Give your real address to people, not to organisations. That's the whole rule. Friends, family, colleagues and anyone who'd phone you if the email bounced — real address. Shops, apps, newsletters, trials, wifi portals, competitions and anything with a signup form — an address you can switch off. It isn't about whether a company is trustworthy today; it's about whether you'd still be able to cut them off in five years.
Why trustworthiness is the wrong test
People instinctively sort companies into "reputable, fine to give my real address" and "sketchy, use something else." That test fails, for three reasons that have nothing to do with anyone's intentions.
- Reputable companies get breached. Security failures aren't correlated with brand quality in the way people assume.
- Reputable companies get acquired. Customer lists are assets. The publisher you trusted in 2019 may be owned by a marketing group by 2026, and their view of your address is not the original company's view.
- Reputable companies share lawfully. The FTC's consumer guidance is blunt: when you give a company your address, "it might share or sell it to third parties." That isn't misconduct; often it's disclosed in a policy you agreed to. Source: FTC. Checked: 2026-08-19.
So the useful question isn't "do I trust them?" It's "what happens if this relationship goes wrong in a way neither of us intends?"
The rule, applied
| Who's asking | What to give |
|---|---|
| A person who knows you | Real address |
| Your employer, your accountant, your doctor | Real address |
| Bank, insurer, government | A dedicated alias you never disable — attribution without risk |
| Any shop, app, subscription or newsletter | Its own alias |
| Free trial you might not keep | Its own alias |
| Wifi portal, competition, gated download | Its own alias, expect to disable it |
| Anything published publicly | An alias you're prepared to burn |
Note the third row. High-stakes institutions still get their own address — not because you distrust them, but because attribution is valuable everywhere and it costs nothing. You simply never disable that one while the account is live. Avoiding the lockout mistake.
"But isn't that dishonest?"
No, and it's worth saying plainly because people worry about it. An alias is a real, working address that belongs to you and reliably reaches you. You're not giving a false address — that would break the relationship, and it's why disposable addresses cause problems.
You're giving a real address that's specific to that relationship. Businesses do exactly this constantly, with role addresses and per-department contacts, and nobody considers it deceptive.
What this doesn't do
You typed your real name, delivery address and card details into the same form. The alias hides which inbox the mail lands in; it does not hide who you are. Treat it as spam control and attribution, not as a disguise.
Starting from an address you've already given out
Most people are here. Your real address is already with several hundred organisations and there's no recall.
That doesn't make the rule pointless — it changes what you're optimising for. You're no longer preventing the first leak; you're stopping the number growing, and making every future one attributable and switchable. Apply the rule from today and migrate old accounts only when they happen to email you. The practical routine.