an account without an email address

almost every service asks for an email address. almost none of them need it for the reason you think.

why an email address is the problem

• it is the same string everywhere. the address you type on account X is the one you used on three other sites, so it becomes a join key that ties those accounts together.
• it usually has your name in it. it is also often already sitting in a public breach dump, next to other accounts of yours.
• it is a channel to you, and it outlives the account. even after an operator deletes your data, your address can still sit in a mailing-list export somewhere.
• most services use it for two things: password resets and marketing. only the first one helps you.

what a passkey does instead

a passkey is a pair of keys. your device keeps the private one. the service stores only the public one. signing in is your device proving it still holds the private key; unlocked with face id, touch id, or your device pin.

• there is no shared secret to steal. if the service is breached, what leaks is a public key, useless on its own.
• each site gets its own key, by design. that key cannot link your accounts the way a reused address or password can.
• it cannot be phished the way a password can. the key is bound to the real site's domain, so a fake page has nothing to steal. whatcan still be phished is any weaker fallback behind it -- the honest cost of offering an optional password.
• nothing about it names you. no name, no address, no phone number.

the trade-off

no email means no password reset. lose every device that holds the passkey and the account is gone. nobody can prove you are you -- that is the same property that keeps it private. most platforms copy passkeys across your devices through your apple or google account, which covers a lost phone. it does not cover losing that apple or google account itself.

it also meansan operator cannot reach you. no security notices. no "someone signed in from a new device" email. worth knowing before you decide this is what you want.

how sissy-haven handles this

we never ask for an email address, and there is nowhere to type one. you pick a handle, register a passkey, and that is the account. there is an optional password as a second way in, for devices where passkeys are awkward -- with no reset flow, for the reason above.

what we keep is deliberately short, and the privacy page lists it in full. the summary: a handle, a coarse location square if you give one, your posts, and your messages. no email, no phone number, no real name, no third-party analytics.

an account that holds almost nothing is only half the story. what you then post matters more; see the checklist for sharing a photo safely and what "delete" actually does.

making one takes a handle and a passkey, and nothing else.