Not OP, but i could see hypothetically laws that prevent recording user data unknowingly. The same logic could say that just because i'm running your process does not mean you can monitor all my other processes/keystrokes/network-traffic/etc; could be used (hypothetically!) to say that if it's not obvious the user has submitted data, that you can't record it.

Obviously it gets into the weeds, but where does it stop? Clearly there's some boundaries. If i have an app actively open/selected, what does it have access to?

I could see an argument where if the user didn't think they were sending it, then the user has not acknowledged to transferring "ownership" of data. As nebulous as ownership is in this context, i'm simplifying.

I'm not making any statement here. Just posing a hypothetical to attempt to illustrate where privacy arguments could be made.

That is so wrong. In cases where long input is required, I, for some reason, have a habit of writing things down in plain text editor, and then copying that to forms. Did not know that I need to make this a required step.