A tracking number
A tracking number is a short string printed on a label and stored in a carrier database. Typing it into a public page returns part of that database to whoever asked.
A postal operator · A courier · Anyone holding the number
A public handle to a private record
The operator file described in a parcel entering the postal system is internal. Most of it is never shown to anyone outside the business. The tracking number is the exception: it is the one key the operator deliberately publishes, so that customers can answer their own questions without phoning a call centre.
That design decision has a consequence that is easy to state and easy to forget. The key carries no authentication. There is no login, no ownership check and no record of entitlement. The page does not ask who you are because it was never built to care. Possession of the string is the whole permission system, so the correct mental model is not a private account page but a lock that opens for anyone holding the number.
It exists in two places at once
In practice a number does not stay with one party. It is generated at induction, it belongs to whoever handed the item over, and it is then passed to the person waiting for the item so they can stop asking. Almost always it travels through whatever channel the two parties already use, which for a market order means the sequence described in placing an order and then a message in the system covered by using the market inbox.
From that moment the same key exists in two hands and in at least one stored message. The operator does not know it has been shared and has no mechanism to care. It also outlives the reason it was created: a number is useful for a week and readable for far longer, because the operator keeps its record on its own schedule.
What the number shows to anyone who has it
- A chain of scan events, each one a place and a time.
- The facilities or regions those scans happened in, at whatever granularity the operator chooses to publish.
- A current status word, which is the operator's own summary of the latest event.
- A delivery event when one occurs, with a time and often a general location.
- On some services, an indication that a signature or a delivery photograph was captured.
Put together, that is a route and a clock. Anyone holding the string can watch an object move between two ends of a journey, and can tell afterwards that the journey completed. They can do it repeatedly and they can do it after the fact.
What the number does not show
It does not show contents. Nothing in the published record describes what the item is, beyond a service class and sometimes a weight. The declared category on customs paperwork, where one exists, belongs to a different record, not to the public tracking page.
It does not show sender identity. The published view names facilities, not people. The person who handed the item over is not on it.
It does not show recipient identity. A delivery event states that an item was delivered to a destination, not who lives there. The name is on the label and the label is not the public page.
It does not show anything about a market. No order, no account, no listing, no vendor name, no message. A tracking page has no idea that any of those things exist. The number is the only string common to both worlds, which is the point of the next section.
The tension, stated honestly
The number is genuinely useful to the person waiting. It converts an unanswerable question into a readable answer, it removes the need to ask a counterparty anything, and it is the only independent evidence either party has if an order goes wrong. In the situation described in opening a dispute, it is often the single piece of information that is not one side's word.
The same string is also a durable link between two people. Two parties who share a number share a pointer into one operator record, and anyone who later obtains that string from either end can read the same route and the same clock. Both things are true at once, and no rule resolves them, because nothing makes a shared unauthenticated key stop being shared.
| Who holds the number | What it gives them |
|---|---|
| The party who posted it | The full route, plus knowledge of where the item entered. |
| The party waiting for it | The full route, plus knowledge of where it is going. |
| Anyone else who obtains the string | The full route, and therefore both ends, without needing either party. |
What changes the answer
4 things change how much this action gives away. None of them takes it to zero, and none of them is a promise.
- Treat the number as shared by defaultIt is not a private reference. It is a key with no lock on it, held by at least two people and stored in at least one message. Reading it that way from the start prevents the specific mistake of pasting it somewhere on the assumption that it identifies nothing.
- Know where the stored copy livesA number passed in a message sits in that message until the message is gone, and the retention of a market inbox is not yours to set. What that store holds is described in using the market inbox. Removing your copy does nothing to the operator record or to the other party's copy.
- Remember that looking it up is its own observed actionChecking a tracking page is a normal web request to a courier site. Whoever can see your traffic sees that request, which is the subject of opening Tor Browser on your home line and of the wider point in the shape and size of the traffic. The lookup is an event even when the result is boring.
- Keep the number of people who have it smallEvery additional holder can read both ends of the route indefinitely, and a number gets copied, pasted and autofilled as it moves, which is the subject of copying an address to the clipboard. There is no way to revoke a tracking number, so the only variable is how many copies were made in the first place.
What this card is not
This card is not about how to obtain, avoid or interpret any particular carrier interface. It describes what a published tracking record contains and who can read it.
Questions that come up
Can a tracking number identify me?
Not by itself. It returns a route and a clock, and no name appears on the published view. What it does is connect anyone holding it to both ends of a journey, which is a different and more durable kind of exposure than a name would be.
Does the operator know the number was shared?
No mechanism exists for it to know or to care. The number carries no authentication, so a lookup by one party is indistinguishable from a lookup by another.