Most people keep email by default. Deleting feels like losing something, and storage is cheap, so the mailbox grows year after year. Each message you keep is a copy of something someone else sent you, and it stays exposed for as long as it sits in an account, on a device or in a backup. Retention is a privacy decision, even if it rarely feels like one. This article describes how to make that decision deliberately.
What old mail holds
A long mailbox is rarely a list of trivial messages. It tends to contain the things that answer security questions: the name of a first school, a booking reference, a tax identifier, a passport scan sent to a landlord, a password reset link that was never used. It also contains a map of your life, including who you contacted, when, and about what. Account recovery often depends on reading mail, so an attacker who gets into one mailbox can use it to reach others.
Where copies accumulate
A message you think you deleted may still exist in several places:
- The server, in a folder you forgot about, or in Trash until it is emptied. On ITProMail, Trash is emptied after 14 days.
- Local caches in desktop and phone clients, which often keep a full copy even when the server has removed the message.
- Exports, mirrors and encrypted archives you made for backup.
- Forwarded copies in other people's mailboxes, which you cannot control.
Deleting on the server is necessary but not sufficient. A complete retention plan has to cover the local and backup copies too.
A practical set of categories
Rather than deciding message by message, sort mail into a few categories and set a default for each. The durations below are examples to adapt, not rules. Some obligations, such as tax or warranty records, depend on where you live and should be checked against your local requirements.
| Category | Typical content | Suggested default |
|---|---|---|
| Newsletters and marketing | Promotions, digests, product updates | Delete or unsubscribe; keep nothing |
| Notifications | Shipping, app alerts, automated reminders | Keep only until the event is resolved |
| Receipts and invoices | Purchases, subscriptions, warranties | Keep for the period you need, then archive or delete |
| Security notices | Login alerts, recovery codes, password changes | Delete once the event is over; keep recovery codes in a password manager instead |
| Personal correspondence | Messages with people you know | Decide per relationship; prune attachments first |
| Identity and financial documents | Scans, statements, tax forms | Move to encrypted storage, then remove from the mailbox |
Attachments are the usual problem
Most of the sensitive content in a mailbox is in attachments, and most of the storage is too. Attachments are the first thing to address. Save what you need to an encrypted location, remove the message, or ask the sender to share a link you can revoke. A folder full of scanned documents is much easier to secure than the same documents scattered across years of threads.
Build a routine, not a clean-out
A one-time purge is satisfying and rarely lasts. A short recurring routine works better: once a quarter, clear newsletters, empty Trash, review the Sent and Archive folders, and check for attachments above a size you care about. Filters can route mail into folders so the review is quicker. Standard Sieve has no concept of message age, so deletion by age has to happen in the client or by a manual step. Some clients offer age-based cleanup for local copies; check your client's settings before enabling it.
Closing an account
When you leave a service, check what it will keep. ITProMail makes the account read-only for 30 days after closure, then deletes it permanently. Export the mailbox first with Account > Export or an IMAP tool, so the copy you keep is one you chose. The export guide describes the options. After closing, remove the account from your clients and password manager, so local copies are not confused with a live mailbox.
The short version
- Decide a default for each category of mail, and write it down.
- Move sensitive attachments out of the mailbox into encrypted storage.
- Remember that deleted mail persists in caches and backups until those are cleaned too.
- Review on a schedule. A habit beats a one-off purge.
Keeping less is not about hiding anything. It reduces what a breach, a lost device or a compromised account can expose. The threat modelling article shows how to weigh that against the value of keeping records.