The cafe is the good one, the one with the wobbly table by the window, and the wi-fi is free on the condition that you type an email address into a splash page first. You do it without reading anything, because the alternative is burning mobile data on a train timetable. Two weeks later a warranty card comes with the washing machine, and the card says registering extends the guarantee, which may or may not be true but takes forty seconds. In between, somewhere, a checkout offers ten per cent off if you join the mailing list, and ten per cent off a sofa is real money.
None of those is a mistake. Each is a small, sensible trade: an address for a thing you wanted. The problem shows up in April, when something arrives that you did not ask for, from a company you have never heard of, addressed to you by name and apparently well informed about your recent sofa. The honest answer to “where did they get that?” is: no idea. It could have been any of forty places. The address you gave all of them is the same address.
Your email address is the join key
There is a reason it is the address that gets passed around rather than your name or your postcode, and it is not sinister. It is that the address is unique, stable, typed by you, and identical everywhere. Two companies with two completely separate customer databases, who have never spoken and never will, can nonetheless work out that their records refer to the same person the moment they both hold you@example.com. Names are ambiguous. Addresses move. Phone numbers get changed. An email address is the one field that behaves like a proper identifier, which is exactly why it has become one.
So when a retailer shares “customer data” with a partner, or a list is bought, or a company is acquired and its mailing list goes with it, the address is what makes the join work; everything else can be matched around it afterwards. You did not agree to be a row in someone’s matching exercise. You agreed to a discount code. The same field does both jobs, and you only gave them one field.
This is where an article of this kind usually turns grim, and it does not need to. The fix is not vigilance, or deleting yourself from the internet. The fix is that you stop using one key for everything: you give each place its own address. Then the join stops working, and — more usefully — you can see the moment somebody tries it.
What a per-service address actually buys you
Three things, and they are worth separating, because only one of them is the one people expect.
You find out who leaked you. This is the good one. If the address on that unexpected April email is the address you typed into the warranty card for the washing machine and nowhere else, then you know. Not “suspect” — know. It is the closest thing to a fingerprint you will ever get out of marketing, and it costs nothing but the thirty seconds it took to think of a name for the address.
You get a switch. An address you gave to one company can be turned off, filtered, or quietly ignored without touching anything else. Compare the address you have had since 2009, which is also your bank login, your recovery address for four other accounts, and the thing your aunt writes to. That one you cannot abandon, so whatever arrives there, you live with. A per-service address has no hostages.
Your mail files itself. Less dramatic, but it is the one you will notice every day. If everything to do with the car insurance comes to an address that exists only for the car insurance, then a rule can put it in a folder without reading a single word of the message, without guessing at the sender’s name, and without breaking when they change the address they send from. Who it is to turns out to be far more reliable than who it is from.
Two ways to do it
There are two mechanisms, and they are not the same thing, although they get talked about as if they were.
The first is plus-addressing, sometimes called sub-addressing. The idea is that anything after a plus sign in the local part of an address is ignored for delivery, so yourname+sofa@… and yourname+cafe@… both arrive in the mailbox belonging to yourname, while the address you actually typed into the form is preserved in the message headers where your filters can see it. No setup, no admin screen, no cost. You invent the address at the moment you need it.
Whether it works depends on your mail provider, and this article is not going to promise on anyone else’s behalf. Test it before you build a habit on it: send yourself a message, addressed to your own address with +test inserted before the @, and see whether it turns up. One minute, no cost, and it settles the question for your mailbox rather than for mailboxes in general.
Assume it works. It still has two flaws worth knowing about.
The first is that a good number of sign-up forms will not accept a plus sign. They will tell you the address is invalid, which it is not, and there is nothing to be done about that at a checkout at eleven at night. Irritating rather than fatal — but it does mean plus-addressing cannot be your only approach.
The second is more interesting. Your real address is visible inside the tagged one. Anybody who wants to strip the tag can, with one line of code, and a list-buyer with any sense does exactly that before merging — because a tagged address is obviously a tagged address. So plus-addressing is excellent at telling you who leaked your details, and much weaker at preventing the join it was supposed to break. It is a smoke alarm, not a fire door.
The second mechanism is a genuinely separate address: a real, additional address in its own right, which delivers into the mailbox you already read. Nothing in it points at anything else you own. It can be given out, filtered, or switched off entirely, and a list-buyer merging two databases has no way to tell it belongs to the same person as your everyday address, because as far as the data is concerned it does not. Redmail lists additional email addresses among its upgrade options, alongside more storage, and the services page lists multiple email addresses and the ability to filter to multiple mailboxes. It is not free the way a plus sign is free, which is the honest trade: the version that actually breaks the join is the version somebody has to run a mailbox for.
In practice most people end up using both. Plus-addressing for the low-stakes, high-volume end — the cafe wi-fi, the one-off discount code, the competition entry — and a small number of real, separate addresses for the handful of relationships that are going to last years and matter when they go wrong.
Naming them so that you can still read them in two years
This is the part that quietly decides whether the whole idea survives, and it takes about ninety seconds of thought.
Name the address after the company, not after what you were buying. +sofa feels obvious on the evening you buy a sofa and means nothing the following spring, when the question is not “what did I buy” but “who has been passing my details around”. +dfs, +britishgas, +thatcafe — dull, unambiguous, still legible long after you have forgotten the purchase.
Do not number them. +shop1 through +shop14 is a system that requires you to keep a key, and you will not keep a key. The company name is the key, which is the whole elegance of it: the address carries its own documentation, so the answer arrives in the same message as the question.
Keep it lower case and keep it short — you will be typing these into forms on a phone, one-handed, in a queue. And do not put anything in the tag you would mind a stranger reading: the address turns up in other people’s databases, on packing slips, and occasionally in a subject line. A tag expressing your opinion of the company is a thing you will regret when it appears on an invoice.
The evening you actually do this
Here is the version that works, as opposed to the version that gets abandoned on day three.
Do not migrate anything. The temptation is to sit down with every account you have ever opened and start changing addresses, and that is a project — projects have completion dates, and this one does not. You will get eleven accounts in, hit a site that wants the change confirmed from an old address you can no longer face opening, and stop. None of it will have helped, because the accounts you fixed are the ones you already knew about.
Instead, start from tonight and go forwards. The next time something asks you for an email address — and it will be within a day or two — give it its own one. That is the whole habit. It costs the three seconds it takes to type a tag, it needs no decisions, and it means that in six months you will have per-service addresses at precisely the places you have dealt with in the last six months, which is exactly the set that matters.
Then spend ten minutes, once, on the filing. Two rules are enough to start: anything arriving at a tagged address goes to a folder called something like Signups, and anything arriving at your plain everyday address stays in the inbox. Redmail’s rules are processed on the server, which means the sorting has already happened before your phone picks the mail up — you are not waiting for a laptop to be opened for the inbox to be tidy. The same page covers the whitelist, which is the thing to reach for when a genuinely useful sender ends up somewhere you did not want them.
That is it. There is no step four. The rest of it is just living, and the system gets more useful the longer you leave it alone.
The email that makes the whole thing worth it
It arrives eight months later, and it is an advert for a conservatory.
You have not asked anybody about a conservatory. But the address in the To line is one you invented on a wet Tuesday for the company that fitted your front door, and you have never given it to another living soul. No theory required, no browser extension, no afternoon reading privacy policies. The message is addressed to the answer.
What you do about it is up to you, and “nothing” is a perfectly respectable option — it is satisfying enough simply to know, to have one of those small, previously unanswerable household mysteries turn out to have a plain answer. If you would rather it stopped, switch that address off or filter it into oblivion, and nothing else changes: the door company can still reach you, because the address still exists, and everybody who bought your details from them is talking to a folder.
And if you want to go further, you are in a much stronger position than you were, because now you can be specific. A vague “where did you get my details?” is easy to deflect. “This address was issued to your company and to no one else” is not. The rights that let you ask — including asking who your data was shared with — are covered in a UK mailbox, a short privacy policy, and five rights you can actually use, and they are considerably more usable when you can name the leak rather than describe it.
Where per-service addresses are the wrong idea
Three places, and they matter.
Your bank, your GP surgery, the school, HMRC, and the recovery address half your other logins would fall back on should all use your real, everyday address, and should carry on doing so for the next fifteen years. These are not relationships you want to be able to switch off, and the failure mode — needing a password reset on the address you disabled in a fit of tidying — is the kind of bad afternoon that turns people off the whole idea. Per-service addresses are for the relationships you are prepared to end. Keep the others boring.
Anything contractual. Insurers especially will compare what you have given them against what they already hold, and an address that looks improvised does you no favours in a claim. Rare, but worth a moment’s thought.
And there is a third, subtler one. None of this is the same as using a burner address, and it is worth being clear about the difference, because the two get confused. A disposable address from a throwaway service is anonymous and attached to nothing, which is precisely why some checkouts treat orders from them with more caution — the reasoning is unpacked in why some checkouts still hesitate over a free email address. Per-service addresses on a mailbox you pay for are the opposite: every one of them is yours, attached to the same real account holder and the same billing relationship. You are not hiding. You are simply declining to hand the same identifier to forty different databases.
What it does not fix
Being straight about the limits is what stops this becoming a religion.
It does not stop anyone sharing your details. It makes the sharing visible, which is a different and more modest thing. If a company you deal with sells its list, it will still sell its list, and you will still get the conservatory advert — you will just know where it came from.
It does nothing for your phone number, which is increasingly the field being asked for anyway, and which you cannot tag.
And it does not retroactively help the address you have used since 2009. That one is in everything already, and no amount of tagging from here will un-join it. What tagging does is stop the problem getting worse and give every new relationship a clean boundary; the old address improves slowly, by attrition, as the lists holding it go stale.
And it will not, on its own, stop you being phished. A tagged address does raise the odds you notice — a message that claims to be from your bank but arrives at the address you gave a garden centre has told on itself before you have read a word — but the habit that actually protects you is the one in phishing at 11pm: close the message and open the site yourself. Tagging is a useful extra signal, not a substitute for that.
Why a mailbox you pay for makes this easy
All of the above needs a mailbox that is on your side about it. Rules that run on the server rather than in one app. Room for more than one address. A provider whose business model does not involve reading the mail, which on Redmail is stated in three lines: no advertisements based on message content, no selling your personal information to third parties, no reading your mail for advertising. The privacy policy is short enough to read in one go, which is not a boast most providers can make.
It is the same point as the quiet joy of an inbox that doesn’t advertise at you, approached from outside instead of inside. That piece is about what stops happening within the mailbox; this one is about what stops happening to you out in the world, in the forty places you have typed your address without thinking. Both work for the same reason: the mailbox is a service you buy, not one you are the raw material for. Redmail has sold email that way since 1997 — long enough to have watched the alternative arrive and settle in.
The plans differ only in how much room you get — the features are the same on all of them — so nothing here is gated behind an upgrade except additional addresses themselves. If what you are actually stuck on is whether any of it is worth paying for, thirty pounds a year, and what it has to cover works through that honestly, including the cases where the answer is no.
The small, uninteresting act
What you are really buying here is not privacy in the grand sense. It is the return of an ordinary act to its ordinary size.
Signing up for something should be a nothing — a thirty-second transaction with a company you may never think about again. Somewhere along the way it became a small act of faith, and if you have ever hesitated over a discount code because you could not face what it might start, you know the feeling. Per-service addresses give back the ability to be casual. Take the ten per cent. Use the cafe wi-fi. Register the washing machine. Each one gets its own address, each address is a door you can shut, and none of them holds the key to anything else.
Try the plus-address test tonight, on your own mailbox, before you commit to anything — one message to yourself, one minute. And then the next time a form asks you for an email address, give it one of its very own, and see what turns up eight months from now. It is a more entertaining experiment than it has any right to be.
If you are still on an address that is also somebody’s advertising inventory, a proper mailbox for the life you’re already living is the place to start, and claiming an address takes about two minutes.
