You install an expense tracker, and the first thing it asks for is permission to read all your SMS, or your net banking login. It promises to “track everything automatically”. It sounds convenient. But is it a good idea to hand over that much access just to see where your money goes?
You do not need to. Here is what these permissions actually mean, and what the alternative looks like.
How apps usually track automatically
By reading your SMS
Your bank texts you after every transaction. Some apps ask permission to read your SMS inbox, pick out the bank messages and turn them into entries. To do that, the app is given access to your whole inbox: OTPs, personal chats, delivery updates, everything. Even if the app only uses the bank messages, you are trusting it with all the rest.
By linking your bank account
Others connect to your bank through a third party and pull your transactions in. This can be done safely, but it means another company holds a connection to your accounts. You should understand exactly who that is and what they can see.
The real risks
- Sensitive data in one place. The more an app can see, the more is exposed if it is ever breached or misused.
- OTP exposure. An app that can read your SMS can also read the one-time passwords your bank sends. A trustworthy app ignores them, but you have no easy way to check that.
- Wrong sorting. A text that says “Paid ₹250 to MERCHANT123” does not say whether it was dinner or a gift. Automatic apps guess, and a record that is full of guesses is hard to trust.
- Missing cash. Cash payments never show up in an SMS, so automatic tracking misses part of your spending.
A safer rule of thumb
Before you give any app access to something, ask three questions:
- Does it truly need this to do its job?
- Is there a way to do the same job with less access?
- What would happen if this data leaked?
For an expense tracker, the answers are usually: no, yes (type it yourself), and “a lot, since it shows my whole financial life”.
The alternative: note it yourself
Logging a spend by hand takes a few seconds if the tool is quick. In exchange you get a record that is yours: you choose the category, you name the person, and cash is included. And because you never hand over a bank login or message access, there is nothing sensitive for the app to lose.
What HisaabRakho does, and does not do
We built HisaabRakho on this idea, so here is exactly what it does and does not do:
- It never asks for your bank login, card details or passwords.
- It never reads your SMS or notifications.
- It never moves money. When you pay, the payment happens inside your own UPI app.
- You sign in with a six-digit code sent to your email. There is no password to leak, and we store the code and the sign-in session only as hashed values.
- The camera is used only if you tap Scan, to read a UPI QR code on your own device.
The full list of what we store, and why, is on the privacy page. If you want to see how paying works with this approach, read how to track your UPI spending in one place.