This is general safety information, not legal advice, and it is not exhaustive. Every setup is different. Treat it as a starting checklist to adapt to your own circumstances, and check your platform's guidance and the law where you live.
Separating a work identity from a real one is not one decision. It's a few hundred small ones, and the platforms are actively working against you the whole time — quietly linking accounts by phone number, device, contact list and IP address, because connecting people is what they're built to do.
The good news is that almost every real-world unmasking traces back to the same short list of mistakes. Get these right at the start and you're ahead of most people in the industry.
Choosing a stage name
- Never a name you've used online before. Old gamertags, forum handles, an email prefix from 2014 — usernames are trivially cross-searchable, and a single reused handle collapses the whole separation.
- Never a variation of your legal name, and never a nickname friends or family use for you. "Close enough to remember" is close enough to find.
- Search it before you commit. Check it across every major platform and in a plain search engine. You want something distinctive enough to rank for, but not attached to an existing person.
- Don't build it from personal details. Pet names, birth years, street names and childhood addresses are all things a determined person can check against you.
Fresh accounts, from a cold start
Every account attached to your work identity should be new. Not repurposed, not renamed, not "cleaned up" — new.
- A brand new email address that has never been used for anything else, with no personal recovery address attached to it. That recovery address is the thread that unravels everything.
- A separate phone number. A second eSIM or a VOIP number. Your personal number is linked to your name at the carrier and is used by platforms to suggest you to people who have it saved.
- Deny contact permissions at install. This is the single biggest de-anonymisation vector there is. "People you may know" and "Suggested for you" are built from uploaded contact lists — if a client has your personal number saved and you ever grant contact access, the platform will happily introduce you to each other.
- A separate browser profile at minimum, ideally a separate device or OS user account. Cookies, saved logins and autofill leak between tabs in ways you won't notice.
The rules about following
This is where careful people get caught, because it feels harmless.
- Never follow yourself. Not from your personal account, not "just to check it looks right". A single follow is a permanent, public link between two identities.
- Don't follow friends or family from your work account, and don't let them follow you. Well-meaning support from a personal account is a doxx waiting to happen.
- No quiet interactions either. Story views are visible to the poster. Likes are logged. Viewing a personal account while logged into work builds a behavioural link even when nothing is public.
- Assume followers are cross-referenced. If someone appears on both your accounts, they connect them.
Images, words and habits
- Never reuse a photo across identities. Reverse image search is instant, free, and the first thing anyone tries. This includes cropped versions, filtered versions and old profile pictures.
- Never reuse bio text. An exact-phrase search on a distinctive sentence finds every account that used it.
- Strip location data from anything you post. Phone photos carry GPS coordinates in their metadata by default. Turn off location for the camera app entirely rather than remembering to strip each file.
- Watch your writing habits. Distinctive phrasing, emoji patterns and consistent typos are recognisable to anyone who's read both accounts. It's a lower-priority risk than the others here, but it's real.
- Delay travel and event posts. Posting a recognisable location in real time tells people where you are right now, which is a physical safety problem as well as an identity one.
Timing and infrastructure
- Posting times reveal a timezone. If you always go quiet at midnight your time, that's a data point that accumulates. Scheduling tools flatten the pattern.
- Use WHOIS privacy if you buy a domain. Registration records are public by default and have historically listed full name and home address.
- Check link-in-bio pages. Some services expose the account email or an analytics profile tied to a personal login.
- Watch payment app social feeds. Several payment apps default to a public transaction feed showing legal names on both sides.
Audit the other direction too
Most guidance covers stopping people finding your real identity from your work one. The reverse route matters just as much: someone who knows your real name checking whether you cam.
- Set personal accounts to private and audit what's publicly visible from a logged-out browser.
- Look at old public posts — a years-old photo showing the room you now stream from is a direct match.
- Reverse image search yourself periodically, from both directions, using your work photos and your personal ones.
- Check what friends have posted of you publicly. You don't control their privacy settings, and tagged photos are searchable.
This list isn't exhaustive. It covers the failures we see most often, but your setup will have its own. If something caught you out that isn't here, tell us and we'll add it.
Related: securing your streaming space, handling personal questions and accounts & payments.