- 20
- rules for image loads
- 23
- rules for clicks
- 5
- categories of machine events
- 1
- or more rule codes behind every verdict
Categories you see on each event
| Category | Example rules | What it means for you |
|---|---|---|
| Privacy proxy (Apple Mail) | R-OPEN-APPLE | Apple loaded the image on the recipient’s behalf. You don’t know whether anyone read the email. |
| Proxy cache | R-OPEN-GOOGLE, R-OPEN-MSPROXY, R-OPEN-YAHOO | A Gmail, Microsoft or Yahoo server loaded the image. This can be close to an open, but it is not proof. |
| Prefetch | R-OPEN-GMAIL-PREFETCH | Gmail loaded the image in advance. |
| Security scanner | R-OPEN-SCAN-VENDOR, R-OPEN-FAST, R-OPEN-HEADLESS, R-CLK-BURST, R-CLK-SWEEP, R-CLK-ALL-FAST, R-CLK-ALL-1S | A mail filter checked the message or clicked several links at once within seconds. |
| Link preview or AI agent | R-OPEN-PREVIEW, R-OPEN-AI-DECLARED, R-CLK-PREVIEW | A messaging app or AI assistant fetched the page to show a preview. |
| Likely human | R-CLK-JS, R-CLK-RESID, R-OPEN-CLIENT | The event looks like a person’s action, for example a click from a browser on a home network. It is still an assessment, not a certainty. |
Three principles behind every assessment
- An assessment, not a verdict. The result is at most “likely”. Only what the recipient does themselves is certain, such as replying or accepting a proposal.
- No signal means “unknown”, not “human”. If no rule matches, the event stays a possible open.
- Every assessment has a reason. You see the rule codes that fired, so you can decide for yourself whether you agree with them.
Apple Mail Privacy Protection opens
Since iOS 15, Apple Mail can load images from messages through Apple’s servers before the recipient opens their inbox. To a tracker, this looks like an open, often a few seconds after delivery.
HawkOpen recognizes it by the distinctive way the image is fetched and by Apple’s network (rule R-OPEN-APPLE). Such an event does not count as an open by a person.
Security scanners, bots and false clicks
Companies protect their mailboxes with filters that open links before a person does. Typical signs: several links clicked within two seconds, a request with no browser language, or a browser with no window (a headless browser).
HawkOpen has separate rules for this, such as R-CLK-BURST (at least three links in two seconds) and R-CLK-HEADLESS (headless browser). A click with the page running in a visible tab points to a person (R-CLK-JS).
Frequently asked questions
Why do I see an open a few seconds after sending?
Usually it is Apple Mail Privacy Protection, Gmail prefetching the image or a security scanner on the recipient’s side. HawkOpen shows which rule identified the event.
Is email tracking accurate enough to know someone read my email?
No. No tool based on a tracking image can know that. HawkOpen gives an assessment and its reason. Only the recipient’s reaction, such as a reply, is certain.
Do the rules change?
Yes. Rules are versioned, and older events can be reassessed with a newer version, because we store the signals, not just the result.
What is a possible open?
An image load that no rule attributed to a machine. A person may have caused it, but so may an unknown program.