Unsubscribe From Emails

One-click opt-out of activity emails.

Deliberately unauthenticated: an unsubscribe link is followed from an email client with no session, and forcing a login to stop receiving mail is both hostile and, for marketing-adjacent mail in the EU, not defensible. The token is an HMAC over the user id, so the link is unguessable and can do nothing except turn this one flag off.

Idempotent, and returns the same page whether or not the user exists, so it cannot be used to test which addresses have accounts.