Email & Subscriptions

The spookiest thing in your inbox (it's not a BFCM email)

October 30, 2026

11 min read

Copy Link

The Black Friday emails are about to arrive by the hundred, and they are the least frightening thing in your inbox. The scarier email is the one you got once, years ago, that said "Welcome!"

Quick answer. Every welcome email is a receipt. It proves a company opened a file with your name on it, and that file keeps running long after you stop thinking about the account. The data inside it gets used for marketing, shared with partners and ad networks, exposed in breaches, and in some cases sold along with the company itself. Forgetting an account does nothing to any of that. The only thing that shrinks your exposure is finding those old accounts and closing them, and the fastest place to find them is the inbox that collected all those welcome emails in the first place.

The welcome email is the only record most people have of who holds their data, and almost nobody reads it twice
Signing up starts a relationship with no end date, and the regulator that studied the biggest platforms found some of them could keep data indefinitely
Your data rarely stays with the company you gave it to, and the marketing emails that follow are often reporting back on you
Forgotten accounts are the ones attackers like best, because nobody is watching them
When a company is sold or goes bankrupt, the database is usually the asset, and your old account goes with it
Your inbox is the map back to every one of these accounts, and closing them is the only fix that sticks

What is the spookiest thing in your inbox?

It is the welcome email. You have hundreds of them, and most of them are from companies you have not thought about since the day they arrived.

Think about what a welcome email actually confirms. You typed your name and email address into a form, maybe a phone number and a birthday for the free dessert, and a company stored that as a customer record. The email is the company telling you the record exists. Then it goes quiet, or it turns into a newsletter you stopped opening in 2019, and the record carries on without you.

Troy Hunt, the security researcher who built Have I Been Pwned, started the project after finding his own details in a breach of a company he barely remembered signing up for. He had probably created the account years earlier, and by the time it leaked, he had stopped thinking about the site entirely. That is the whole ghost story. The account you forgot is still very much alive at the other end.

Black Friday emails are loud, and you can see them coming. The welcome emails are quiet, and each one marks a place where a copy of you is still being kept.

What happens to your data after you create an account?

It keeps growing. The signup form is only the first entry in a file that the company adds to every time you show up, and often when you don't.

A customer record starts with whatever you typed in. Then it collects the order history, the device you logged in from, the emails you opened and the links you clicked. Many companies also enrich it with data bought from elsewhere. When the Federal Trade Commission studied nine of the largest social media and video streaming companies, it found they collected data from data brokers about both users and people who had never signed up, and that they could keep all of it indefinitely.

That last part matters more than it sounds. The United States still has no comprehensive federal privacy law, which is exactly what the FTC staff asked Congress to pass, so there is no general rule that says a company has to delete your data when you walk away. The same FTC report called the companies' retention and minimization practices woefully inadequate, and found that some of them did not delete everything even when users asked them to.

So the honest answer to "what happens to my data after I sign up?" is that it stays put and keeps growing. The account goes dormant in your head long before it goes dormant on a server.

Who else gets your data after you sign up?

Usually more companies than the one you signed up with. The emails that arrive after the welcome email are one of the main ways it travels.

Open a marketing email and a tiny invisible image loads with it. That image, a tracking pixel, tells the sender when you opened the email and roughly where you were. In a lot of emails it tells other companies too. Researchers at Princeton signed up for mailing lists on thousands of sites and found that 70% of the emails they received contained trackers, and about 29% passed the recipient's email address to at least one third party the moment the email was viewed. Most of those leaks were intentional on the sender's part. One of the most frequent recipients was the data broker Acxiom.

The usual defense is that the address is hashed, meaning scrambled into a string of characters. The same paper explains why that protects very little: anyone who already has your address can scramble it the same way and match it.

Now scale that up to the season you are about to walk into. Proton audited 50 of the largest US retailers during the 2024 holiday season and estimated they sent more than 10 billion marketing emails over the Black Friday weekend alone, with 80% of them carrying tracking pixels or tracking links. Some J.Crew emails carried up to 40 trackers each.

Every one of those emails went to an address someone handed over at a checkout or a signup form. The BFCM flood is the visible part of a much older decision, which is the account you opened years ago and never closed.

Why are forgotten accounts a privacy risk?

Because an account nobody is watching is the easiest kind to break into, and you will be the last to find out.

Google made this argument itself when it started deleting personal accounts that had sat unused for two years. Its internal analysis found that abandoned accounts are at least 10 times less likely than active ones to have 2-step verification turned on. Once an account is compromised, Google wrote, it can be used for anything from identity theft to sending spam.

Most old accounts are guarded by an old password, and old passwords tend to get reused. When any one of those companies is breached, attackers take the leaked email and password and try the pair on hundreds of other sites. A single forgotten forum login from 2014 can open a door somewhere you actually care about.

And the breaches keep coming. Have I Been Pwned lists 1,048 breached websites and 17,846,896,404 exposed email addresses as of today.

The cruel part is the notification problem. A company you forgot about will send its breach notice to an inbox you stopped reading, or to an address it has on file from a decade ago. The data was exposed either way, and you just never hear about it.

What happens to your account when a company is sold or goes bankrupt?

Your data usually goes with the company, because the customer database counts as an asset like any other.

The clearest recent example is 23andMe. The genetic testing company filed for bankruptcy in March 2025, two years after a breach that exposed data from 6.9 million user accounts. The asset everyone was fighting over was its customers' genetic data, and the question in court was whether that could be sold to whoever bid highest.

The court-appointed consumer privacy ombudsman looked at exactly the issue this article is about, and the report could not say with certainty that a sale fit the company's own privacy policies, especially for customers who opened accounts before June 2022. That was when 23andMe amended its privacy statement to mention that customer data could be sold in a bankruptcy. People who signed up earlier had agreed to a version of the terms that did not say so.

In the end, a judge approved the sale of 23andMe for $305 million to a nonprofit run by its co-founder, which committed to honor the existing deletion policies. Customers could delete their data during the process. They were not asked for opt-in consent before their DNA changed hands, and California argued unsuccessfully that the transfer should have required it.

Most companies holding your old accounts are not sitting on your genome. The pattern still holds for a shoe store or a fitness app you used for a month. When the company folds or gets acquired, the records move to a new owner you never chose, and the privacy policy you skimmed in 2017 may not be the one that governs them.

How do I find and delete accounts I forgot about?

Start with your inbox, because it has kept a better record of your accounts than you have. Every welcome email and password reset points back to a company that still holds a file on you.

Search for the receipts. Try phrases like "welcome to" and "verify your email." Sort by oldest first. The companies you have not heard from in years are the ones worth closing first.
Check which ones have already leaked. Run each of your email addresses through Breach Beacon, Yorba's free breach checker. It needs no signup, and it shows you which companies lost your data. Those accounts go to the top of the list.
Close the account, then ask for deletion. A delete button often removes your login without removing the record. If a privacy law covers you, such as GDPR in Europe or a state law like California's, follow up with a formal deletion request, which comes with a legal deadline the delete button does not.
Keep the list short from now on. Use a separate address or an email alias for one-off purchases and free trials, so the next round of welcome emails lands somewhere you can shut off.

Doing this by hand works, and it is slow. Yorba was built to do the searching for you. It scans your inbox for the accounts and mailing lists tied to your email address and flags the ones that have shown up in a breach. From there you get the deletion instructions for each company. For the companies that make leaving deliberately difficult, Yorba's Personal Deletion Agents handle the request on your behalf.

The point is not a one-time purge. New accounts pile up every time you check out as a guest who somehow ended up with an account anyway. Keeping your digital life clean means checking back, the same way you would check a smoke detector.

Frequently asked questions

Is it safe to just ignore old accounts? No. An account you ignore still exists on the company's servers, and it is less likely to have modern protections like 2-step verification. Ignoring it only means you won't notice when something goes wrong.

Does unsubscribing from emails delete my account? No. Unsubscribing stops the marketing emails. The account and the data attached to it stay exactly where they were.

Can companies keep my data after I delete my account? Often, yes. Many keep some records for legal or financial reasons, and backups can hold data for months. A formal deletion request under a privacy law is stronger than a delete button because it comes with a deadline.

Do tracking pixels work if I don't click anything? Yes. A pixel fires when the email's images load, so simply opening the email is enough. Turning off automatic image loading in your email app blocks most of them.

What happens to my data if a company goes out of business? It is usually treated as an asset. In a sale or bankruptcy, customer records can be transferred to the buyer, as happened when 23andMe was sold in 2025.

How do I find out which companies have my email address? Search your inbox for old welcome and verification emails, or let a tool like Yorba scan it for you. For most people, the inbox is the most complete record of their accounts they have.