Gboard uses differential privacy.
I'm mistrustful of Google's privacy stance, since they have a history of changing their privacy policy, then misleading users about it. Remember when they implemented personally-identifiable web tracking and sold it to users as "new features for your Google account"? Merging Doubleclick's tracking data with my Google account doesn't seem like a feature to me.
[0]: https://venturebeat.com/2017/04/06/following-apple-google-te...
[1]: https://www.propublica.org/article/google-has-quietly-droppe...