LoginSign Up
← Back to all sparks
N

Notifuse

MKT AUTO
Velocity5.0

Self-hosted newsletter, email marketing and transactional email platform

github.com/Notifuse/notifuse ↗

Notifuse lets contacts refuse email tracking after a run of security releases.

email-marketingprivacy-consentself-hostingsecurityopen-core
◆Current state
Notifuse is a self-hosted email platform covering broadcasts, automations, transactional sends and, since v38, cookieless web analytics. Its last three releases were mostly security work: private-network webhook blocking, strict SECRET_KEY rules, sandboxed previews and signed tracked links. v43 adds per-contact consent for open and click tracking, with a workspace switch to stop tracking anyone who has not agreed.
◆Where it's heading
Notifuse is turning into a privacy-conscious Mailchimp alternative for teams that self-host: consent, audit logs and hardened defaults matter as much as new channels. Licensed Enterprise features such as audit logs and granular permissions show how it plans to earn revenue from the open core.
◆Prediction
Expect consent to spread to the web analytics side and more licence-gated Enterprise features; the frequent advisories suggest further security releases too.

◆Recent moves

  1. 4d ago

    v43.0 - email tracking consent + security + improvements

    Contacts can now refuse open and click tracking separately, and workspaces can stop tracking anyone whose choice is unrecorded, which is what some EU regulators expect. Rates and A/B winners are recomputed over tracked emails only. It turns months of security hardening into a privacy feature a self-hoster can point to.

    View source ↗
  2. 7d ago

    Release 43.0 absorbs the unreleased 42.3 changes

    A repository note that the unreleased 42.3 changes ship inside 43.0. No change of its own.

    View source ↗
  3. 9d ago

    Tracked links confirm before sending readers to other sites

    Tracked links now carry proof that the email contained them; links without it show a confirmation page before leaving for another site, closing an open-redirect advisory. Workspace creation and startup migrations also recover from half-finished states.

    View source ↗
  4. 21d ago

    Webhooks refuse private addresses and weak SECRET_KEYs block startup

    A security release: webhooks refuse private and loopback addresses, provider events only act on emails Notifuse sent, previews run sandboxed, and a weak or default SECRET_KEY now stops startup. Several changes need action from self-hosters before upgrading, which marks the shift from feature building to hardening.

    View source ↗
  5. 1mo ago

    v41.0 - audit logs

    Audit logs become the sixth licensed Enterprise feature, gating only recording, and every API response now carries a request ID. The AI email designer also learns template categories and stops leaving templates half-built.

    View source ↗
  6. 2mo ago

    v39.0 - Zapier + new permissions

    A Zapier connector lets Zaps react to Notifuse events or create and subscribe contacts, and webhook subscriptions can be scoped to lists or segments. API endpoints now patch instead of clearing omitted fields, fixing silent data loss for direct API users.

    View source ↗