ADR-012 — Proposal view telemetry is intelligence, never automation

Context#

The proposal share page records when a proposal is opened, for how long, and which sections were read. The proposals.status enum includes a viewed state, and the obvious implementation is to transition sent → viewed automatically when the share link is first opened.

Two reasons not to.

It would be wrong often. A link forwarded to a business partner, opened by an email security scanner, or loaded by a link preview generator all produce a "view" that says nothing about whether the client has actually read it. A status the operator cannot trust is worse than no status.

It creates pressure to act on surveillance. Knowing a prospect opened the proposal three times in an hour invites a follow-up timed to that knowledge. That is a manipulative pattern, and it is not the register Orvenath operates in — see Operating Principle 4 and the deliberately understated positioning throughout.

Decision#

Telemetry informs. It never acts.

• Opening a share link records a view. It does not change status.
• All status transitions (draft → sent → accepted | declined | expired) are explicit operator actions.
• Do Not Track and Sec-GPC headers suppress recording entirely.
• IP addresses are never stored. Only a salted HMAC-SHA256 hash, which permits deduplicating viewers without identifying them.
• No notifications, alerts, or emails fire on a view.

The analytics exist to answer one useful question: which sections do people actually read? If prospects consistently skip the approach section and dwell on pricing, that is a signal to restructure proposals. That is the legitimate use.

Consequences#

• Status always reflects a deliberate judgement, so it is trustworthy
• No follow-up timed to someone's reading behaviour
• Section engagement data accumulates and will inform proposal structure over time
• Requires manual status hygiene — a stale sent proposal stays sent until updated

Related#

Requires a corresponding disclosure in the published privacy policy. The policy previously stated that no analytics of any kind were run; that statement is no longer accurate for proposals.orvenath.com and must be corrected.