Every time you type a message on your smartphone, your keyboard learns a little more about you. It notices your favourite words, your common misspellings, the names of people you text most often. For years, this intimate knowledge was hoovered up and shipped to distant servers, where tech giants analysed your linguistic fingerprints alongside billions of others. Then, around 2017, something changed. Google began training its Gboard keyboard using a technique called federated learning, promising that your typing data would never leave your device. The raw text of your most private messages, they assured users, would stay exactly where it belonged: on your phone. It sounds like a privacy advocate's dream. But beneath this reassuring narrative lies a more complicated reality, one where mathematical guarantees collide with practical vulnerabilities, where corporate interests shape the definition of “privacy,” and where the gap between what users understand and what actually happens grows wider by the day.…