Reading your Gmail without uploading it

Billio tracks subscriptions, and the fastest way to fill it is to read the receipts already sitting in your inbox. That means asking for access to Gmail, which is a serious thing to ask for. So the first design decision was where the reading happens.

The scan runs in your browser

When you tap Connect Gmail, Google shows its own approval screen and gives your browser a short-lived token for read-only access. Billio uses that token to search your mail, reads the results on your device, and shows you a list. The token is not stored. Nothing from your inbox is sent to my server or saved in my database.

There is a second reason I chose this. As I understand Google's rules, an app that keeps data from a restricted scope like Gmail read access on its own servers has to pass an annual third-party security assessment. Keeping the scan on the device means Billio never holds that data, and it is a better privacy story anyway.

Reading less, and reading it carefully

Gmail limits how fast an app can read messages. My first version fetched the full email for every search result and hit the per-minute quota quickly. Now Billio fetches only the sender and subject first, and opens the full message only when it needs an amount or a renewal date. It makes five requests at a time and backs off when Google says to slow down.

What counts as a subscription

• Known services, like Netflix or Spotify, are matched by name.
• Unknown senders are listed only if the email mentions renewal or a subscription, shows a next billing date, or shows up at least twice.
• Order, delivery and promo emails are dropped.
• Past billing dates are rolled forward to the next one that has not happened yet.

It is rule-based, so it can miss things. Amounts that sit only inside a PDF attachment are not read yet, and Billio asks you to type them. You can also mark something as not a subscription, and it remembers.