I'm not sure how this keyboard could work any other way - the whole value prop is that you can search from the keyboard, and it would be pretty hard to send your search queries to google if it couldn't send the things you type to google.
the app store description is pretty clear on what it actually sends to google, and it's actually less than what most keyboards send - swype, the standard google keyboard on android, and i think most others send everything up to their respective servers so they can sync personalized predictions across devices, this keyboard only sends the queries that you explicitly ask google to search for.
That seems antithetical to the Apple statement about "This could include sensitive information such as your credit card number or street address."
Anyway to confirm the only keystroke that google can access are the ones submitted to its search query?
Apple only has one permission level for keyboards that send stuff over the network: full permission. There's no way to determine what exactly they send using apple's keyboard permissions API, and apple doesn't know what they send. They just know it's a keyboard that can send anything you type over the network, and warn you accordingly.
You have to either trust that google isn't flat-out lying, or try to MITM and analyze the traffic using something like wireshark, which would be difficult assuming it's properly encrypted.
the app store description is pretty clear on what it actually sends to google, and it's actually less than what most keyboards send - swype, the standard google keyboard on android, and i think most others send everything up to their respective servers so they can sync personalized predictions across devices, this keyboard only sends the queries that you explicitly ask google to search for.