metadata__referral_source
Incoming subscribe URL ?ref= token
Never displayed raw; used only to attribute a confirmed subscriber to an inviter.
Referral wiring
Buttondown-first attribution without exposing reader data.
This is the implementation bridge for MY-2571 and MY-2577: static invite links, Buttondown metadata, private review, then a safe public leaderboard artifact.
Internal prep only: no webhook, subscriber email, reward fulfilment, public leaderboard refresh or sponsor-backed prize is triggered from this static page.
Metadata contract
Fields the website passes to Buttondown
metadata__reader_token
Browser-local share token generated on /share/
Can be mapped to an approved display name after opt-in.
metadata__signup_market
Static hidden field
Market filter for multi-newsletter dashboards.
tag
Buttondown embedded form tag website-subscribe
Operational filter only; never shown to readers.
Manual refresh sequence
How a safe leaderboard refresh should work
Export confirmed subscribers
Use Buttondown confirmed subscriber data only after credentials and approval exist; never commit raw exports or private emails.
Build private counts
Deduplicate by subscriber email and reader token, then review same-IP clusters, disposable domains and suspicious bursts before publishing.
Publish redacted projection
Update only /leaderboard/leaderboard.json with initials, area labels, confirmed counts and reward tiers after manual approval.
Publication gates
Hard stops before gamification goes public
Rule
Export or webhook source must include only confirmed Buttondown subscribers.
Rule
Referral counts must be deduplicated by subscriber email and reader token before any ranking is shown.
Rule
Public display names must use initials, explicit opt-in names or area labels; never raw emails.
Rule
Prize eligibility must be reviewed manually before any sponsor-backed draw is announced.
Rule
Leaderboard JSON must be generated as a static artifact; no private subscriber API response is exposed client-side.