock](https://wmkeyboard.pages.dev/tools/clock/) ring screen, Android 14 and later. Not in the Play Store build, which doesn't declare it | Lets a ringing alarm or timer put its screen, with Snooze and Dismiss, over the lock screen. Without it, the ring shows as a notification. Used only while one of your alarms rings. |
| Usage access | "Show source app" on clipboard entries | Reads which app was in front at the moment you copied something, so the clip can show where it came from. Not your history, not time spent anywhere. Kept with the clip, on this device. |
| Accessibility service | Keyboard gestures under a screen reader | Marks the key grid as bypassing TalkBack's touch handling, which is the only way an app can keep its own gestures there. It subscribes to no accessibility events, can't read window content, and covers nothing outside the keys. See [Screen readers](https://wmkeyboard.pages.dev/reference/settings/accessibility/). The Play Store build doesn't contain the service, so there it's one fewer. |
| Accessibility service | Screen reading for the [floating button](https://wmkeyboard.pages.dev/reference/settings/floating-button/#asking-the-ai-about-the-screen)'s **Ask AI about this screen** and **Look up a word** | A second, separate service. Each time Ask AI runs it reads the text of the app on screen once and puts it in the chat that opens, where you see it before anything is sent. Each time you tap a word for Look up, it reads the piece of text under your finger once, with where its letters are, and looks the word up. It reads nothing at any other time, skips password fields, performs no actions and keeps nothing. Where the chat goes depends on the AI provider you picked. Not in the Play Store build. |
| Accessibility service | The [Screenshot](https://wmkeyboard.pages.dev/tools/instruments/#screenshot) tool (Android 9 and later), and the floating button's [system buttons](https://wmkeyboard.pages.dev/reference/settings/floating-button/#system-buttons): Back, Recent apps, App drawer (Android 12 and later), Notifications and Quick settings | A third, separate service, **WM Keyboard system buttons**. Android lets another app press its own system buttons only this way. Each time you press the tool or one of those actions, it presses that one button, and nothing else: a screenshot is saved as any screenshot is, and Back or the shade does what it would from Android's own navigation. It reads nothing on screen, subscribes to no events and keeps nothing. Not in the Play Store build. |

All of them are revoked the same way they were granted, from the relevant system Settings screen, and the features fall back cleanly: media controls show their "needs access" panel, clips are saved with no source app, the floating button stops appearing, its Ask AI chat opens without the screen's text, and the gestures mode behaves like Explore by touch.

## Options

Privacy / Permissions

The app has a permissions screen of its own, at the top of **Privacy**. It's an inventory rather than a funnel. Every permission that does something you can turn on or off appears there in three groups: the ones Android prompts for, the special-access grants, and the four install-time ones the app declares for itself. Each row shows **Granted**, **Not granted** or **Automatic** on the right. What the screen leaves out is the handful of manifest entries with no control behind them, listed under [Details & edge cases](#details--edge-cases) below.

Tap a row you haven't granted and you get the same explanation-then-prompt flow the feature itself would run, so this is the one place you can grant something ahead of the feature that wants it. Tap a row that's already granted and the app's own page in Android's Settings opens, because that's the only place a grant can be taken back. Field by field, it's on [Permissions settings](https://wmkeyboard.pages.dev/reference/settings/permissions/).

Nothing stops you going to Android's page directly instead: **Settings → Apps → WM Keyboard → Permissions**. Notification access, usage access, display over other apps and accessibility each sit on their own system screen rather than in that list, which is why the in-app screen keeps them in a group of their own.

## Details & edge cases

- **Revoking a permission never breaks the keyboard.** Every feature behind one is optional and checks at the moment it's used. A revoked permission turns that one panel back into its "needs permission" state and leaves everything else alone. Typing is never affected.
- **Two dictionary permissions are declared but do nothing on any current phone.** The app lists `READ_USER_DICTIONARY` and `WRITE_USER_DICTIONARY` for the "Add words to the system dictionary" setting described on [Your data on device](https://wmkeyboard.pages.dev/privacy/data/#options). Since Android 6, the system grants the *active* keyboard access to that provider without a permission, so these are inert on anything modern and only matter on much older releases.
- **Reading your SIM's country isn't a permission either.** The **Suggested for you** group on the Languages screens asks Android for the SIM's and the network's country code (`getSimCountryIso` and `getNetworkCountryIso`), which any app may do without asking, alongside your phone's system language list. Both are used only to order that list, both are read on the spot rather than stored, and neither leaves the device. Nothing else about the SIM is touched, not the number, the carrier account, the IMEI or anything else identifying. A phone with no SIM falls back to the region on its locale. See [Suggested languages](https://wmkeyboard.pages.dev/languages/overview/#suggested-languages).
- **Listing your installed apps isn't a permission.** The keyboard-mode editor can bind a mode to specific apps, and app names can be offered as suggestions. Both need to see the list of launcher activities. Android 11 and later hide that list unless an app declares which kinds of apps it wants to see, which this app does narrowly: launcher activities, mail apps for the bug-report row, and two entries naming Google Play services itself (the `com.google.android.gms` package and its `com.google.android.gms.fonts` provider) so the document scanner and the downloadable Noto fonts can be left out cleanly on a phone that has no Play services. It doesn't use the blanket "query all packages" permission.
- **The camera permission covers the scanners, but the document scanner asks on its own screen.** OCR and QR scanning run in a keyboard panel and use the permission above. Document scanning hands off to a full-screen scanner: Google's, supplied by Google Play services, which manages its own camera access, or the keyboard's built-in one, which asks for the same camera permission on its own screen. Either returns the pages when it's done.
- **Nothing here is asked for on behalf of an analytics or ad SDK.** No permission on this page is requested by an analytics library or an ad network, because the app contains none. The only permissions a third-party library contributes at all are the three install-time ones described above, which arrive in every build but F-Droid's from androidx.work as a transitive dependency of ML Kit. See [Privacy at a glance](https://wmkeyboard.pages.dev/privacy/overview/) for what that claim rests on and how to check it yourself.