Addresses expire.
Obligations don’t.

Take stock: what hangs off this address

When a temporary address expires, only the mail slot disappears. The accounts, the billing, the third-party grants — all of it stays exactly where it was. So the first move is not deleting anything: spend two minutes listing what you signed up for with this address, and sort it into three piles. Things you will still log into (login access). Things to take with you (records and files). Things to disconnect (outbound grants).

Sorting beats sequencing. Anything with a payment method or work data goes first; a pure-download service is finished the moment the file is safe. Don’t spread effort evenly.

Asset one: login access — rebind, then retest

Rebinding must happen while the old address still receives and the current session is still alive. In the account’s security settings, switch the email to an address you control for the long term — or a forwarding alias — and confirm the verification message it sends.

Rebinding is not done until it is retested: sign out, sign back in with the new address, trigger a harmless notification, and watch it land. Login email, notification email and billing contact are often three separate fields; check each one instead of trusting the main field.

Recovery paths in the same pass

Verify the backup email, recovery codes and authenticator app while you are there. Turn on two-factor for accounts that matter and store the recovery codes offline — it is a second road home, not a substitute for the rebind.

Asset two: records and files — take only what you’ll reuse

Receipts, license keys, exports and contract confirmations may exist nowhere except this inbox. For each one, confirm two things: does the download link still open, and do the invoice’s amount, merchant and date actually check out?

Keep only what future-you will genuinely open again. “Might be useful someday” marketing mail does not earn space in controlled storage, and anything holding personal data belongs in encrypted storage — not a shared desktop or a public download folder.

• One-off download: verify it opens, then let it go;
• Invoices and proofs: save as PDF and verify the key fields;
• License keys: into the password manager, never plain-text notes.

Asset three: outbound grants — subscriptions, OAuth and keys

An expiring address cancels nothing on its own. Open the billing page, confirm the plan and the next charge date, cancel through the proper flow, and keep the confirmation page or email. Deleting mail or closing the tab ends no contract.

If you signed up through “log in with…”, revoke it in the identity provider’s connected-apps list. Developer services deserve a sweep of API keys, webhooks and team invites. Finish with “sign out of all devices” to end any leftover sessions.

Acceptance: one drill that ignores the old address

A single exercise proves the handover: pretend the old address is already gone, then walk every kept account through the loop — log in, receive a notification, open password reset and confirm it points at the new address. All green, and the countdown can run out in peace.

If wind-downs always feel rushed, the problem sits at the start, not the end. The three-hour planner reserves time for verifying, using and winding down at the moment you create the address.

Durable privacy is not hoarding addresses; it is giving each address one clear, finite job — temp inboxes for short tasks, switch-off-able forwarding aliases for contact that lasts.