Where Does Your Email Address Actually Go After You Type It In?

Let's follow one address. Call it yours.

It starts innocently, because it always does.

You're buying shoes, or a phone cover, or booking something, and at checkout a friendly little box offers you a discount if you join the mailing list. Ten percent off. You type your email address — your real one, the one you've had for years — take the discount, and forget the whole thing before the parcel even arrives.

The parcel arrives. Your address, meanwhile, has just started a much longer journey than the shoes ever took. I think about this a lot, working at , because our whole service exists for people who got tired of this journey. So let me walk you through it, stop by stop, the way it usually happens.

Stop one: the welcome flood

First comes the welcome email. Then a "you left something in your cart" email, even though you bought the thing. Then new arrivals, a weekend sale, a sale because it's Tuesday.

This part is legal, expected, and only mildly annoying. You signed up; they're writing to you. Clicking unsubscribe on a company you actually recognise works fine, and I'll defend that link later. But notice something: you gave the address to one shop. Already, the emails aren't all from that shop. There's the delivery partner with its own account invites. The payment service suggesting you join. A survey company asking how the shoes felt, which — how did the survey company get your address, exactly?

Nobody stole anything. You were handed along, politely, through a chain of "partners" that the signup page mentioned in print small enough to need a magnifying glass and a law degree.

Stop two: the lists you've never heard of

Here's the part people don't picture. Email addresses get bundled.

A shop builds a list. The list is an asset, like stock in a warehouse. Companies buy, sell and swap lists, and separate businesses — data brokers — exist purely to collect addresses, sort them (these people buy shoes, these people travel, these people click on sales), and rent the sorted piles to whoever's marketing this month. Your address might be typed into fifty databases in its first year without a single thing going technically "wrong." Every step had a policy. Every policy had a paragraph. You agreed to all of it, in the same way you agreed to the discount.

The practical result lands in your inbox months later: email from companies you have genuinely never interacted with, about things weirdly close to your interests. That's not a hacker. That's your address, working its second and third jobs.

Stop three: the leak

And then, one day, one of those fifty databases gets copied by someone who was never invited.

It might be a big company or some forgotten little site you used once in 2019. It doesn't matter which — that's the miserable thing. You can be careful with your password, careful with your phone, careful with everything, and your address still ends up in a leaked pile because a stranger's server wasn't careful. I keep a running list of the mistakes I see around codes and accounts — the OTP mistakes post on this blog is basically my family group chat in article form — and leaked old accounts sit underneath half of them.

After a leak, the tone of your inbox changes. Now it's phishing dressed as your bank. Fake delivery notices. Messages that know your name and one true detail about you, because the leak included both. This is the stop on the journey where the address stops being a marketing asset and becomes a targeting list.

What I'd actually do about it

You can't un-share an address that's already out there. Anyone who tells you otherwise is selling something. But you can stop feeding the machine, and it's less work than you'd think.

One-off things get a one-off address. Trials, coupons, downloads, that shop you'll never buy from again — a temporary inbox takes the signup, receives the one email you actually wanted, and expires. That address's journey ends in an hour, in a bin. It never reaches stop two, let alone stop three. I wrote a whole piece on keeping your real inbox spam-free if you want the full habit list, but honestly, this one habit does most of the work.

Your real address gets promoted, in other words. Reserve it for the accounts you'd genuinely grieve if you lost: banking, government, your main everything. For services you use every week and actually trust, that's also where a permanent inbox earns its keep — an address that's yours, that you control, that isn't your identity's front door.

And those welcome-flood emails from companies you recognise? Unsubscribe, calmly, using the link in their own email. It works on the legitimate ones. Save your rage and your spam button for the strangers. Your address will still travel — it's the internet, everything travels — but it can travel a lot less far, with a lot less of you attached to it.