Mail preferences

The two flags

A developer account patches them through PATCH /api/auth/mail-preferences; a player account through /api/user-auth/mail-preferences. Both require the corresponding session token.

What registration actually writes

Store sign-up always sends marketingConsent: false and productUpdateConsent: true alongside the account type. Checking the box at sign-up flips marketing on.

That default is the right one for a user: transactional mail is expected, promotion is not.

Email that ignores your preferences

Verification codes and password-reset links are transactional and are always sent. Nothing in the preference model suppresses them.

Codes expire after 10 minutes and there is no enforced delay between resends, so a missing mail folder is the first thing to rule out before requesting a third code.

• If verification mail never arrives, the address is usually wrong or the domain rejects the sending server.
• There is no in-dashboard view of what was sent when.
• Developer accounts cannot change their address themselves — see Account recovery.

For a developer account

The same two flags exist, and the same rules apply. What you should expect to receive regardless: signing or upload failures worth action, policy notices against your listings, and payout correspondence once you have set up merchant details.

Use an address your team monitors. A single-person mailbox is an outage waiting to happen at the moment a listing is suspended.