Campaigns
Tell them, and prove what happened.
The sending half. Its design goal is not throughput — it is that every safety property still holds when the process dies halfway through a send.
01
How is the audience decided?
At send time, never snapshotted when the campaign was scheduled — somebody who bounced or unsubscribed in between must not receive the mail. Resolution is subtractive and every subtraction is reported, so a 4,000-contact list becoming 812 recipients is visible before the send rather than after it.
02
What happens if it crashes mid-send?
- The recipient row is written before the provider is called, so a death between the two leaves it pending for the next tick.
- Duplicates are prevented by a uniqueness constraint in the database, not by application bookkeeping.
- Nothing stores a cursor. Progress is derived by asking who has no row yet, so there is no position to corrupt.
- An A/B test’s phase is derived from the log too, so a crash mid-test resumes into the same phase.
03
What protects the recipients?
One-click unsubscribe on every message, working without a reply and without an account, adding the address to a global do-not-send list rather than to one sender’s. An operator opt-out outranks any later automated verdict.
Every policy check writes an immutable audit row for an allow as well as a block, because an unlogged allow is indistinguishable from an unchecked send six months later. The rules are on the sending policy page.
04
What comes back?
Delivery, bounce, complaint and unsubscribe events from the provider, per address; the A/B winner; and coverage you record against the campaign afterwards. Open and click tracking are available and are disclosed to recipients in the privacy notice — including the open question about their lawful basis under the ePrivacy rules.