makeprivacy.org guides

One email address for every account

2026-10-14T00:00:00Z

Most people use one email address for everything. It works until that address leaks, is sold or is scraped from a website. Then spam and phishing arrive at the same inbox your bank writes to, and there is no way to tell which company let it out.

What happened to us

We printed a contact address on our own website, in the footer, on the contact page and in the privacy notice. Within weeks it was getting spam. Removing it from the visible pages wasn't enough: the address also sat in the files machines read, such as the site summary written for AI tools and the structured data search engines collect. We took it out of all of them and pointed visitors to a contact form and an encrypted messenger instead.

The address that leaked is still on spam lists, and it will stay there. Removing it stops new harvesting; it doesn't recall the copies already made. That is the case for separate addresses: you want the thing that leaks to be something you can switch off without anyone else noticing.

How a per-account address works

Each service you sign up for gets its own address, for example one for the library and one for the postal service. All of them deliver to your normal inbox.
Each address carries a label saying what it is for, so mail to it always tells you who is writing.
When one starts getting spam, you switch that address off. Mail to it is accepted and quietly dropped, so the sender learns nothing, and every other address keeps working.
If a service you never gave the address to writes to it, you know exactly who shared it.

Three ways to set it up

Route	Effort	Good to know
Your mail provider's built-in masked or alias addresses	Minutes	Easiest. The addresses live with that provider, so moving provider later means moving them too.
An alias service such as SimpleLogin or addy.io	An hour	Works with any inbox and handles replies from the alias. Both are open source and can also be self-hosted.
Your own domain on a mail server you run	A project	Full control and no extra company in the path. You also take on spam filtering, backups and the reputation of your sending server.

We started with an alias service and later moved our own mail to a server we run, where each address is a labelled alias with an on/off switch. The idea is the same in all three; pick the one you will actually keep up.

Habits that make it work

Use your own domain if you can. Addresses on a domain you own can move to any provider; addresses on someone else's domain can't.
Switch off, don't delete. A switched-off address keeps refusing quietly. A deleted one may fall through to a catch-all and start arriving again.
Keep one stable address for account recovery on the accounts that matter most, and never publish it.
Don't print any address on a website. Use a contact form with spam protection, or a messenger link.

What it doesn't do

Separate addresses stop one leak spreading and show you who leaked. They don't hide what's in your mail from your mail provider, and every alias on your own domain still points back to you. For that you need to choose the provider carefully, which is a separate decision.

Find every subscription without handing over your bank login

2026-10-14T00:00:00Z

Subscription trackers are useful: they find the streaming service you forgot and the free trial that quietly became a paid plan. Most of them get there by asking you to log in to your bank through a data aggregator. From then on a third company receives every transaction you make, not only the subscriptions, and keeps it under its own terms.

The same result from records you already hold

Collect. Download the last 6 to 12 months of statements for every card and account, personal and business. Add the card alert and receipt emails already in your inbox.
Match. Group charges by merchant. Anything that repeats at a regular interval (weekly, monthly, yearly) with a similar amount is a subscription candidate.
Decide. For each one: keep, cancel, downgrade, or move to annual billing. Look for the same service paid twice, on two cards or by two people.
Keep watching. Repeat the match each quarter, or have card alerts land in one place so a new repeat charge stands out as soon as it starts.

Our subscription finder does the matching step in your browser: paste statement lines and it lists the repeat charges. Nothing is uploaded.

What our own review found

Our founder's own review used 9 statements from 6 banks, plus email receipts. It found more than 20 recurring charges and flagged up to about US$415 a year to cut, including 5 possible duplicates. It also turned up US$1,161.72 of company fees paid on a personal card, which could be claimed back. None of it needed a bank login shared with anyone.

Tips

Yearly charges hide well. Use at least 12 months of statements, or search your inbox for "renewal" and "annual".
Charges in a foreign currency often show a slightly different amount each month. Group by merchant first, then look at the amounts.
Give each service its own email address (see one address for every account). Every renewal notice then tells you exactly who is charging you.
Cancel in the service's own account settings and keep the confirmation email. Then check the next statement.

Backups you have actually restored

2026-10-14T00:00:00Z

Most backup failures are discovered on the day you need the backup: the job stopped months ago, the password is lost, or the copy turns out to be incomplete. All three are cheap to catch in advance.

Three copies, in three places

A drive at home or in the office, for fast restores.
A second computer, so one broken machine or drive never takes everything with it.
Rented storage in another country, for fire, flood and theft.

Every copy is encrypted on your own machine before it leaves, so the storage company holds data it can't read. We use restic, which is free and open source; it encrypts, removes duplicate data and keeps dated snapshots you can go back to. Keep the encryption password in your password manager and on paper: without it the backups are useless, to a thief and to you.

Make the off-site copy add-only

If a machine is compromised, an attacker who can reach your backups can delete them too. Set the off-site copy up so the machines that send backups can add new snapshots but cannot delete or overwrite old ones. Clearing out old snapshots then becomes a deliberate, manual step.

The restore drill

Once a month, restore something real and compare it with the original:

Pick some files at random, restore them, and check they match byte for byte.
For a database, restore it somewhere separate and count the rows. Our last records drill brought back 9,484 of 9,484 rows.
For a whole system, such as a mail server, start a throwaway copy from the backup and check that it works. When we did this for our own mail server, the restored copy had every account and a test message we had planted beforehand.

Write down the steps the first time. The day you need them is not the day to work them out.

Let silence be the alarm

Each backup job should report when it succeeds, and a daily check should raise an alarm when a report is missing or old. Don't wait for an error message: a job that has stopped running sends none.

Leaving Airtable for a database you run

2026-10-14T00:00:00Z

Airtable is a good product. The concern is where the records live: in someone else's platform, under terms that can change, with an export that loses part of what makes the base work, such as formulas and links. For records a business depends on, we wanted a copy we run ourselves and can take anywhere.

What we use instead

Baserow is open source and looks and works much like Airtable: tables, views, links between records, formulas and forms. We run it on a small rented cloud server, about US$7 a month, with its data in a PostgreSQL database on the same server. It is reachable only through a sign-in gate in front of it, and the database is backed up every night.

How we moved

Export each base from Airtable through its API, including attachments.
Load it into a test workspace first, never straight into the real one.
Rebuild formulas. Most convert directly; some need rewriting by hand.
Compare every value, field by field, between Airtable and the new copy. For our first two bases that was 2,245 and 8,131 values, with 0 differences.
Only then switch the people and the automations over, and stop editing the old base.

Two traps we hit

Number precision. In Airtable, a number field's display precision doesn't limit what it stores. In the new database it does. One field set to whole numbers held a 22.5, and that single value got a whole batch of 200 rows rejected. Exchange rates with 7 decimal places would have been cut to 6. The fix was to size each field's decimal places from the data actually in it, never from the display setting.

Date differences. A formula counting whole years between two dates gave a different answer after the move, because the new database rounds where Airtable counts whole years. A company 8.87 years old came out as 9, which pushed a renewal date out by a year. We rebuilt the formula from calendar years, months and days so it counts the way people do.

Neither would have been noticed without the value-by-value comparison. That step is the migration; the rest is copying.

After the move

A nightly backup of the database and the attached files, with a restore test before relying on it.
Keep the old Airtable base read-only for a while, as a reference, then close it.
Programs that wrote to Airtable get their own narrow access tokens on the new database, one per program, so any one can be switched off on its own.

Clean up your address book without Google or iCloud

2026-10-14T00:00:00Z

Address books rot quietly. Every mail app saves the addresses you write to, every phone adds its own copies, and an old Google export brings the same people back under slightly different names. Ours had 675 cards. After cleaning it held 207 contacts, and they now sync between an iPhone and an Android phone through a standard contacts server (CardDAV) at our email provider, without Google or iCloud.

1. Back up first, and at every stage

Export everything before you change anything, and again after each step. On an iPhone you need no app for this: Contacts → Lists → press and hold the list → Export. Keep each export with a date in its name. You will need one of them; we did.

2. Gather every source into one place

Bring in the old exports and the contacts that only live on a phone. Most will already be there: of 159 contacts from an old Google export, 151 matched cards we had, and 110 of 113 phone-only contacts did too. The rest are the ones worth adding.

3. Remove junk by what's on the card, never by group

An automatically saved address looks the same every time: no name (or the name is just the email address), no phone number and no organisation. 100 of our cards were like that, and those are safe to remove. A card with a phone number or a company name was saved by a person, even if it has no name.

Here is the mistake. Our mail provider keeps an "Autosaved" group, and it looked like the junk list. It isn't: it holds every address ever captured, including people later given phone numbers and job titles. Deleting its members took the address book from 519 cards to 84. Everything came back from the backup, but it took two passes, because 22 cards reported success on the first pass without actually being saved. Check what is inside a group, a label or a folder, and count it, before you delete by it.

4. Merge duplicates, with a guard

Cards that share an email address or a phone number are usually the same person. Merge them onto the fullest card and keep every email and phone from the others; that took our duplicate groups from 48 to 3. The guard: a shared address such as info@ or office@ links different people. When the names on a shared email or phone don't agree, a person decides, not the tool.

5. Curate by hand

No tool knows whom you'll call again. We went through the remainder by hand and removed 312 contacts that had only an email address and that nobody needed.

6. Connect the devices, in the right order

Clear a phone's own contacts before you add the sync account, never after. Once the account is attached, a bulk delete on the phone can reach the server and remove the contacts everywhere.

Things that surprised us

A server can answer "saved" and not save. After any bulk upload, read the contacts back and check.
Each card has an internal ID, and the same person can survive under a different one. Comparing by ID over-counts what was lost; compare by name, email and phone instead.
After a restore, look for duplicates again, and only remove a copy that adds nothing. One of seven we checked held a phone number the other card lacked.

Our free contacts cleaner does steps 3 and 4 in your browser, using these same rules.

Monitors you won't learn to ignore

2026-10-14T00:00:00Z

A monitor has one job: to be believed when it speaks. Every false alarm spends some of that trust, and the real failure eventually arrives looking exactly like the ones you learned to dismiss.

What went wrong

Our daily backup check looked at whether the home server was reachable at the moment it ran. When the server moved off the office network and onto a connection across the internet, it was often briefly unreachable at that exact minute. One morning the check fired at 9:00 and the connection came back at 9:27. Twelve alerts like that had fired, four of them in five days, and none of them meant anything.

Alarm on how long, not on a single moment

We changed the check to ask how long something has been down, not whether it is down right now. It now alarms only after more than 26 hours: a day, plus slack. We tested it at 30 minutes, 25 hours, 27 hours, a week and "never seen": silent inside the window, loud outside it. Real errors, such as a sync folder reporting a failure, still alarm at once.

Check the destination, not the sender's log

Twice a log said everything was fine while nothing was arriving. One job's log cleared its own failure when a later run reported "no change". In another case the local state looked healthy while every upload was failing. The only reliable test is to look at the other end: is the newest copy actually there, and how old is it?

Let silence be the alarm

A checker that has stopped running sends no error. So ours reports every day to a small service elsewhere, and that service raises the alarm when a report doesn't arrive. A daily "all OK" message is also worth having: it proves the watcher is still watching.

Don't cry wolf about the network

Retry, with pauses. Up to five attempts, waiting 15, 30, 45 and 60 seconds between them. Don't retry when the other side rejects the report outright; that needs a person.
Wait for the network after waking. A laptop that wakes up runs its scheduled jobs before Wi-Fi is back. Ours now waits up to two and a half minutes for the connection, then checks anyway and says so.
Warn for a blip, alarm for a stuck state. A brief outage is logged as a warning; only something that stays broken becomes an alert.

Watch for shrinking, too

A database that has been emptied still backs up "successfully". Our check compares the row count with the previous backup and flags a drop of more than 20%.

Say it once, remind, and say when it's over

Our mail server monitor alerts on the first failure, reminds every six hours while it lasts, and sends a message when things recover. You always know whether a problem is still open without digging.

For the backups themselves, see Backups you have actually restored.