juudd sends one email to a customer on its own initiative: when their first site goes live. It holds no copy of your address to send it with. The address is asked for at the moment of sending, used for that one message, and written to no table.
That is the decision. The rest of this post is why there is an email at all, why it is one, and why we can send it without keeping your address.
The conversation is the only place we meet
Most people build a site in one sitting, in a chat with their assistant. When the site is live they close the tab. Everything juudd had to say to them was said inside that conversation, and the conversation is gone.
We read the first weeks of accounts and the pattern was plain: a site built in a single sitting, and no second visit. Nothing of ours outlived the tab. If the only place a customer ever hears from us is a chat they have closed, they never hear from us again.
Exactly one, and only for the first site
The email goes out when a deploy publishes the first version of a site and that site is the only one the account owns. Nothing else sends it:
- a second site does not
- a redeploy does not
- publishing an earlier version does not
There is no list behind it and no follow-up. It says the site is live, that anyone with the link can open it, that every version is kept, that the site can go on a domain you own, and that a reply reaches a person.
We hold no address, so we ask for one
The sign-in a customer comes through carries no email. So the platform has never had an address to store, and the record of who an account is has never held one.
When the first site goes live, the platform asks the Directory, the identity provider that does know, who this account is. The address comes back, goes to the mailer in one request, and is dropped. It is not written to a table. The Directory lookup is held in memory for ten minutes and goes when the process does.
The alternative was to start keeping addresses so that we could write to people later. That would have turned a one-time convenience into a standing store of personal data with no deletion path, and we would have had to explain that store to everyone. Asking each time costs one extra request and keeps the answer to "what do you hold about me" short.
The mailer cannot be made to say anything else
The platform does not write the email. It sends the mailer three things: where to send it, which site, and that site's address. The mailer renders a fixed message from those.
It also refuses an address that is not the site's own, so the secret that reaches the mailer can send this one email and nothing else. Whoever got hold of it could not use it to send a message in our name with a link of their choosing.
It never holds up the deploy
The send is not awaited. A site that went live is live whether or not the email went, and a failure is logged with the site and the reason, never the address. If the Directory has no address to give, nothing is sent and nothing breaks.
What is not decided
- We have not said it worked. The decision was made with a measure attached: of the accounts created after it shipped, how many deploy on a second day. This post claims no result, and if the email moves nothing, a second email will not.
- Accounts that built their first site before it existed get nothing. The email fires on a first version, and theirs had already passed.
- The first version of the message, sent as a test, passed every authentication check and was still filed as spam. It was made plainer after that. A new sender has no reputation, and only time gives it one.
The rule, once
One email, at the first site, to an address we ask for at that moment and do not keep, from a mailer that can send nothing else. The tools a first site opens up are listed in the docs.