Software as a service
For password managers: which reviews and searches bring subscribers who renew each year.
Password managers sell yearly plans to individuals, families and teams through a website, browser extensions and mobile apps, to an audience that cares how it is tracked. Tally links each web subscription to the visit behind it, even with the site in cookieless mode, and follows each renewal back to that visit.
14 days free, no card needed.
01How they sell
- SubscriptionYearly plans for one person or a family, and per-user business plans; renewals arrive once a year on the date of the first purchase.
- FreemiumA free tier limited to one device type or a set number of items, upgraded when someone wants sync everywhere or sharing.
02Payments it reads
- StripeWeb subscriptions through Checkout; yearly renewals, upgrades to family plans and refunds are read.
- PaddlePicked by security software sold worldwide that wants VAT and sales tax handled; transactions, renewals and adjustments are read.
What Tally can't read
- Subscriptions bought in the iOS or Android app go through the App Store or Google Play and aren't read.
- Installs of the browser extension from browser stores aren't visits and aren't read as sales.
- Nothing inside users' vaults is, or could be, read; Tally sees only visits to your website and payments to you.
- Business plans sold through resellers or managed service providers who bill the customer themselves aren't read.
03Where buyers come from
- Security review sitesComparison reviews with affiliate links send readers choosing between a few managers; each link's revenue sits on its row.
- Searches after breach newsWhen a large breach is in the news, searches for a password manager can rise, and a spike alert tells you when that traffic arrives.
- Browser extension listingsPeople who find the extension in a browser's store may visit later to upgrade; a click through from the listing shows the store as referrer.
- Tech YouTubePrivacy and security channels walk through setup, and viewers arrive having already watched it work.
- IT admin communitiesAdmins at small companies ask peers which manager to roll out, and the links come through forums and chats.
04What Tally answers
Can we stay cookieless and still tie sales to visits?
Yes. Send buyers back to a Stripe success page with the session id and the sale links with high confidence without any cookie; coverage shows the share of revenue that linked and the reason for each sale that didn't.
CoverageWhich source brings subscribers who renew?
Lifetime value by first source counts each subscriber's renewals and repeat rate under their first source; with yearly plans, read it after the first anniversary.
Lifetime valueCan we know when news traffic starts arriving?
A spike alert flags an unusual jump by email, Slack, Discord, Telegram or webhook, so a news-driven surge is seen as it starts and the sales that follow can be checked.
Alerts and digestsDo buyers read the security audit page?
Engaged time and scroll depth per page, for buyers against everyone else, show whether the audit and architecture pages are read by the people who end up paying.
What they readWhich security review earns its affiliate commission?
Each review site's referrer row carries the revenue of buyers credited to it; weigh that against the commission you pay, which Tally doesn't read.
Sources with revenue
05Numbers worth watching
- Renewals
- Yearly renewals by first source, the figure that says whether a review site's readers stay a second year.
- Coverage
- The share of revenue linked to a visit, which on a cookieless site depends on the success page carrying the session id.
- Refunds and chargebacks
- Refunds and chargebacks by source, which show where buyers come from who use the money-back window.
- Visitors from AI assistants
- Visits from AI assistants, which people now ask which password manager to trust.
06An example
Lifetime value by first source
All time: every payment since 1 Nov 2025. The period above doesn't apply.
| First source | Customers | Lifetime revenue | Average value | Renewals | Repeat rate |
|---|---|---|---|---|---|
| GoogleOrganic Search | 325 | $40,560 | $125 | 845 | 52% |
| ChatGPTAI Assistants | 126 | $21,071 | $167 | 391 | 61% |
| Direct | 178 | $18,216 | $102 | 374 | 44% |
| NewsletterEmail | 94 | $17,362 | $185 | 357 | 69% |
| Hacker NewsOrganic Social | 84 | $11,741 | $140 | 227 | 55% |
| x.comOrganic Social | 115 | $10,190 | $89 | 161 | 33% |
| RedditOrganic Social | 84 | $9,016 | $107 | 160 | 40% |
| PerplexityAI Assistants | 42 | $6,342 | $151 | 101 | 57% |
| Every source | 1,048 | $134,498 | $128 | 2,616 | 51% |
A customer is a visitor linked to a sale, counted under the source of their first visit. Lifetime revenue is net of refunds and chargebacks; repeat rate is the share who paid more than once (a renewal, an upgrade or another purchase). $13,167 from 426 payments not linked to a visitor is in no row.
07Setting up
- Any HTML siteAdd the tag to the head of every page of the website, with the site set to cookieless if you'd rather not set a cookie at all.
- StripeSet Checkout's success URL to a page with ?session_id={CHECKOUT_SESSION_ID}; in cookieless mode that is what links each sale.
- Give each review site's affiliate link its own UTM campaign, so their buyers are counted apart.
08Questions
Does cookieless mode lose returning visitors?
It counts a visitor once a day without a cookie, so visits on different days aren't joined into one person. Sales still link through the success page's session id; the path before the day of purchase just isn't joined to it.
Are family plan upgrades new sales?
An upgrade on the same subscription takes the first payment's link, so it adds to the source that won the subscriber rather than counting as a new customer.
What happens when a subscriber is refunded under our guarantee?
The refund lands on the original sale's receipt and comes off that sale's source, so a review site whose readers ask for refunds loses the revenue it seemed to bring.