There is no official statement of Google about this but there is a generic Android warning saying "This method can collect all of the text that you enter except passwords including personal data and credit card numbers.". I wonder why Google doesn't explicitly say what they are doing. I don't want to distribute FUD but this is a critical component.