# Expense Tracker Without SMS Permission

Almost every expense tracker in India opens with the same request: let us read your messages. Spenco AI never asks. It reads bank alert emails that you forward to it — nothing else, and nothing you have not explicitly sent.

Start free at https://app.spenco.ai · Android app: https://play.google.com/store/apps/details?id=com.spencoai.spenco

## Why Indian expense trackers ask for your SMS inbox

Indian banks have sent transaction alerts by SMS for two decades. Every UPI payment, card swipe, EMI debit and salary credit arrives as a text within seconds. For an app that wants to catch all of it with zero setup, reading the SMS inbox is the obvious shortcut — which is why it became the default for Indian trackers and most have copied it since.

The problem is that SMS permission is not granular. Android has no way to grant an app access to bank messages only. Approving it hands over the whole inbox: one-time passwords, account numbers, delivery codes, personal messages, and every other text on the device.

That trust matters more when the app is free. A tracker with no subscription has to earn revenue somewhere, and a detailed picture of your income, obligations and spending is exactly what lenders and advertisers pay for.

## What Spenco AI reads instead: bank alert emails you forward

Indian banks send the same alerts by email as they do by SMS. That opens a route with a property SMS does not have: you choose what gets sent. A forwarding rule is a filter you write and control, not a permission you hand over.

The direction of access is the whole point. An inbox integration pulls — it logs in and reads whatever it can reach. Forwarding pushes: your mail provider sends copies of matching messages outward, and the receiving side gains no ability to look back at anything else. Spenco AI has no token for your mailbox, cannot search it, and cannot see a single message your filter did not match.

## Every permission the Android app requests

Four, in total. Three are Android "normal" permissions, granted at install with no dialog — they cannot read your data. Only the microphone is a runtime permission that asks, and only when you first tap the mic.

| Permission | Why | Prompted? |
| --- | --- | --- |
| Internet | Sync your transactions with your account | Granted at install, no prompt |
| Vibrate | Haptic feedback on actions | Granted at install, no prompt |
| Biometric | Optional app lock — only if you turn it on in settings | Granted at install, no prompt |
| Microphone | Optional — dictate a question to the AI chat instead of typing | Asked the first time you use it |

Not requested, and absent from the app manifest entirely: Read SMS, Receive SMS, Contacts, Location, Call log, Photo and media library, Draw over other apps.

Attaching a photo of a bill to a transaction uses the Android Photo Picker, which hands the app one image you selected and needs no media-library permission at all.

## Setting up the forwarding rule

1. **Sign up and get your forwarding address.** Create an account at https://app.spenco.ai. You get a private address that only accepts forwarded mail — it is not published anywhere and is unique to you.
2. **Create one filter in Gmail or Outlook.** Filter on your bank's alert sender — the address your debit notifications already arrive from — and set the action to forward to your Spenco AI address. One rule per bank, roughly thirty seconds each.
3. **Alerts become transactions on arrival.** Every alert your bank sends is parsed the moment it lands: merchant, amount, date and category. Nothing is retroactive — only mail your filter forwards from that point on.
4. **Revoke whenever you like.** Delete the filter and forwarding stops instantly. There is no token to revoke on our side and no session to end, because there was never a connection to your mailbox.

## Banks parsed automatically

HDFC, ICICI, Axis, Kotak Mahindra, Canara Bank, Punjab National Bank and Bank of Baroda. Because the parser works on the alert format rather than a bank integration, a card or account at any of these is picked up the moment its alerts start arriving — including UPI payments, which reach your bank as ordinary debits whichever app initiated them.

## What you give up, honestly

Two minutes of setup, against zero for an SMS tracker. That is a real cost and worth naming.

And if a bank alerts you by SMS but not email, those transactions will not appear automatically. Most Indian banks send both, and email alerts can usually be switched on in net banking, but check yours before switching. You can always add a transaction by hand, or upload a statement PDF to backfill history in bulk.

## Common questions

**Is there an expense tracker that works without SMS permission?**
Yes. Spenco AI tracks spending from bank alert emails you forward, so it never requests READ_SMS or RECEIVE_SMS. The Android app requests four permissions in total — internet, vibrate, and optionally microphone and biometric unlock — and none of them can read your messages.

**Why do Indian expense trackers ask for SMS access?**
Indian banks send transaction alerts by SMS, so reading the SMS inbox is the quickest way to catch every debit. The cost is that SMS permission is all-or-nothing: granting it exposes every message on the device, including OTPs, account numbers, and messages that have nothing to do with money.

**How does email forwarding track expenses instead?**
Indian banks send the same transaction alerts by email. You create one filter in Gmail or Outlook that forwards only those bank alerts to your private Spenco AI address. Each forwarded alert is parsed into a transaction — merchant, amount, date, category. Spenco AI can only ever see what your filter forwards.

**Can Spenco AI read the rest of my inbox?**
No. There is no inbox connection and no OAuth grant to your mail account. Forwarding pushes copies of matching emails outward to us; it gives no ability to read anything else, search your mail, or look at history. Delete the filter and the flow stops immediately.

**Does it need my bank login or net banking password?**
Never. Spenco AI does not connect to bank accounts, store credentials, or use account-aggregator access. It reads alert emails you already receive, which means it can see that a transaction happened but can never move money.

**What is the catch with a no-SMS tracker?**
Setup takes about two minutes instead of zero — you have to create the forwarding rule once. And if your bank only alerts by SMS and not email, those transactions will not be captured automatically; you can add them manually or upload a statement PDF to backfill.

## Related

- Security and data handling: https://spenco.ai/security
- AI expense tracker for India: https://spenco.ai/ai-expense-tracker-india
- Month-end balance prediction: https://spenco.ai/month-end-balance-prediction