Money Tracker 為何從不索取你的銀行密碼

Open-banking fear is rational. Once an expense app asks for your bank username and password — or a deep “connect account” flow that feels the same — you are trusting that product with credentials you would not paste into a random form. Even when the pitch is convenience (“we sync everything”), the trade-off is clear: your ledger gains speed; your bank identity leaves the bank app.

Plenty of people still want less typing after every QR / UPI / Pix / wallet payment. Those two desires collide. So when we built Smart Notification Entry in Money Tracker, we started from a hard line:

The app does not connect to bank logins. It never asks for your bank password.

That is not a soft disclaimer buried in settings. It is the product shape.

What we do instead of bank login

Money Tracker is a bookkeeping and budget app (Android store name: Money Tracker-Expense & Budget; iOS: Money Tracker:Expense & Budget). Capture stays on your side of the fence:

• You can type entries.
• You can use AI voice or receipt photo entry (results are editable before save).
• On Android, Premium users can optionally let the app watch transaction-style notifications from other apps, draft a line, and wait for you.

None of those paths require handing over bank credentials. If you need verified bank sync as the core workflow, this is not that product — and we would rather say that upfront than blur the line.

High-level: how Android notification bookkeeping works

Android exposes a system permission called notification access. With it, an app you choose can read the text of notifications other apps post — the same banners you already see when a payment succeeds.

Smart Notification Entry uses that surface, not a bank API and not a stored password:

1. You open Settings → Smart Notification Entry (Premium) and turn the feature on.
2. Android asks you to grant notification access (so Money Tracker can monitor other apps’ alerts) and the app’s own notification permission (so it can nudge you when something looks like a transaction).
3. When another app posts a transaction-like notification, Money Tracker can treat it as a draft candidate.
4. You review it — amount, category, and related fields — then confirm. Until you confirm, it is not meant to become permanent ledger history.

At a product level, the pipeline is: notification text → draft → human confirm → save. We are not documenting parser heuristics, vendor-specific reverse engineering, or a “supported bank list.” Payment apps and notification formats change; naming untested packages would be marketing fiction. The durable idea is simpler: reuse the alert you already got, then keep the human in the loop.

You can also put apps you do not want monitored on a blacklist. After that, those apps’ transaction notifications are ignored, and any pending drafts from them are cleared. Remove them from the blacklist later if you change your mind.

Confirm-to-save is the privacy feature

“Automatic expense tracking” demos love to skip the checkpoint. In a ledger, the checkpoint is the feature.

A wrong coffee is annoying. A wrong transfer amount — or a duplicate — is how trust dies. So the design default is:

• Suspected transactions land in a pending / to-confirm flow (you can open from the nudge, or process items in a list).
• You can confirm one by one or batch-confirm with “recognize and import.”
• Suspected duplicates are meant to force a confirmation path rather than silently stacking copies.
• Ignore is always available when the alert was not a spend you care about.

That is the same philosophy as AI voice and receipt entry elsewhere in the app: AI or automation may draft; you decide what becomes history. Speed without a silent write.

Important honesty for tech readers: this is not silent full-statement import, not open banking, and not “set it and forget every line forever.” It is a lower-friction capture path for people who already get payment alerts on Android and are willing to tap Confirm.

Limits (please read before you expect magic)

Other Premium examples that often get mixed into “privacy” questions: app lock (PIN / biometrics), more books and accounts, unlimited AI entry after free trial limits, bill import, team books / share invites, and smart settle on AA. AA / split books can stay free to create; team books, initiating share invites, and smart settle need Premium. Exact quotas can change by version — trust in-app copy over blog posts.

Short FAQ

Does Money Tracker log into my bank?

No. It does not use bank logins or bank passwords.

Is notification entry “fully automatic”?

No. On Android Premium it drafts from transaction-style notifications; you confirm before those drafts are treated as saved bookkeeping.

Can I stop it from reading a specific app?

Yes — blacklist that app.

Why not just connect open banking everywhere?

Because many users in our markets want faster capture without expanding the credential surface. Notification text + confirm is a deliberate smaller trust boundary.

Will every payment app’s alert parse perfectly?

No. Formats differ; noisy or non-transaction alerts exist; you can ignore or edit. We do not publish an unverified “works with every wallet” claim.

Who this is for

Worth a look if you pay from phone apps all day, already see payment notifications, refuse to type bank passwords into a budgeting tool, and will spend two seconds confirming a draft.

Skip the notification path if you are on iOS only, need certified bank-sync as the center of the product, or want zero confirmation steps. The rest of Money Tracker still works without that feature.

Stores: Google Play (Money Tracker-Expense & Budget) · App Store (Money Tracker:Expense & Budget).

I help build Money Tracker. This piece explains why we avoid bank-password flows and how Android notification drafts + confirm-to-save are meant to work — including the Premium / Android-only limits. Originally published on Hashnode; this is a cross-post with canonical URL set.