The pile you can’t take back — and the pile you’re still building
Your Gmail address is probably listed on 80 different sites. Your phone number is on 150. This didn’t happen because of one bad decision. You signed up for things over years. Companies sold that data to brokers, and brokers sold it to other brokers. Then somewhere in 2019 a database got breached, and your details ended up in a dump that circulates on Telegram to this day.
That data is out there. You can work on cleaning it up — removing your information from broker sites is a separate fight worth having.
This post is about a different problem: the pile you’re still building right now. Every signup you complete today adds to it. That’s what email aliases and phone masks are designed to stop.
Why compartmentalization matters
Most people use one email address for everything. That feels fine until a company you barely remember — some food delivery app from 2021, a discount coupon site — gets breached. Now every service you’ve ever signed up for knows your email is valid and active. Spam floods in. Credential stuffing attacks start. The breach at one service becomes a problem for all of them.
Email aliases break this chain. You create a different alias for each service — myntra-8x2j@simplelogin.com for Myntra, zomato-k9p1@simplelogin.com for Zomato. When Zomato gets breached (or sells your data), only that alias is exposed. You delete the alias. Damage stops there. Your actual inbox and identity stay clean.
This is compartmentalization. It’s not paranoia — it’s how you manage risk when you can’t control what companies do with your data.
Email aliases: the options for Indian users
Four tools are worth your time. Here’s what they actually cost and where they fall short.
SimpleLogin is the strongest recommendation. It’s now owned by Proton (the Swiss privacy company), which adds credibility. The free tier gives you 10 aliases — enough to get started. Paid plans (around ₹2,500/year (approximately $30/year)) give you unlimited aliases, custom domains, and more. It works with any email provider, including Gmail. You create an alias, forward it to your real inbox, and reply from it without revealing your real address. Setup takes about five minutes.
DuckDuckGo Email Protection is free with no account required — you just need the DuckDuckGo app or browser extension. It gives you a @duck.com forwarding address that strips tracking pixels before delivering email to your real inbox. The limitation: you can’t create per-service aliases, just one address. It’s a good starting point if you want something that works immediately.
Apple Hide My Email generates random aliases that forward to your iCloud address. It’s well-integrated if you use an iPhone. The catch: it requires an iCloud+ subscription, which costs ₹75/month in India. If you’re already paying for iCloud storage, this is essentially free. If you’re not, SimpleLogin is the better choice.
Firefox Relay gives you five aliases on the free tier as part of Mozilla’s ecosystem. It works, but the free limit is tight. It’s worth knowing about; it’s not the first recommendation for most users.
Virtual phone numbers for Indian users
Phone is harder than email. Genuinely anonymous virtual numbers are not a practical option in India — SIM registration requirements mean every number is linked to an Aadhaar or passport at the point of purchase. Anyone claiming to sell you a truly anonymous Indian number is either mistaken or operating in a grey area you don’t want to touch.
So what actually works?
A secondary Jio SIM is the most practical approach by far. A Jio prepaid SIM costs around ₹149 and gives you a real +91 number. Use it exclusively for signups, OTPs, and services you don’t trust with your primary number. Your primary number stays reserved for banking, Aadhaar-linked services, and people you actually know. Most Indian apps require a +91 number for OTP verification — this satisfies that requirement cleanly.
TextNow or Google Voice give you US numbers. They don’t work for Indian OTPs that require +91. Don’t bother for Indian services.
Airtel’s virtual number features exist in limited form for business accounts. Not practical for individual consumers at this stage.
A WhatsApp Business account on a secondary number is worth considering if you want to keep your primary WhatsApp clean. You can run both accounts on the same phone using WhatsApp’s dual-account support (available natively on most Android phones, and via WhatsApp’s own multi-account feature). The secondary number receives business or commercial messages; your primary stays personal.
The honest answer: for most Indian users, a secondary Jio SIM does the job.
A practical setup that takes 30 minutes
Here’s what an actual privacy setup looks like — not theoretical, just the steps.
Start with SimpleLogin. Create a free account at simplelogin.io, connect it to your existing Gmail or email provider. Make one alias and use it for your next signup. That’s the whole workflow — one alias per service, going forward.
For phone, pick up a Jio prepaid SIM from any Jio store or mobile shop (bring your Aadhaar). Activate it. This becomes your “signup number.” Use it wherever an app or site asks for a phone number and you’re not sure you trust them.
Going forward: use your primary email and phone number only for things that genuinely need them — your bank, your Aadhaar-linked services, government portals, EPFO, UPI. Everything else gets an alias and the secondary SIM.
That’s it. Thirty minutes of setup, and you stop building the pile.
The limit of these tools
Email aliases and phone masks are forward-looking. They protect the data you haven’t handed over yet. They do nothing about the 80 sites already listing your Gmail, or the breach dump from 2019 that has your Airtel number.
For that — the data already out there — you need removal requests. India’s DPDPA gives you the right to request deletion of your personal data from companies that collect it. Read the practical guide to removing your data from Indian sites for how that process actually works.
For formal rights under the DPDPA — including how to file complaints with the Data Protection Board — the DPDPA rights guide covers the steps.
These two tracks work together. Aliases and masks stop the bleeding going forward. Removal requests clean up what’s already there. Neither one is a replacement for the other.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.