‘Read-only Gmail access’ — what an expense tracker can and can’t see

Your bank emails you every time money moves — "₹450 debited," "UPI payment successful," "salary credited." Those alerts are a clean, structured record of your spending that's already sitting in your inbox. An expense tracker that can read them can save you a lot of typing.

But "connect your Gmail" is a request that deserves a straight answer about what it grants. Here's the whole picture.

OAuth scopes, in plain terms

When you connect a Google account to an app, you're not giving it your password. You're granting a scope — a specific, named permission — through Google's own consent screen, and Google issues the app a token that only works for that scope.

For Gmail, the scopes are very different in power:

• gmail.readonly — the app can read messages. It cannot send, reply, delete, mark as read, change labels, or modify anything. Read, and nothing else.
• gmail.modify — read and change (labels, read status, trash).
• gmail.send — send mail as you.
• https://mail.google.com/ — full access, including permanent deletion.

TheMoneyMitra requests gmail.readonly only. On the consent screen it shows up as "View your email messages and settings." There is no version of the connection that can send or delete anything, because that permission is never requested.

Read-only still means it can read everything — so what does it actually read?

This is the fair objection. gmail.readonly technically lets an app read your whole mailbox. The protection isn't the scope alone; it's what the app does with it.

TheMoneyMitra runs a filtered search, not a full scan. It queries Gmail for messages from a known list of Indian bank and payment senders — the domains that send transaction alerts — and only processes those. Your personal threads, work email, newsletters, and everything else are never fetched, because the query never asks for them.

From each matching alert it extracts four things: amount, merchant, date, and reference number. Those become a transaction in your ledger. The email body isn't stored after that.

Two things worth knowing about the trade-off here: a filtered search is only as good as the sender list, so a bank whose alert domain we haven't added yet just won't be picked up (you can still import that bank via CSV). And "we only query bank senders" is a property of how the app is written — gmail.readonly is what makes it possible to be narrow, not a guarantee on its own. That's why the next two points matter.

You press "sync." It doesn't run on its own.

The connection doesn't poll your inbox in the background. Each sync happens because you opened the app and asked for one (or scheduled a daily batch that you set up and can turn off). Between syncs, nothing is reading anything.

The token lives encrypted, and you hold the off switch

The access token Google issues is stored encrypted, and it's the only Gmail-related thing kept server-side.

You can cut it off two ways, and both are instant:

• In the app: disconnect Gmail in settings. The token is revoked and deleted.
• In your Google account: go to myaccount.google.com/permissions, find TheMoneyMitra, and click Remove access. This works even if you've deleted the app.

Revoking doesn't touch the transactions already imported — those are yours and stay in your ledger. It just stops any future reads.

Google reviews apps that ask for this

gmail.readonly is what Google classifies as a restricted scope. Apps that use it have to pass a security assessment and a review of exactly why they need the access and what they do with the data, and they're bound by Google's API Services User Data Policy — including the "limited use" rules that prohibit using the data for advertising or selling it. It's not a scope an app can just switch on quietly.

If you'd still rather not

Gmail import is one of four ways to get data into TheMoneyMitra, and it's entirely optional. If connecting your inbox isn't for you, a bank statement CSV gets you the same month of transactions with nothing connected at all — plus manual entry and receipt scanning for the gaps.

TheMoneyMitra is in private beta on iOS and Android. Leave your email for a launch invite — one message, when it's live.