I Tracked Every Signup Email for 30 Days. Here's the Data.

I'm a backend developer, and last month I did something slightly unhinged: I wiped my laptop, started fresh, and logged every single email that arrived because I had typed my address into a signup form. Not newsletters I chose. Not mailing lists I joined on purpose. Just the mail that exists because a form somewhere asked for my email and I gave it my real one.

The setup was simple. A fresh Gmail label called "signup-trace". A spreadsheet with four columns: date, service, why I signed up, emails received in 30 days. Eleven signups in the first week. A CI tool trial, a cloud free tier, a domain registrar, a monitoring SaaS, a VPN trial, a job-board alert, a conference CFP form, a design-asset site, a font library, and two dev newsletters I actually wanted.

Here is the 30-day tally from those eleven signups: 147 emails.

The breakdown is the part that got me. Marketing newsletters: 68. "Product updates" that were marketing wearing a different hat: 34. Onboarding drip sequences: 21. Receipts and invoices I actually needed: 9. Genuinely useful mail, security alerts and billing notices: 15. Out of 147, about 24 were worth opening. The rest was noise I had technically agreed to by clicking "Create account".

Two details made it worse. First, six of the eleven kept emailing after I unsubscribed or deleted the account. The unsubscribe link worked, the mail stopped for a week, then a "we miss you" campaign started from a different sending address. Second, two of them clearly shared my address. I know because "partner offers" from companies I'd never heard of started arriving, referencing the original signup.

The unsubscribe treadmill

I unsubscribed from all marketing mail in week two as part of the experiment, and the mechanics were depressing. Three services sent a confirmation and actually stopped. Two stopped for exactly one week, then a win-back sequence started from a different subdomain that my filters did not catch. One never honored it at all; the unsubscribe link just reloaded the preferences page with everything still checked.

Total time spent unsubscribing across eleven services: forty minutes. Total reduction in mail: about a third, and only from the honest ones. The spreadsheet made the conclusion unavoidable. Unsubscribing is damage control on a process that should never have started. The address was already in their CRM, their analytics pipeline, and in two cases, somebody else's list entirely.

Reproduce it yourself

You do not need my spreadsheet. Create a label, route every signup through it for a month, and log four columns: service, reason, date, count. The discipline that matters is using your real address for everything, the way most of us do by default. After 30 days, sort by count. I guarantee the top three will surprise you. Mine were a font library and a conference CFP form, two signups I barely remembered making. That is the whole point of the exercise. The mail you forgot signing up for is the mail you would never miss.

The part developers already know but ignore

Your email address is a join key. One string, reused across twenty services, lets anyone holding two leaked databases merge your profiles. Forum posts, shopping history, job applications, all tied together by a single identifier. And every signup form adds another row to somebody's table: your address, a timestamp, an IP address, sometimes a lot more.

Nothing here is news to a backend dev. What surprised me was the volume math. Eleven casual signups, 147 emails in a month. Scale that to a year of normal developer life, new tools every week, conference registrations, trial accounts for evaluating libraries, and you are looking at well over a thousand signup-originated emails a year landing in the one inbox that also holds your bank alerts and your password resets.

Concrete example from my own log: the font library signup asked only for an email. A year earlier, a breach at a forum I used exposed the same address paired with a username. Anyone holding both datasets can now connect my font-library account to my forum posts. I gave neither party permission to be combined. The combination happened anyway, because the join key was identical.

The inbox is also the root of your account recovery chain. Forgot-password flows send their reset link to email. That makes the address itself the most valuable credential you own, and most of us spray it across the internet like confetti.

Week five: the switch

After 30 days of logging, I changed one variable. Same kinds of signups, but the address I typed into each form was disposable. My real address stayed reserved for exactly three categories: banking, government services, and the messaging accounts where losing access would actually hurt.

The result after another 30 days: zero signup-originated emails in my real inbox. Not fewer. Zero.

The disposable inbox caught everything the signups needed. OTP codes landed in about ten seconds. Verification links worked on the first click. The one time a trial asked me to confirm from the same address a week later, the inbox was still there, because tempmail.is addresses persist instead of self-destructing after ten minutes.

Here is the exact workflow, since developers like concrete steps. I open tempmail.is and an address is already waiting, something like [email protected]. If I want a memorable one for a trial I might revisit, I open the Create New Address modal, type a username, pick a domain from the dropdown, and hit the dark Create Custom Address button. Otherwise I just take the random one. Copy button, paste into the signup form, and the inbox on the same page refreshes on its own when the OTP arrives. Under a minute, start to finish. When the trial ends, I stop thinking about that address entirely. There is no account to delete, no unsubscribe link to hunt, no "we miss you" campaign, because the address was never connected to me in the first place.

One thing worth knowing: the service is receive-only by design. For signup verification that is all you need. The inbox cannot send mail, which is also why it is useless to spammers, and that is a feature, not a gap.

What it does not do

Honest limitations, because every tool has them. The service is receive-only, so if a signup flow needs a back-and-forth with support, use your real address. Do not use disposable addresses for banking, government services, healthcare, or anything where losing access would be a real problem. The address lives in your browser data, so if you clear cookies and site data, you lose it. And some sites block disposable domains outright. When that happens, no trick gets you past it, and you should just decide whether the signup is worth your real address.

FAQs

Do OTP and 2FA codes actually arrive?
In my testing, yes, within seconds, and the inbox refreshes by itself. If a code is time-sensitive, keep the tab open until it lands.

What if I need the account months later?
Use a custom alias you can remember and bookmark the page. The address persists as long as your browser data does. For anything you might need in a year, use your real address instead.

Do sites detect and block these addresses?
Some do. It is their right, and it usually means they really want your real address, which is itself useful information.

Is it actually free? What is the catch?
It is free, no signup, no paid tier pushed at you. The site runs ads, which is stated openly.

Can I automate the logging?
A Gmail filter that labels mail from senders you do not recognize gets you halfway there. The manual part, writing down why you signed up, is what makes the data honest.

The takeaway

I started the experiment expecting maybe thirty emails. I got 147, and only 24 mattered. The fix was not a better spam filter or stricter unsubscribing. It was never giving the address out in the first place. If you want to run the same experiment, start here: https://tempmail.is

Sharing practical tips on keeping your inbox spam-free. I use tempmail.is — free temporary email, no signup. https://tempmail.is