Blog
A Privacy Checklist to Run Before You Sign Up for Anything
Six checks that take ninety seconds and decide which address a form deserves, plus the four form patterns that reliably signal your details are the product.
The moment worth intervening at is before you type, not after the mail starts arriving. This is a ninety-second routine that decides how much of yourself a given form gets.
The six checks
1. What is genuinely required?
Required fields are marked. Everything else is optional even when the layout implies otherwise. Fill in the marked ones and skip the rest — nothing else on this list saves as much.
If a form marks date of birth, phone number, and postcode as required for a newsletter, that is not a newsletter form. It is a data-collection form with a newsletter attached.
2. What is the last message I will ever want from this sender?
- Arriving in the next minute → disposable inbox.
- Arriving next week or next year → alias, or your real address.
This one question does most of the routing work. It is more useful than "is this important?", which is unanswerable in the moment.
3. Will I ever need to log back in?
If yes, the address must still exist then. Password resets go to the address on file, and no support desk can work around a mailbox that no longer resolves.
4. Where does this go if the company disappears?
Customer lists are assets. They are sold in acquisitions, transferred in bankruptcies, and occasionally leaked wholesale. Assume anything you provide may end up with a company you have never heard of. That is not cynicism; it is standard practice and usually disclosed in the privacy policy nobody reads.
5. Does the payment method need to be stored?
For a one-off purchase, usually not. A stored card is a permanent record and a join key in its own right, and guest checkout exists on most stores that hide it well.
6. Is there a marketing box already ticked?
Pre-ticked consent is unlawful in many jurisdictions and still common. Scan for it before submitting, including the one below the button that you have to scroll to see.
Four patterns that should change your answer
Certain form designs reliably indicate that your details, not the product, are what is being collected.
| Pattern | What it usually means |
|---|---|
| Phone number required for a text-only service | The number is being collected for resale or SMS marketing, not for the service |
| Date of birth for something with no age restriction | Demographic segmentation, sold onward |
| "Partner offers" checked by default | Your details are already routed to third parties by design |
| A privacy policy that lists no company name | Nobody has taken responsibility for what happens next |
Any two of these together is a strong signal to give this form the least you can and treat the relationship as single-use.
The routing decision, condensed
After the six checks, one of three outcomes:
- Disposable inbox. Single message, no login, nothing to recover. Wi-Fi portal, gated download, one-off quote.
- Alias. Ongoing but revocable. Shops, newsletters, communities, anything you might grow tired of.
- Real address. Money, identity, employment, health, or anything you would be genuinely upset to lose access to.
When you are unsure between disposable and alias, take the alias every time. The downside of an unnecessary alias is a minute of setup. The downside of an unnecessary disposable address is an account you can never get back into.
After you submit
Two habits that keep the benefit:
Note it down. A single line in a text file — date, site, which address you used. Two weeks of this reveals exactly which signups generate mail you did not want, which is information no filter can give you.
Set a reminder for free trials. In your calendar, two days before the trial ends. The cancellation warning email is not something to rely on; it is frequently late, occasionally missing, and always designed to be easy to miss.
The signup safety checker runs this same logic interactively if you would rather answer questions than remember a list, and the spam risk checklist scores the form itself.
FAQ
Is it acceptable to leave optional fields blank?
Yes. They are optional by the site's own declaration. If the form breaks or the service later demands the data, that tells you something useful about what the signup was for.
What if a site requires a phone number I do not want to give?
Consider whether you need the service. If you do, some jurisdictions give you a right to have data deleted afterwards, and a virtual number is an option for services that only send codes.
How can I tell if a privacy policy is trustworthy?
Look for a named legal entity, a physical address, and a specific retention period. Vagueness on any of those three is the signal, more than the policy's length.
Should I read the terms of service every time?
Skimming for three things is enough: what happens to your data, whether accounts can be closed without notice, and whether disposable addresses are prohibited. That takes under a minute.
Does this checklist apply to mobile apps?
Yes, and app permissions matter more. An app requesting contacts or location for a function that plainly does not need either deserves the same suspicion as the form patterns above.