Why Stash reads the email body
Banks often put the amount, currency, merchant, date and relevant card or account details in the body of a message. Metadata-only access cannot reliably provide those fields, so Stash requests the gmail.readonly scope through Google OAuth.
Read-only means no mailbox changes
Stash cannot send, modify, delete or move emails, change read status, or change Gmail settings. Google handles authentication directly; Stash does not receive your Google password.
Local processing and review
Eligible email content is fetched directly to the Android app and processed on the device. Stash does not upload message contents to a Stash-operated backend. Recognized transactions can be reviewed, edited or deleted, and Gmail access can be disconnected or revoked.
Full Gmail disclosure
Read the dedicated Gmail Access explanation for the permission scope, data use, user controls and Google API Limited Use commitment.
Common questions
- Is Gmail connection required?
- No. Stash can be used without connecting Gmail.
- Does Stash get my Google password?
- No. Google OAuth handles authentication directly.
- Can Stash send or delete email?
- No. The gmail.readonly permission does not allow those actions.