GhostSubsReceipt-scanning tools ask for something that reasonably gives people pause: access to your inbox. Whether that's safe depends on specifics you can actually verify — the scope requested, what's stored, and who else sees the data.
Here's how to evaluate any app that asks, including ours.
What read-only access can and can't do
Google's gmail.readonly scope permits reading messages — and nothing else. An app holding it cannot send email as you, delete or modify messages, or touch your password. Access appears in your Google Account's third-party permissions page, where you can revoke it in one click at any time, immediately.
Google also gates this scope: apps requesting Gmail scopes for production use undergo Google's verification and, for sensitive scopes, security review. That's not a guarantee of good behavior, but it filters the field.
The questions that matter
What's stored? The good answer is extracted data only — service names, amounts, dates — not email bodies. Where does AI processing happen and is your data used for training? Look for processing that's confined to identification. Is data sold or shared? Read the privacy policy's sharing section specifically. Can you delete everything? There should be a stated path.
GhostSubs' answers, for the record: read-only scope only; stores extracted subscription details and message IDs (so you can open your own receipts), never full email bodies; email content goes to an AI model solely to identify subscription details; nothing is sold; access is revocable from your Google account instantly.
Compared to bank linking
Bank-linked trackers see every transaction you make — income, rent, medical payments, everything — forever, via credentials or tokens to your actual bank. Email scanning sees receipt-shaped messages in one inbox. Both require trust; the email version simply has a much smaller blast radius, and revocation is self-serve rather than dependent on the aggregator.
Frequently asked questions
Can a read-only app send or delete my email?
No — the gmail.readonly scope technically cannot send, modify, or delete anything. Those are separate permissions an app would have to request explicitly.
How do I revoke an app's access to my Gmail?
Google Account → Security → Third-party access (myaccount.google.com/permissions) → select the app → Remove access. It takes effect immediately.
Is email scanning safer than linking my bank?
The exposure is narrower: receipts in one inbox versus your entire transaction history. Judge any specific app by its scope, storage policy, and revocability — those three tell you nearly everything.