> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coldsend.pro/llms.txt
> Use this file to discover all available pages before exploring further.

# Click & Open Tracking Privacy

> How ColdSend's click-through-rate (CTR) tracking works, what data it collects, retention windows, opt-out controls, and GDPR alignment.

ColdSend offers an optional **click-through-rate (CTR)** tracking feature for outbound campaigns. This page discloses exactly what the feature does, what data it processes, and the controls and safeguards in place. It is intended to help you meet your own transparency and data-protection obligations.

<Info>
  Click tracking is **disabled by default**. It is only active on campaigns where you explicitly enable it.
</Info>

## Overview

When tracking is enabled for a campaign, ColdSend applies two changes to each outgoing email:

1. **Link rewriting** — HTTP/HTTPS links in the email body are replaced with an opaque tracking-domain URL that redirects to the original destination.
2. **Open pixel** — a small tracking pixel is added so opens can be measured.

Both mechanisms route through a per-customer tracking domain (for example `click.yourdomain.com`). Recipients who click a link are transparently redirected to the intended destination.

## What We Track

For each click or open event, ColdSend records only the following:

| Data point             | Description                                                                                                                                                     |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Click timestamp        | The time of the event, stored in **UTC**.                                                                                                                       |
| Scanner category       | The `User-Agent` is reduced to a coarse category (for example `human`, `ms_atp`, `proofpoint`). The raw User-Agent string is **not** retained as an identifier. |
| HTTP method            | Whether the request was a `GET` or `HEAD`.                                                                                                                      |
| Opaque link identifier | An opaque token that maps, **server-side only**, to the original destination URL.                                                                               |

## What We Do **Not** Track

<Warning>
  ColdSend does **not** store the recipient's raw IP address. Any signals computed from network-level data are used transiently and **discarded at ingest** — they are never persisted.
</Warning>

We deliberately minimize collection: there is no raw IP address, no raw User-Agent fingerprint, and no personally identifying network data kept on file.

## Bot & Scanner Filtering

Many "clicks" and "opens" are generated automatically by security scanners and mail-protection systems rather than real recipients. ColdSend applies three heuristics to distinguish automated traffic:

1. **Timing** — events occurring within roughly **7 seconds** of send are treated as automated.
2. **Known-scanner denylist** — the User-Agent category is matched against a denylist of known scanners (for example Microsoft ATP, Proofpoint).
3. **HTTP method** — `HEAD` requests are treated as automated pre-fetches rather than genuine clicks.

<Note>
  Only **verified non-bot** clicks count toward your reported CTR. Both the **raw** count and the **verified** count are retained so you can audit filtering behavior.
</Note>

## Open Tracking

Open tracking is unified onto the **same tracking domain** as click tracking and follows the **same data-minimization** rules described above: UTC timestamp, coarse scanner category, and HTTP method only — no raw IP address.

## Data Retention

| Data                    | Retention                                              |
| ----------------------- | ------------------------------------------------------ |
| Raw click / open events | **90 days**, then automatically purged.                |
| Aggregated CTR metrics  | Retained (aggregate counts only, no per-event detail). |

Raw event rows are removed on a rolling 90-day schedule. Only aggregated, non-identifying metrics are kept beyond that window.

## Your Rights & Opt-Out

* **Off by default** — no tracking occurs unless you turn it on.
* **Per-campaign toggle** — tracking is controlled independently for each campaign.
* **Account-level disable** — to disable click and open tracking entirely for your account, contact support.

## Data Subject Requests & Deletion

ColdSend supports data erasure at the lead level. **Deleting a lead cascades** to remove all related tracking data:

* `tracked_links` — the opaque link mappings for that lead.
* `click_events` — the raw click/open event rows.
* `lead_link_clicks` — the aggregated click counts for that lead.

This ensures a lead deletion fully removes their tracking footprint.

## Security

<CardGroup cols={2}>
  <Card title="Signed Opaque Tokens" icon="shield">
    Tracking links use **HMAC-SHA256** signed, opaque tokens. The original URL is never exposed in the link itself.
  </Card>

  <Card title="No Open Redirects" icon="lock">
    Redirects resolve **only** to server-stored original URLs, eliminating open-redirect abuse.
  </Card>

  <Card title="Enumeration Protection" icon="key">
    Opaque tokens combined with rate limiting prevent enumeration or scraping of tracked links.
  </Card>

  <Card title="Server-Side Mapping" icon="database">
    The destination URL is stored server-side and resolved only via the signed token.
  </Card>
</CardGroup>

## GDPR Alignment

ColdSend's tracking design follows core GDPR principles:

* **Data minimization** — only a timestamp, coarse scanner category, HTTP method, and an opaque link identifier are stored; no raw IP addresses.
* **Storage limitation** — raw events are auto-purged after 90 days.
* **Right to erasure** — deleting a lead cascades to all tracking tables, making erasure straightforward.
* **Purpose limitation** — data is used solely to compute campaign engagement metrics.

<Note>
  This page describes the technical behavior of the tracking feature. It is not legal advice. You remain responsible for your own lawful basis, notices, and consent requirements when enabling tracking.
</Note>