Most subscription trackers ask you to sign in with Google before they'll scan your inbox. BillSensor doesn't ask, because it doesn't need to. Here's exactly what happens instead, and what that means for your data.
Connecting an email account to a third-party tool means handing over a permission screen. You've seen it before: "This app wants to read, compose, send, and permanently delete emails in your Gmail account." Most people click through it without reading, because there's usually no other option if they want the tool to work.
BillSensor's Gmail detection skips that screen entirely. Not a scaled-down version of it, not a shorter list of permissions. There is no OAuth request, no Google sign-in, and nothing to grant or revoke, because BillSensor never asks Google for access to your inbox in the first place.
BillSensor's Gmail detection runs as a content script, a small piece of code that only activates while you're already looking at a Gmail tab in your own browser. It never contacts Gmail's servers directly and never uses Google's Gmail API.
BillSensor does nothing until you're already browsing your own inbox in your own browser tab.
The moment you click into an email, BillSensor's content script reads the page content that's already rendered in your browser, the same content your eyes are looking at.
BillSensor matches what it sees against a list of 61 known SaaS billing senders, stored locally in the extension. This check happens entirely on your device.
Tool name, amount, and next charge date are extracted and saved to your browser's local storage. Nothing is sent anywhere unless you choose to create an account for email alerts.
This runs on a local schedule inside your browser using Chrome's alarms API, no server round-trip required.
Gmail's web interface renders your emails as regular web page content. A content script can read that rendered content the same way any browser extension can read what's on a page you're already viewing. It's a fundamentally different mechanism from an API request, which requires an explicit access token and a direct line to Google's servers.
No sign-in screen. No permission list to read through. No access token sitting in a database somewhere that could later be leaked, misused, or forgotten about after you stop using the tool. There's nothing to revoke later because nothing was ever granted.
This also means BillSensor's Gmail detection cannot send, delete, forward, or modify a single email. Not because a setting is turned off, but because the mechanism it uses has no capability to do any of that in the first place. Reading rendered page content is a one-way street.
This is the part most privacy pages gloss over. Here's the honest, specific answer for BillSensor.
The only thing that ever reaches BillSensor's servers is the parsed subscription metadata, and only for users who create a free account to receive email alerts. Even then, it's the tool name and the renewal date, never the email itself.
If Gmail detection needs no OAuth, a fair question is why Outlook does. The honest answer: Microsoft's web interface doesn't expose a full 12-month email history the way an open Gmail tab does in the moment. To offer the same one-time historical scan for Outlook and Microsoft 365 users, BillSensor connects through Microsoft's own Graph API using a read-only scope called Mail.Read.
That connection still can't send, delete, or modify anything in your inbox. It's the same standard, minimal-permission consent screen you'd see connecting any calendar or scheduling tool to Outlook, not a broad "full access" grant. The difference from Gmail is the mechanism, not the privacy standard.
Tools that offer automatic detection across your whole inbox typically need OAuth access to Gmail as well as Outlook, since that's the standard way to get programmatic, ongoing access to an inbox. BillSensor's passive approach avoids that requirement for Gmail specifically, which is the one place most people are more hesitant to connect a third-party app.
Install BillSensor and open a billing email in Gmail. No sign-in, no permission screen, no setup. You'll see the detection happen in real time.
Add BillSensor to Chrome, free →No Gmail account connection required. Outlook and Microsoft 365 supported.
No. BillSensor never asks for your Gmail login at all. There's no sign-in screen tied to Gmail detection, so there's no password to see, store, or mishandle.
No. The content script that reads billing emails only has the ability to read what's already rendered on the page. It has no mechanism to send, delete, forward, or edit anything in Gmail.
Nothing gets detected until you do. BillSensor doesn't scan your inbox in the background for Gmail, it only checks emails at the moment you open them yourself. You can also add a subscription manually if you'd rather not wait for the email to be detected.
It uses a different mechanism, a read-only Microsoft Graph API connection instead of a passive content script, but the privacy standard is the same. The Outlook connection is strictly read-only and cannot send, delete, or modify anything. Email body content is never stored, only the subscription name, amount, and renewal date.
For Gmail, there's nothing to revoke since no access was ever granted. Uninstalling the extension stops detection immediately. For Outlook, you can revoke the read-only connection at any time from your Microsoft account's app permissions page, the same way you'd remove access for any other connected app.