Turns out "set it and forget it" isn't great privacy advice.