We use Gmail's read-only OAuth scope (gmail.readonly) — we cannot send, delete, or modify any email. Our scan filters financial emails (invoices, receipts) using a Gmail search query, so we only fetch the body of emails that look financial. We never store the full content of your emails — only the extracted invoice data.