Why we don't email our old users

The counter table on this service holds 4,148 e-mail addresses. They belong to counters created over the past twenty years, back when a counter came with an address field and people filled it in.

Three people have asked to receive mail.

Those two numbers are the whole of this post. The gap between them is not a problem to be closed. It is the design.

Having an address is not permission to use it

The addresses were collected for a purpose — recovering access to a counter — and that purpose has not changed. What has changed is that the service now has things it could plausibly send: a weekly summary, a milestone, a warning that a counter has gone silent.

Every one of those is a defensible message. Somebody with a counter would probably like to know that it stopped counting three weeks ago. That is exactly the reasoning that turns a recovery field into a mailing list, and it is wrong at the first step: the person filled in that field to get back in, not to be contacted.

So there is a second table. An address goes into it only when its owner has confirmed, on a page they opened themselves, that they want mail. Nothing is sent to anybody who is not in it. Today that is three people out of four thousand one hundred and forty-eight.

Fetch, do not send

The rule that falls out of this is short enough to keep: the old addresses may answer a request, and may never receive one.

A recovery request works. Somebody who has lost the link to their statistics types their address, and if it matches, a message goes out — because they asked for it, thirty seconds ago, by their own action. That is the address doing the job it was collected for.

A weekly summary to the same address is a different thing wearing the same clothes. Nobody asked. The fact that it would be useful is not consent, and neither is the fact that we have the address and it still works.

What this costs

It is worth being straight about the price, because it is real. Three confirmed addresses means that a feature built to warn people about broken counters can currently warn three people. The watchdog works, the mail works, the text is translated into eleven languages, and the audience is three.

That looks like failure, and the reason it is not is worth stating. The alternative — writing to four thousand people who never asked, once, to tell them they can subscribe — is one message. It would probably work. It is also exactly the message that every service which ends up with a reputation for spam sent first, with exactly this reasoning.

The number goes up when somebody chooses to put themselves in it, or it does not go up. Both of those are acceptable outcomes. Sending mail to people who did not ask is not one of them, no matter how good the mail is. The way back exists; it simply runs in the other direction. /recover takes a counter number and the address of the page the counter sits on, checks that the page carries both a marker valid for one hour and the counter itself, and hands over the management link. Neither an account nor an address on file is needed — which matters, because of 166,481 counters only 4,148 have one.