Email Privacy Basics

Email was designed in an era that assumed everyone involved was trustworthy. A few of its properties follow from that assumption and surprise people who have never had reason to look.

Your address is an identifier, not a contact detail

To a marketing system, your address is a primary key. It is stable, unique, and you carry it between services, which makes it ideal for joining records that would otherwise stay separate.

Data brokers rely on this. A purchase from one shop, a signup at one site and a survey answered years ago can be combined into a single profile because the same address appears in all three. Nothing in the process required your consent beyond the terms you accepted at each individual step.

Using different addresses for different services breaks that join. This is the single largest practical improvement available, and it costs nothing.

What the string itself gives away

Before a single message is sent, the address you typed is already information.

Most real addresses contain a name in some recognisable form, and a surprising share contain a birth year. The domain adds the rest: where you work, where you studied, which country you signed up in, or simply that you have kept the same free provider since the middle of the last decade. A shop, a recruiter and a stranger on a forum all read those fields without having to ask you anything.

The second property is less obvious and matters more. Hashing an address does not anonymise it. Run through MD5 or SHA-256, one address always produces the same value, so the hash identifies you exactly as well as the plain text does. Advertising systems trade hashed addresses for that reason: the join still works, and the word "hashed" reads well in a privacy policy.

So an address reused across services is a name tag whether it is stored as text or as a fingerprint of that text.

Why the address became the identifier of choice

Tracking used to run on third party cookies. Browsers began blocking them, phones added their own restrictions, and the machinery that depended on them started returning worse matches every year.

The replacement was already in every database: the email address. It survives a cleared browser, a reinstalled phone and a switch from laptop to tablet, and it is the one field almost every company already holds. Systems built around it are sold as identity resolution, and the pitch is that a person can be recognised across sites without a cookie anywhere in the chain.

This is the reason the address field keeps appearing in places that have no use for correspondence, including sites with nothing to send you. The address is being collected as an identifier, and the newsletter is the excuse for asking.

Understanding that changes what the field means. You are not agreeing to receive mail. You are handing over the key that links this visit to everything else that already has your address on it.

Opening a message reveals more than you expect

Most marketing mail contains a tracking pixel: a tiny image with an address unique to you. When your client loads it, the sender learns that you opened the message, roughly when, roughly where you were, and what kind of device you used.

Links are usually tracked too. The link you see and the link you follow differ: the visible one points at a redirect service that logs the click before sending you on.

Blocking remote images stops the pixel. Most clients can do this, and it is the one setting worth changing. On this site messages are shown with remote images enabled, because otherwise most legitimate mail looks broken. If that matters for a particular message, do not open it here.

What the pixel records, field by field

It helps to see how little machinery is involved. The pixel is an ordinary image request, and that is the entire trick.

The image address carries a token unique to your copy of the message. When your client fetches it, the sender's server writes down four things: which token, what time, which IP address, and what the client said about itself in the user agent string.

Everything reported back to the marketing team is derived from those four. The open, the time of day you read mail, a rough location from the IP, phone versus desktop, and how many times you returned to the same message.

Two developments have made the numbers noisier. Apple's Mail Privacy Protection fetches remote images through a proxy regardless of whether the message was opened, which inflates opens and removes the location. Gmail loads and caches images through Google's own servers, so the sender sees Google rather than you, though the request itself still registers as an open.

Neither is the same as switching remote images off, which prevents the request from happening at all.

Links are rewritten before they reach you

The second half of the tracking is in the links. Nearly every sending platform replaces the address of every link in a message with one of its own.

The visible text says the brand's site. The link underneath points at a tracking domain, carrying an identifier for the message and for you. The server records the click and then redirects you onward, which takes a few milliseconds and leaves no trace you would notice.

Three practical consequences follow.

Forwarding a link out of a newsletter attributes your friend's click to you, and in some systems drops them into the sequence you were in.

The tracking domain never matches the brand's domain, which is precisely what a forged message looks like. Checking where a link points is worth less than it should be, so check where you actually landed, in the address bar, after the page loads.

Anything after utm_ in the resulting address is measurement rather than navigation. Removing it rarely breaks the page and is worth doing before you paste a link somewhere public.

Mail is not private in transit or at rest

Transport between servers is usually encrypted now, but the message sits readable at each end. Your provider can read your mail, and the recipient's provider can read it too. Anyone who compromises either account can read everything in it.

For most correspondence this is acceptable. For anything genuinely confidential, email is the wrong medium, and no service, this one included, changes that.

The habits that matter

A different address per service. Aliases for the things you keep, disposable addresses for the things you do not.

Block remote images by default. Kills the tracking pixel in one setting.

Never publish an address in public text. Scrapers find it within days, and cutting the supply beats filtering the result.

Check where a link goes before following it. Long redirect addresses in a message you did not expect deserve suspicion.

Do not use unsubscribe links from senders you do not recognise. For a legitimate company they work. For a spammer they confirm that a human reads the address, which makes it worth more.

Keep a real address for the small number of things that need one, and give it out rarely.

What a disposable address does and does not do

It removes one specific risk completely: the address you handed over cannot follow you, because it stops existing. Whatever a company planned to do with it, it can no longer do.

It does nothing about the message content, about tracking pixels in messages you open, or about anything else you typed into the same form. If you filled in your name, your name is still on the form.

Think of it as one tool that solves one problem thoroughly, rather than a privacy measure in general. Used that way it is genuinely useful, and it takes no effort at all.