Is it safe to give an expense tracker SMS permission?

On Android, READ_SMS gives an app the whole inbox. There is no way to grant access to messages from your bank only, and no way for you to see which messages an app looked at. Anything narrower is a choice the app makes in its own code, after the system has already let it in.

That is why Google Play treats it as a restricted permission. An app that is not your default messaging app may use it only under a short list of exceptions, one of which is SMS-based money management, and the developer has to declare the use and have it reviewed. The review limits who may ask. It does not change what the permission exposes once you say yes.

These apply to any expense tracker that reads SMS, this one included.

• Can it reach the internet? Open Settings, Apps, the app, then Permissions, and choose All permissions from the menu. An app that lists “have full network access” can transmit what it reads. An app that does not list it cannot open a connection at all. This is the single most useful check, because it is enforced by Android and not by a promise.
• What does its Data Safety section say? On the app's Play Store page, Data safety lists what the developer declares as collected and shared. Look for messages and financial info under “data collected”.
• Does it need an account? A phone number or an email ties your transactions to an identity on someone's server. A tracker that works with no sign-up has nothing to attach your data to.
• How does it make money? Ads, a subscription, or selling loans, cards and insurance are all legitimate businesses. Each tells you what your spending data is worth to the developer, and it is worth knowing before you share it.
• Can it send SMS too? Reading and sending are separate permissions. A budgeting app has no reason to send, edit or delete a message.

The network check is worth repeating after an update. Android treats INTERNET as a normal permission, granted at install without a prompt, so an app can gain it in a new version without asking you.

Internet access

None. The release build does not declare INTERNET, so Android refuses it a network connection

Data Safety

No data collected, no data shared. The answers are published in full on this site

Account

None. No sign-up, phone number or email

Business model

None. Free, no ads, no loans, cards or insurance sold

Sending SMS

Cannot. SEND_SMS, WRITE_SMS and RECEIVE_SMS are not requested; access is read-only

Details are in the Data Safety answers and the privacy policy.

Having no network access settles where your data can go. These settle how little of it the app keeps in the first place:

• Filtered before the app sees it. Native code checks every message for a bank-style sender ID and an amount. A message from a person, or one with no amount in it, is discarded there and never reaches the rest of the app.
• OTP digits are erased on the way in. A one-time password that quotes an amount passes the first filter, so the code itself is removed from the text before the parser, the classifier or the database is given it.
• Message text is not kept. The text is stored only while an item waits in the review queue. Confirm or dismiss it and the text is deleted. The transaction stays.
• It reads when you open it. Skimp does not wake up when a message arrives or run on a timer. It reads when you open the app or press Sync, and the only background work is finishing an import you started.
• The permission is optional. Decline it and Skimp works as a manual expense tracker. You can withdraw it later in Android Settings.

No app removes the risk entirely, and it would be dishonest to say this one does.

• Android still hands Skimp the whole inbox. The filtering above is the app's own code, and you are trusting that it does what this page says.
• A backup or report you export leaves the app's control the moment you share it. The backup is encrypted with your passphrase; a CSV or PDF is not.
• Anyone with your unlocked phone can open the app. Skimp has no app lock of its own.

That is a reasonable choice. Three ways to track spending without giving any app your inbox:

• Manual entry. Slower, and it captures cash, which no automatic method does. Skimp works this way with the permission declined.
• Statement import. Some trackers read a statement you download from your bank. You control exactly which transactions the app sees.
• Account Aggregator apps. India's Account Aggregator framework lets an app fetch transactions from your bank with your consent. It needs no SMS access, and it does mean your data passes through that app's servers.

The comparison of expense trackers notes which method each app uses.