What does read-only actually prevent?

With a read-only mail scope the tool can list and read messages but cannot send as you, delete or archive anything, or change labels. Anything that appears in your mailbox afterwards is not something the scanner did — which is also how you test whether a vendor is telling the truth about its own scope.

Is the read-only scope the important privacy question?

It is the first question, not the last. A read-only scan still reads your mail, so the one that decides your exposure is what the vendor keeps afterwards: the whole body of every message, or just the extracted fields for each subscription. Ask which, for how long, and whether you can delete it.

What can an inbox scan structurally miss?

Anything that does not bill to that address: subscriptions on a personal card, app-store billing, charges on a second mailbox, and trials that converted without sending a receipt. The statement diff exists because a mailbox is one source, not the whole picture.

How do you revoke a scan tool?

Revoke the OAuth grant at the mail provider, not only inside the tool. The provider-side revocation kills the token, which is the thing that has access; deleting an account in the tool only removes what it stored.

SaaSClerk Blog · Read-only subscription scanning

Is There a Read-Only Tool That Lists Subscriptions From My Inbox?

Short answer: yes, and the category is worth understanding before you connect anything. A read-only scanner is granted a mail scope that cannot send, delete, or label, reads a bounded window of history, and returns one row per service — name, amount, interval, next renewal. The honest limits are the ones every vendor in the category shares: it sees only the mailbox it was given, it cannot tell whether anyone uses the software, and the privacy question that actually matters is what it stores after the scan, not what scope it asked for.

What read-only guarantees, precisely

For Gmail the relevant scope is gmail.readonly. It permits listing and reading messages. It does not permit sending as you, deleting, archiving, or changing labels. Two useful consequences follow: a scan cannot quietly rearrange your mailbox, and if a tool is asking for more than a read scope to build a list, that is information about the tool rather than about your subscription problem.

Read-only is not the same as no-access. The tool still reads subject lines and message bodies during the scan. Anyone claiming a subscription scan needs no mail access at all is either inferring from something else or not scanning.

The four permissions worth checking

Scope. Which grant, exactly, and whether the same product also asks for calendar, drive, or a send capability you did not need.
Retention. Whether the email body is stored after extraction or discarded, and how long the extracted rows live.
Credential handling. The token that grants access is the sensitive object; it should be stored encrypted, not in plaintext.
Reversal. Whether you can revoke at the mail provider and have the stored inventory deletable on request.

SaaSClerk asks for the Gmail read-only scope, reads 12 months of mail for billing events, and keeps the extracted line per service rather than the mailbox — the email body is not stored, and the access credential is kept encrypted with AES-256. Revoke the grant at Google and the access ends regardless of what the tool itself offers.

What the scan returns

Field	Why it is the useful one
Service name	The product, not the sender domain — the two differ more often than you would expect
Amount and currency	The number you can add up, and the one a price increase changes
Billing interval	Monthly versus yearly decides how much a missed cancellation costs
Next renewal date	The only field that turns a list into a calendar of decisions
Receiving address	Who owns the renewal, which is where unowned subscriptions get found
Shadow-IT flag	Items that look personally purchased inside a business mailbox

Three things no inbox scanner can tell you

Whether it is used. Mail receipts prove a charge, not a login. Pair the list with vault or SSO activity if you need the unused-and-still-billed set.

The complete total. Charges on a personal card, app-store billing, and receipts that land at another address are invisible to a scan of one mailbox. Diff against 12 months of statements to find them.

Which plan you are on. A renewal amount tells you what you pay, not whether a cheaper tier exists. That comparison is a human ten-minute job per service, best spent on the largest lines.

Test the category on one mailbox

The scan costs nothing to try and takes one mailbox: run it free at saasclerk.app. Read the scope screen before you authorize it, and compare the four permissions above against whatever tool you end up using — including ours.