Tinbox can add a tiny remote image to future HTML messages composed by people in an inbox. When an email client requests that image, Tinbox shows Open detected on the sent message. This is a useful hint, not proof that a person read the message.

Open detection is off by default. Account owners and admins can change the tenant default under Settings → Sending and can set each inbox to inherit, enable, or disable it under Settings → Inboxes.

What the statuses mean

No open detected means Tinbox has not received the image request. The recipient may still have read the message with remote images blocked or while offline.
Open detected means the image was requested at the displayed time.
Open detected automatically means the request resembled a privacy proxy, prefetcher, or security scanner. It may not represent a person opening the message.
For eligible group messages, the details show Open detected separately for each envelope recipient. Automatic/proxy qualification also stays per recipient.
Older message-level receipts and messages above the recipient-mode safety limits are labeled Aggregate history. They can say only that at least one recipient caused a detection; Tinbox never invents historical attribution.
Replied is a stronger engagement signal and takes precedence over image-based status.

Which messages are eligible

The setting applies only to future, human-composed HTML inbox messages and replies. Plain-text-only email is never converted to HTML for tracking. Campaigns, journeys, outreach, API mail, agent mail, and system mail retain their existing controls and behavior.

The policy is captured when the message is prepared. Changing the setting affects future sends; it does not rewrite sent mail or delete historical detections. Undo Send, retry, and replay reuse the same logical receipt instead of creating new ones.

Recipient attribution is used only when the final message is at most 5 MiB and has no more than 100 deduplicated envelope recipients. Larger messages or groups retain the aggregate message-level receipt. This fallback does not affect delivery.

Reliability and forwarding

Remote images are an imperfect signal:

image blocking and offline reading cause missed detections;
Apple Mail Privacy Protection, Gmail image proxying, security scanners, and other automated fetches can cause automatic or early detections;
forwarding can cause the forwarded copy to request the original image. That request remains attributed to the original delivery recipient, not the person who opened the forwarded copy;
client and proxy behavior changes over time.

Tinbox therefore uses Open detected, never Read or Unread, and does not show device or location claims.

Privacy, retention, and legal responsibility

The image URL contains a random bearer token, not an email address, RFC Message-ID, or database ID. Tinbox stores only a hash of that token. Recipient identity is resolved from the existing trusted send ledger; it is not placed in the URL or duplicated into request metadata. Tinbox does not retain the request IP, location, or raw User-Agent for inbox-open detection; only a coarse unknown, privacy proxy, or suspected bot classification is kept.

Recipient details, including Bcc delivery status, are returned only after the same inbox/message read authorization used for the message itself. Anyone who cannot read the owning Tinbox inbox cannot query its recipient status. A Bcc recipient still receives a wire copy with no Bcc header.

The receipt accepts detections for 30 days. A summary detected during that window can remain visible with the sent message. Requests after expiry return the same image but do not record anything.

Enabling open detection does not establish recipient consent or another legal basis. Requirements vary by jurisdiction, relationship, and purpose. The tenant is responsible for appropriate legal review and recipient notice before enabling it. Tinbox's controls and data minimization do not replace that review.

Troubleshooting

If open detection is enabled but outgoing HTML has no working receipt, open Settings → About → System health. The Open detection route check reports a missing or unreachable public image route. Sending continues without a tracker when preparation fails, so a tracking configuration problem does not block email delivery.

To stop future receipt injection immediately, turn off the tenant default and remove any inbox-level Enabled overrides. Existing sent messages and their historical detections remain intact.