Print or copy this into a note and mark each item done, not applicable, or investigate. It covers mailbox security and maintenance, not the larger question of which accounts belong in your digital life. The complete email privacy guide is the live parent reference.

1. Secure the mailbox before cleaning it

  • Done / N/A / Investigate: The mailbox has a unique password stored in a password manager.
  • Done / N/A / Investigate: MFA is enabled; a passkey or security key is used where supported.
  • Done / N/A / Investigate: Recovery email addresses and phone numbers are current and controlled by you.
  • Done / N/A / Investigate: Recent sessions and devices contain no unfamiliar entry.
  • Done / N/A / Investigate: Forwarding rules, filters, delegates, and connected apps contain no change you did not make.
  • Done / N/A / Investigate: Backup codes are stored somewhere safe and are not in the mailbox itself.

If an item is unfamiliar, stop the cleanup and investigate it first. Deleting messages will not fix an account-control problem.

2. Start with your noisiest senders

Write the senders here before taking action:

For each sender, choose one action:

  • Keep and route to a folder or label.
  • Unsubscribe because you recognize the publisher and no longer want it.
  • Filter it into a review folder without deleting it.
  • Report it as spam or phishing because it is suspicious or unsolicited.
  • Investigate because it may be account-service mail rather than marketing.

Do not open attachments or follow links merely to inspect suspicious spam. Provider controls and the message’s reporting function are safer than interacting with the content.

3. Preserve records before deletion

  • Save receipts, invoices, warranties, tax material, medical or insurance records, and work or school documents where appropriate.
  • Check whether the message is the only proof of a purchase, subscription, cancellation, dispute, or account change.
  • Confirm the service’s retention and export options before closing an account.
  • Keep a copy of a breach notice, suspicious-account timeline, or support case when it may be needed later.
  • Empty spam and trash only after the review is complete and your provider’s retention behavior is understood.

Retention obligations vary by country, employer, institution, and document type. When unsure, preserve first and ask the relevant organization.

4. Set the next-signup rule

Future need Address lane
Recovery, finance, health, identity, work, or essential people High-trust durable inbox
Shopping, newsletters, communities, or an account you may keep Durable secondary inbox or alias
A one-time, low-consequence interaction with no later access Temporary inbox

An alias can separate and identify a sender, but it usually still routes to a mailbox you must secure. Temporary email is not suitable for records, recovery, private conversations, payment, or saved work. For the comparison details, read email aliases vs temporary email; for concrete low-commitment cases, see 10 signups that do not need your primary email.

Before using a temporary address, ask: “Would losing this inbox create a problem?” If the answer is yes or uncertain, choose durable.

5. Choose a maintenance rhythm that fits the account

After suspicious activity or loss of a recovery method

  • Review sessions, recovery methods, forwarding rules, filters, and connected apps.
  • Change exposed or reused credentials and revoke sessions where the provider supports it.
  • Preserve evidence before deleting messages or closing the account.

Monthly

  • Process the action-required folder.
  • Review new recurring senders and adjust filters.
  • Remove low-value promotions after saving needed records.

Quarterly

  • Confirm recovery details and MFA still work.
  • Review aliases, secondary inboxes, and connected apps you no longer use.
  • Check storage and large attachments if the provider is near its limit.

A weekly schedule is optional, not a security requirement. Check more often if the inbox handles active work, payments, or frequent subscriptions.

A short cleanup session

Give yourself about ten minutes for each section: secure the mailbox, handle the three largest noise sources, then decide where future signups belong. Stop when you reach the end of the session. Small, repeatable cleanups are less likely to delete a record or hide a security warning than one rushed purge.

Completion check

  • I can explain what belongs in this inbox.
  • I know where important records are stored.
  • I can recognize the account’s recovery path.
  • I have a rule for suspicious mail that does not require clicking it.
  • I have chosen a durable inbox or temporary address before my next low-value signup.