Your bank already tells you what you spent. FiscalFox keeps the receipts.
Every UPI payment and card swipe, your Indian bank emails you an alert. FiscalFox reads those alerts and turns them into one clean, searchable spending ledger — no statements to download, no manual entry, no linking your bank login.
FiscalFox is invite-only while we're in early access and finishing Google's review of our Gmail access.
How it works
- 1. Sign in with GoogleThis only confirms who you are. It does not grant access to your email.
- 2. Connect Gmail (read-only)A separate, explicit consent for
gmail.readonly— the narrowest scope that exists. FiscalFox can never send, delete, or change anything in your mailbox. - 3. SyncFiscalFox scans recent bank-alert emails, parses the amount, merchant, and date, and builds your ledger. Card-bill payments and transfers are flagged so they don't inflate your spending.
How FiscalFox uses your Gmail data
FiscalFox requests one Google scope: https://www.googleapis.com/auth/gmail.readonly. Here is exactly what we do with it, and nothing else:
- What we read. Only messages that match a bank-transaction search (senders like
alerts@hdfcbank.bank.inand phrases like “debited” / “credited”). We do not read, index, or scan the rest of your inbox. - What we extract. The transaction amount, merchant/payee, date, and payment method from each alert.
- What we store. The parsed transactions, and the raw alert email (encrypted — see below) so a parsing mistake can be corrected without re-reading your mailbox.
- What we never do. We never sell your data or share it beyond what this page lists, never use it for advertising, never use it to train AI/ML models, and no human at FiscalFox reads your email except where you explicitly ask us to debug a specific transaction.
- Optional AI categorisation. Off by default. If you turn it on, for transactions the parser can't identify we send only the merchant text, payment method and a coarse amount range (never your email, name or account numbers) to Google's Gemini API, on its paid tier, where Google does not use it to train models.
FiscalFox's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Full detail in our Privacy Policy.
Security
- Least privilege. Read-only Gmail, no bank credentials, no account aggregation.
- Envelope encryption. Your Gmail token and raw alert emails are encrypted with a per-record key wrapped by Google Cloud KMS — a database dump alone is useless without a separate KMS grant, and every decryption is audit-logged.
- Delete anything, anytime. One button on your dashboard permanently erases every transaction and raw email and revokes FiscalFox's Gmail access.
Want in? FiscalFox is invite-only right now. Sign in above to join the waitlist — we'll email you when your spot opens.