Tracking & privacy

MailingCore's open and click tracking is privacy-conscious: it records when an event happened, not who or from where.

What is stored

• Opens — a first-open timestamp on the email log (openedAt). Only the first open is recorded.
• Clicks — a first-click timestamp (clickedAt). Only the first click is recorded.
• No IP address and no user-agent are stored for tracking events. (Admin actions in the audit log are separate and do record IP/user-agent.)

Because events live on the email log, they follow the same retention as the log itself — there is no separate tracking store to purge.

Disabling tracking

Set trackingDisabled: true on POST /emails/send to skip the open pixel and click rewriting for that send. Tracking is per-send and on by default; there is no per-template flag. The List-Unsubscribe header and unsubscribe link are still added.

One-click unsubscribe

Every non-platform send includes RFC 8058 one-click unsubscribe:

• List-Unsubscribe: <signed-url> and List-Unsubscribe-Post: List-Unsubscribe=One-Click headers.
• A signed unsubscribe URL (also available as {{unsubscribeUrl}} in templates) that expires after about 90 days.
• Click rewriting deliberately leaves the unsubscribe link direct, so one-click stays reliable.

See Unsubscribe & GDPR and Tracking.