Email access and security
What connecting Gmail allows.
What permission is requested?
Signing in with Google asks only for your name and email address. It does not request any access to your mail and it does not scan anything.
Connecting a Gmail inbox is a separate, optional step. It asks Google for the gmail.readonly permission. That permission is read-only, and it is broader than receipts alone: it lets an application read any message in the mailbox. Google's consent screen says so, and so do we.
What does the scan do?
- Searches the mailbox for receipts and trial notices within a time window you choose, in bounded batches.
- Reads the sender, subject, date and text of each matching message to extract the vendor, dates and price. The text is used for that extraction and then discarded; it is not written to our database.
- Lists what it found as suggestions. Nothing is added to your tracker until you open a suggestion, check it and add it.
- Never sends, modifies, labels or deletes mail. The permission does not allow it, and the code does not try.
What information is stored?
- The mailbox address, so the tracker can say which account a subscription came from.
- An encrypted refresh token, so a later scan does not need you to consent again.
- For each suggestion: the sending domain, the subject line, the date, Google's message identifier, and the details extracted from it (vendor, dates, price, billing period). We store these while you review them, and you choose which suggestions to add to your tracker.
- A suggestion you add stays linked to the subscription it created. A suggestion you dismiss moves to an archive of dismissed suggestions until you delete it from there, so it is not offered again.
- Not stored: message bodies, snippets, attachments, full sender addresses, or anything from messages the scan did not match.
What happens when I disconnect?
Disconnect from Settings › Inboxes at any time. TrackSignUp deletes the stored token and every suggestion found in that mailbox, including dismissed ones, and then asks Google to revoke the grant. If Google does not confirm the revocation, the page tells you so you can finish it under “Third-party apps” in your Google account.
What remains in my tracker?
Everything you added. Subscriptions imported from the mailbox stay on your tracker with their reminders, and the mailbox address stays on your account so the tracker can still say where a subscription came from.
Plans
One connected inbox is included free. Connecting a second, different Gmail inbox is part of Solo Founder. Reconnecting the inbox you already connected is not a new inbox.