Small cookies.
Your choice.
Tally cookie policy
Effective October 8, 2026 · Choice version 3
The entire website works with necessary technologies only. Optional measurement starts only after the corresponding affirmative choice. Earlier acceptance does not automatically enable expanded tracking.
What we store
These three Tally cookies apply to this site only and use HttpOnly, SameSite=Lax and Secure on HTTPS. External analytics, replay and advertising load together only when connected and accepted. We do not add browser fingerprinting. External scripts have their own storage practices.
External service cookies
When connected and permitted, Google Analytics uses _ga and _ga_* identifiers; this integration requests a 30-day lifetime. Microsoft Clarity uses _clck and _clsk to associate permitted sessions and recordings; provider defaults are one year and one day respectively. Meta uses _fbp and, after a Facebook ad click, _fbc, generally for up to 90 days. Providers can also process their own domain cookies subject to browser restrictions and their policies. Our site cannot directly remove cookies belonging to other domains.
The essential tally_signup cookie lasts 180 days after a new email signup. It enables removal of that signup without placing an email in a URL. It is not used for advertising. Analytics, session replay, advertising and optional email matching are described in the privacy policy.
What our own analytics records
Analytics measures visits, TestFlight clicks and button placements, section views, scroll milestones, visible-page time milestones, FAQ and guide interactions, the example week, calculator use, navigation and categories of external links. Calculator values and typed text stay out of analytics.
Events include random browser/session/event IDs, a time rounded to the minute, an approved page path, broad screen-size/browser/operating-system categories, and fixed referral/campaign categories. Recognized campaign labels are beta-launch, campus-fall-2026 and friends-invite. Other parameter values become “other”; raw query strings, full referrers and ad click identifiers are discarded. Numeric page-load, layout-shift and interaction timing summaries and generic error categories help us find reliability problems.
We do not store IP addresses, precise location, emails, full fingerprints, raw browser headers, error messages, screen recordings, app account IDs or attendance data in our own analytics database. External providers process the additional information described in our privacy policy. Infrastructure providers separately process connection information needed to deliver and protect the site. A TestFlight click measures an outbound visit, not a confirmed app install.
Accept, decline, or change your mind
“Accept all” enables the connected optional purposes together, while “Necessary only” keeps them all off. Closing the notice does not accept. Use in the footer anytime. Global Privacy Control keeps optional tracking off. If consent cannot be checked or saved, optional tracking stays off.
Choosing necessary only later stops future collection and clears optional cookies accessible to this site. Google, Microsoft and Meta records already collected require a separate deletion request; the local deletion button only erases our own analytics. To delete previous events, choose “Delete this browser’s Tally analytics” while its identifier is still present. That also opts out. Clearing the identifier first can prevent us from finding older events. Website choices do not change the app’s separate required-sharing agreement.
Hosting security cookies
Cloudflare also sets __cf_bm to help distinguish automated traffic and protect the website. It expires after 30 minutes of inactivity and may be present when optional Tally analytics is off. It is managed by Cloudflare and is separate from our visitor and session identifiers. Read Cloudflare’s cookie explanation.
Retention and providers
Events older than 90 days are removed during the next accepted analytics write, so removal may happen later on an inactive site. We cap stored events at 200 per browser per UTC day. Cookie expiry does not itself erase earlier database records. A private hosted review version may also use the platform’s access cookies under its own policies.
See the privacy policy for providers, app practices and rights. Contact privacy@s3ailabs.com for help.