Email privacy 101: what your address reveals about you

Email feels like a direct message between two people, yet SMTP and HTML email were designed decades before modern web privacy models existed. In practice, the email address you hand to a signup form functions as a persistent cross-site identifier, and the messages you open routinely report metadata back to the sender. This guide explains what your email address and client expose, how open and click tracking work at the protocol level, and practical steps to reduce that exposure.

What your email address itself reveals

Before a single message is opened, the string you type into a registration form leaks context in two ways:

Human-readable attributes in the local-part: Addresses like firstname.lastname@gmail.com, jane88@, or jane@company.com immediately disclose your full name, birth year, or employer to every database that stores the signup.
Deterministic identity resolution across advertising networks: Ad-tech platforms and Customer Data Platforms (CDPs) normalize and hash email addresses (typically via lowercase SHA-256) to match records across unrelated websites. When you hand the same primary email address to fifty different services, data brokers can join those fifty activity profiles on a single shared key.

The Received header chain on outbound mail

Every time an email traverses an SMTP relay, the receiving server prepends a Received: header recording the connecting server's IP address, TLS cipher, and timestamp. Reading a raw message's headers from bottom to top traces the exact network path the message took.

When you send mail through a webmail interface like Gmail on the web or Proton Mail, the earliest Received: header shows the provider's internal server rather than your home IP address. However, when you send mail from a desktop or mobile IMAP/SMTP client connected directly to certain ISP or self-hosted mail servers, the submitting client's public IP address is often recorded directly in the first Received: header and sent to every recipient.

Because a disposable inbox like tenmin.app is strictly receive-only, it never transmits outbound mail or client Received: headers.

How open-tracking pixels work

Marketing platforms and sales outreach tools measure email opens by embedding a 1x1 transparent image (<img src="https://track.example.com/open?id=...">) in the HTML body. Each recipient receives a unique URL token. When your mail client renders the HTML and fetches remote images, that HTTP GET request tells the sender's server:

Which specific recipient opened the message (via the unique URL token).
The exact timestamp of the open (and every subsequent re-open).
The requesting IP address (which maps to rough geographic location or corporate network).
The User-Agent header (revealing device type, OS, and client engine).

Practical defences against tracking pixels

Use an email client that proxies or blocks remote images: Apple Mail Privacy Protection (on iOS and macOS) pre-fetches images through relay proxies so the sender sees Apple proxy IPs rather than your location or open time. Proton Mail, Fastmail, and Thunderbird allow blocking remote images by default and stripping known tracking parameters.
Inspect plain-text bodies for untrusted messages: Plain-text MIME parts cannot execute external image fetches. On tenmin.app, you can inspect the plain-text view of any message whenever you want zero external asset requests.
Isolate one-time signups in a short-lived inbox: Even if an initial welcome email loads an image, an address that expires in ten minutes cannot be used to build a multi-month behavioral open profile.

Link wrapping and click tracking

Even when remote images are blocked, nearly all commercial email providers rewrite anchor tags (<a href="...">) to point to a click-tracking redirector domain owned by the ESP. Clicking the link hits the redirector first, logs your recipient ID, IP address, and browser fingerprint, and then issues an HTTP 302 redirect to the destination URL (often with utm_ or subscriber tracking parameters appended).

When a verification email contains both a plain-text OTP code and a wrapped "Click here to verify" button, copying the six-digit code directly into the open registration tab avoids an unnecessary redirect through the sender's click-tracking server.

Compartmentalizing your email identity

The single highest-leverage privacy habit for email is compartmentalization: never using one global identifier for every interaction on the web.

Tier 1 (Primary inbox): Reserved for banking, government services, healthcare, family, and critical infrastructure accounts. Never entered into marketing forms or third-party app trials.
Tier 2 (Forwarding aliases): Used for ongoing SaaS tools, e-commerce checkouts, newsletters you want to read, and community accounts. Each service gets its own unique alias via SimpleLogin, Addy.io, or iCloud Hide My Email so breaches cannot be correlated across services and any noisy sender can be shut off independently.
Tier 3 (10-minute disposable inbox): Used for one-time downloads, gated PDFs, promo codes, and staging QA tests where no ongoing relationship should exist at all.