Protect Your Privacy When Signing Up for Apps: A Practical Guide

To protect your privacy when you sign up for apps, give each one only what it needs and use stand-ins for the rest: an email alias instead of your main address, a second or temporary number instead of your real one, and a unique password from a password manager. Keep your real phone number and main email for the handful of accounts where losing access would really hurt.

Why your phone number deserves extra care

Your phone number is one of the most revealing things you hand over at sign-up:

It rarely changes. People switch email addresses and usernames, but tend to keep a phone number for years. That makes it work like an ID that links your accounts together.
It leaks. When an app's database leaks, numbers end up on spam and scam lists, and data brokers can match them across sources.
It can be hijacked. In a SIM-swap scam, someone talks your carrier into moving your number to their SIM, then receives your SMS codes. Many carriers let you set an account PIN or turn on extra protection against this. Ask yours.
It exposes your contacts. Apps that ask to upload your address book collect other people's numbers too.

Sort your accounts into three groups

You don't need to treat every sign-up the same way. Decide first which group an account belongs in:

Core accounts: main email, bank, payment apps, phone carrier, password manager, government and health services. Use your real number, your real email, and the strongest login protection offered: a passkey, a security key or an authenticator app.

Keepers: shopping, social media, subscriptions, travel and work tools. Use an email alias, a password from your password manager, and either your real number or a private second number. Turn on two-factor login.

Throwaways: one-time downloads, Wi-Fi portals, a forum you'll visit once, an app you're only trying out. Use a disposable email or alias, a temporary number if one is demanded, and no real name.

Putting each new account in a group takes a few seconds and settles every other choice below.

Email: use aliases

Plus addressing is the quickest trick. With Gmail and several other providers, mail sent to yourname+shopname@... still reaches yourname@..., and you can see which company leaked or sold your address. The downsides: some sites reject the + sign, and anyone can strip the tag to find your real address.

Alias services go further. They create a separate, random-looking address for each site and forward the mail to your real inbox. If one starts getting spam, you switch it off. Examples include Apple's Hide My Email (part of iCloud+), Firefox Relay, SimpleLogin and DuckDuckGo Email Protection. Several have a free tier.

Sign in with Apple can hide your email too. Choose "Hide My Email" when an app offers it, and the app only gets a relay address.

Sign in with Google or Facebook is convenient, but it shares profile details with the app and links the two accounts. Skip it when you want an account kept separate.

Phone numbers: give out less

Leave the field empty when it's optional. Many sign-up forms ask for a number without needing one.
For throwaways, a free public number works when an app insists. Pick one with a recent "Last SMS" from the live list, or one that recently got a code from that app via the services page. Remember that everyone can read its messages.
For keepers, use a private second number, such as an eSIM line or prepaid SIM, so only you see the codes. Our comparison of temporary vs virtual vs burner numbers explains the options.
For core accounts, use your real number and add your carrier's protection against SIM swaps.
Prefer an authenticator app over SMS for two-factor login wherever it's offered.

Settings worth changing during sign-up

Contacts: decline. You can usually still add friends by username.
Location: choose "While using the app", and turn off precise location if the app doesn't need it. Both iPhone and Android let you share an approximate location instead.
Tracking: on iPhone, tap "Ask App Not to Track". On recent Android versions, you can delete your advertising ID in the privacy settings.
Discoverability: messaging apps such as Telegram and Signal let you hide your number from other users and control who can find you by it.
Marketing boxes: untick them before you tap "Create account".

A one-minute sign-up routine

Decide the group: core, keeper or throwaway.
Create an alias and a unique password in your password manager.
Give a phone number only if it's required, and choose which one by group.
Decline contacts and precise location.
Note in your password manager which alias and number you used. Months later, you'll know exactly where that address or number lives.
If you're keeping the account, turn on two-factor login with an authenticator app.

What to do with accounts you already have

You don't have to fix everything at once. Start with the accounts most likely to cause trouble:

Swap SMS for an authenticator app on your core accounts.
Replace your main email with an alias on shopping and social accounts, starting with the ones that send the most marketing.
Remove your phone number from apps that don't need it. Many let you delete it in the account or privacy settings.
Close accounts you no longer use. An account that doesn't exist can't leak.

The trade-off with public numbers

Free public numbers are good at one thing: keeping your real number out of an app you don't trust. They're bad at everything that needs privacy after sign-up, because every message is visible to anyone. Use them for throwaways only. For more on the risks, read are temporary phone numbers safe?