← All posts
5 min readprivacy, email, spam

Your inbox is everyone else's billboard

We treat the inbox like it belongs to us. It doesn't. Here's how it actually works — and how to get it back.

You think your inbox is yours.

It's not. It's a billboard. The space inside it is rented out, sold off, and re-sold by every company you've ever handed your email address to.

The Tuesday morning your inbox is full of "we miss you" emails from a SaaS trial you cancelled six months ago, and a yoga studio you visited once in 2021, and three different "exclusive offers" from companies that bought your address from a fourth company you don't remember signing up for — that's what your inbox actually is. Not yours. A leased advertising surface that you don't get paid for.

How we got here

Email was supposed to be a personal address. You give it to your friends. You give it to your bank. End of list.

Then the internet happened. Every site needed a way to identify you, and "your email" turned out to be a perfect natural primary key. Stable. Unique. Already-existed. Now it's not just an address anymore — it's the identifier. Your name might be John Smith. There are a million John Smiths. There is exactly one john.smith.1987@gmail.com.

So now every site asks for it. The shopping cart asks for it. The free PDF asks for it. The "are you over 18" gate asks for it. The wifi at the coffee shop asks for it. The article you wanted to read asks for it.

And every single one of those addresses goes into a database. And every single one of those databases gets:

  • breached
  • sold
  • merged into a marketing platform
  • handed to a "partner"
  • exported by an employee leaving for a new job
  • mined by an AI that's training on customer data

You gave each of those companies one little piece of yourself. They turned it into ad inventory. The next time you open Gmail and there are 47 unread messages, only 3 of which are from people, that's the bill coming due.

Why "just unsubscribe" doesn't work

You know the routine. You see the spam, you scroll to the bottom, you click "unsubscribe", you check the box, you click confirm, you read the "you've been unsubscribed" page that has a button to re-subscribe in case you change your mind, and you close the tab feeling like you did something.

You didn't.

Here's what actually happened: the company now knows that the address is active. A real human read the email. A real human cared enough to want it to stop. That's the most valuable signal a marketing list can have. Most lists with a working unsubscribe button don't actually delete you — they put you in a "suppressed" segment that gets re-sold to a partner, who emails you under a different brand name from a different domain, with a whole new "unsubscribe" link that does the same thing.

This is not a conspiracy theory. This is just how email marketing works. It is a multi-billion-dollar industry built on the assumption that you can't actually leave.

The trick

There's a trick.

You don't give them your real email.

You give them an address that forwards to your real email. A different one for every site. When the site starts spamming you — or sells your address to a partner who starts spamming you, or gets hacked and leaks your address to everyone — you don't unsubscribe. You don't beg. You don't ask politely.

You delete the address.

The site now has nothing. There's no working email to send to. The "we miss you" campaign hits a wall. The retargeting pipeline collapses. The marketing partner who paid for your address gets a bounce. Your inbox stops being a billboard.

What changes

I run on aliases now. Every site, every signup, every "enter your email to unlock the discount", every wifi network — different alias. Most of them named after where I gave them out. amazon@my-domain.com. target@my-domain.com. that-yoga-studio@my-domain.com.

When something starts misbehaving, I don't have to remember which "unsubscribe" link is real and which one re-subscribes me. I don't have to email customer support. I don't have to wait 30 days for the unsubscribe to "process".

I delete the alias. It's instant. It's permanent. I never hear from them again.

The first month I started doing this I did the math: my real inbox went from ~120 emails a day to ~12. The ratio of "things from people I know" to "things from companies that bought my email" went from 1:40 to 1:1. I stopped checking email on weekends because there was no reason to.

Why we built SecureAlias

I built SecureAlias because the existing alias services were almost what I wanted but not quite. They were either built for privacy nerds (great if you're a privacy nerd, not great if you're trying to convince your mom to use it) or they were a side feature inside a browser, an OS, or a search engine — and side features get neglected when the company shifts focus.

I wanted a service that:

  • worked instantly, no setup, no DNS records, no jargon;
  • scanned every attachment for malware before it hit my inbox, because I get phishing PDFs about as often as I get the real ones;
  • stripped tracking pixels by default, because I'd rather companies not know whether I opened their email;
  • let me kill an alias in one click and have the spam stop, forever, with no follow-up;
  • was usable by my mum.

That's it. That's the whole thing.

The product is free. Pro features are free for 30 days, then you can keep using the free tier forever, or upgrade if you want the heavy stuff. There's no card required to start. There's no "we're going to spam you about the upgrade" sequence — we built this thing because we hate that.

What you can do today

If you take one thing from this post, it's: stop giving your real email to companies that want to sell it. There are a handful of ways to do that. Apple has Hide My Email. DuckDuckGo has Email Protection. Mozilla has Firefox Relay. Proton has SimpleLogin.

We're SecureAlias, and we built it because none of those felt like products built for the version of you that just wants the inbox to stop screaming. Try it free, no card required. If you hate it, the others are still right there.

Either way: stop using your real email for things that aren't your friends or your bank.

The inbox should be yours. Take it back.

Take your inbox back.

Generate unlimited aliases. Kill them when you're sick of the sender. Free forever.

Start in 30 seconds