Email Privacy Best Practices

Your email address is one of the most valuable pieces of personal information you share online. Once it's compromised, you can't simply change it like a password. Here's how to protect it.

Use Disposable Addresses for One-Time Interactions

The single most effective privacy practice is simple: don't give out your real email unless you trust the recipient.

When signing up for:

• Free trials or downloads
• One-time purchases
• Newsletters you might not want long-term
• Websites you're just exploring
• Any service you don't fully trust

...use a disposable email address instead. Services like tempy.email give you a temporary inbox that self-destructs after 10 minutes, leaving no trace.

Enable Two-Factor Authentication

Your primary email account is the master key to your digital life. If someone compromises it, they can reset passwords for your bank, social media, and everything else.

Turn on 2FA immediately for:

• Your primary email provider (Gmail, Outlook, etc.)
• Any email aliases or forwarding services
• Password managers that send recovery codes via email

Use authenticator apps (not SMS) when possible. SMS can be intercepted via SIM swapping attacks.

Never Click Links in Unexpected Emails

Phishing works because emails look legitimate. Even if an email appears to be from your bank, Amazon, or the IRS:

1. Don't click the link
2. Open a new browser tab
3. Type the official URL manually
4. Log in directly

If the message is real, you'll see the same information in your account dashboard.

Use Email Aliases for Long-Term Services

For services you trust but want compartmentalized (online shopping, newsletters, work), use email aliases:

• Gmail: Add +anything to your address: [email protected]
• Apple iCloud+: Generates unique @icloud.com addresses for each service
• Fastmail, ProtonMail: Offer unlimited aliases

Aliases let you:

• Track which services sell your email (if [email protected] gets spam, you know who leaked it)
• Filter messages into folders automatically
• Delete specific aliases if they get compromised

Avoid Public Email Lists

Never post your email address in:

• Public comments sections
• Social media bios
• Forum signatures
• GitHub profiles (unless work-related)

Bots scrape these constantly. If you must share it publicly, use:

• Image instead of text (bots can't read images easily)
• Character substitutions: name [at] domain [dot] com
• A contact form instead

Use Encrypted Email for Sensitive Communications

Standard email is sent in plain text. Your provider, network admin, and anyone intercepting traffic can read it.

For truly sensitive communications:

• ProtonMail or Tutanota — end-to-end encrypted by default
• PGP/GPG encryption — works with any provider but requires technical setup

Don't email:

• Social Security numbers
• Credit card details
• Medical records
• Anything you wouldn't write on a postcard

Review Connected Apps Regularly

Your email account likely has dozens of third-party apps connected (via OAuth):

1. Check your connected apps every few months:
   • Gmail: google.com/permissions
   • Outlook: account.microsoft.com/privacy
2. Revoke access for apps you no longer use
3. Look for suspicious apps you don't recognize

Ignore "Verify Your Email" Scams

Legitimate companies don't ask you to "verify your email" by clicking a link and entering your password.

Red flags:

• Urgent language ("Your account will be closed!")
• Generic greetings ("Dear Customer")
• Mismatched sender domain (from @secure-paypal-verify.com instead of @paypal.com)
• Threatening consequences for not acting immediately

When in doubt, go directly to the website (don't click the email link) and check your account status there.

The Three-Email System

Consider separating your digital life into three tiers:

1. Primary email: Banks, taxes, legal, medical. Guard this aggressively. Never give it out casually.
2. Secondary email: Online shopping, subscriptions, newsletters. Use an alias or separate Gmail account.
3. Disposable email: Everything else. One-time signups, free trials, sketchy downloads.

This compartmentalization limits damage from breaches. If your shopping email gets compromised, your bank is still safe.

Quick Checklist

✅ Use disposable email for one-time signups ✅ Enable 2FA on your primary email account ✅ Never click links in unexpected emails ✅ Use aliases for long-term services ✅ Keep your primary email private ✅ Review connected apps every 3 months ✅ Use encrypted email for sensitive data

Your email address is your digital identity. Treat it like your home address — you wouldn't write it on a public bathroom wall.