Last updated: August 16, 2026
App Provider: XYZTech
Contact: XYZKeyboard Support

This disclosure explains how the optional AI features in XYZKeyboard (玲珑键盘) work and what may be sent when you enable them. It supplements the XYZKeyboard Privacy Policy, the Terms of Service, and the End User License Agreement.

1. AI Is Optional

Basic full-pinyin input, nine-key input, local candidates, symbols, emoji, personal lexicons, and offline dictionary lookup do not require AI or a network connection. If AI is disabled, unavailable, unauthorized, or times out, XYZKeyboard falls back to local candidates.

2. When a Request May Be Sent

XYZKeyboard may send an AI request only when all applicable gates are satisfied:

  1. you have enabled AI candidate features;
  2. you have configured a valid provider, endpoint, model, and any required credential;
  3. you have expressly accepted the data-sharing disclosure for the current provider, endpoint, model, context limit, and disclosure version;
  4. the keyboard has the system permission needed for network AI, including Full Access where required by iOS; and
  5. the local candidate strategy determines that an AI request is needed.

Changing the provider, endpoint, model, or context limit invalidates the prior consent for that configuration. Choosing “Not Now” or disabling AI closes the network path for new AI requests.

3. Possible Recipients

You choose the recipient. XYZKeyboard can be configured for local services such as LM Studio or Ollama, supported cloud providers, or a custom OpenAI-compatible endpoint. Available presets may change over time and may include DeepSeek, Qwen, Kimi, Zhipu GLM, Tencent Hunyuan, Doubao, MiniMax, SiliconFlow, OpenAI, Google Gemini, OpenRouter, xAI, Mistral AI, Groq, Together AI, Perplexity, and Cohere.

The actual recipient is the endpoint and provider shown in the in-app disclosure at the time of authorization. XYZTech does not operate a server that proxies, relays, or stores these AI requests.

4. Data That May Be Sent

Depending on the feature and the current input state, a request may contain:

  • the current full-pinyin letters or nine-key digits being composed, normalized to letters or digits and limited by the App;
  • whether the current input is full pinyin or nine-key input;
  • for nine-key correction, the current nine-key code and a request for possible pinyin interpretations;
  • up to 24 characters immediately before the cursor as limited context, after whitespace and control-character minimization; and
  • a small output limit used to request short candidate words, phrases, or pinyin alternatives.

The request is intended to generate keyboard candidates. It is not intended to send the entire document, the entire conversation, your contacts, or your personal dictionary. However, the text you are typing or the 24-character context may itself contain sensitive information. Do not enable a third-party AI provider for content you are not willing to share with that provider.

The API key, when one is required, is sent to the configured endpoint for authentication. XYZKeyboard stores it in the Apple Keychain and does not place it in ordinary preferences, personal-lexicon exports, or application logs.

5. Direct Transmission and Provider Terms

Requests go directly from the App to the endpoint you configure. The selected provider may process, retain, log, use, or disclose request content and response content under its own terms and privacy policy. The provider may also charge usage fees, impose rate limits, transfer data across borders, or use subcontractors.

Before enabling a cloud provider, review that provider’s current privacy policy, service terms, data-retention controls, model-training settings, pricing, and age requirements. XYZTech cannot control or delete data that a provider has already received.

6. Local AI Services

LM Studio and Ollama can be configured as local or private-network endpoints. HTTP is accepted only for localhost, loopback, .local, or supported private-network addresses; other remote endpoints must use HTTPS. A local endpoint may still be accessible to other software or devices on your network, so protect your network and configure the local service appropriately.

7. Responses and Accuracy

AI responses are parsed and filtered as candidate text, but filtering cannot guarantee accuracy, safety, legality, or suitability. AI may return incorrect spellings, unintended words, biased or offensive text, or content that does not match your intent. Review a candidate before submitting it, especially when the text concerns health, legal, financial, employment, identity, or other high-impact matters.

AI candidates are suggestions only. XYZKeyboard does not provide medical, legal, financial, educational, employment, or other professional advice through this feature.

8. Local Usage Statistics and Caching

XYZKeyboard keeps AI request counts, cache hits, local skips, prompt-token counts, and completion-token counts in local App Group storage so the host App can display usage for today, this month, this year, and all time. If a provider does not return token usage, the App may show a local estimate. These figures are not the provider’s invoice and are not sent to XYZTech.

The App may keep a short-lived in-memory cache of candidate responses to avoid duplicate requests. This cache is not intended as permanent storage and is cleared when it expires or when the relevant process is removed.

9. Your Controls

You can:

  • refuse the disclosure or choose “Not Now”;
  • disable AI in the host App;
  • revoke consent when changing or saving an AI configuration;
  • clear the API key in AI settings; and
  • continue using local input without AI.

Disabling AI prevents new AI requests, but it cannot retract content already received by a third-party provider. Manage provider-side deletion or retention using that provider’s controls.

10. Contact

For questions about this disclosure or an observed XYZKeyboard data flow, contact XYZKeyboard Support. Do not post API keys, passwords, or private input text in an issue.