Privacy notice

01Who we are, and our two roles

Tally (tallybyoutpost.com) is revenue analytics made by Outpost and run by Tesseract Systems Corporation (“Tally”, “we”, “us”). We have two roles, depending on whose information it is:

• Your account, as a controller. For your account and the details that come with it (your name, email address, sign-in and billing), we decide what is collected and why, and this notice covers it.
• Your visitors, as a processor. For the people who visit the sites you add, you decide: you are the controller, and we process their information only to give you Tally, under our Data Processing Agreement. This notice describes that processing too, so you can tell your visitors about it.

Questions and requests go to support@tallybyoutpost.com. A real person reads every message.

02The short version

• A visitor’s IP address is used to find their city and then dropped. It is never stored, logged or written to disk.
• Each site counts visitors in one of three modes. Cookieless mode sets no cookie at all; consent mode sets none until the visitor agrees.
• Session replay is off until a site turns it on. Form fields are always masked, and recordings are deleted after 30 days.
• We don’t sell anyone’s information, use it for advertising, or show one customer’s data to another.
• Our pages load nothing from other sites: no third-party scripts, fonts or analytics.

03What we collect about you

Your account

• Account: your name, email address and when you verified it, a new address you asked to change to until you confirm it, a one-way hash of your password (Argon2id; we never store the password itself), when you agreed to these terms, when you signed up and last signed in, and your account’s name and members.
• Signing in: a session kept on our server and a cookie that refers to it, records of failed sign-ins (to lock out password guessing), and the links we email to verify an address or reset a password, which we store only as hashes.
• Your sites: each site’s name, domain, time zone and counting mode, its replay settings, the goals, funnels and chart notes you add, and your alert channels.
• Connections: the key you give us for a payment provider (a Stripe restricted key, a Paddle or Lemon Squeezy API key, or a Polar access token) and the signing secret of the webhook Tally creates on your account, encrypted; the Slack, Discord, Telegram or webhook address an alert goes to, encrypted; and the email addresses alerts go to, once each confirms.
• API keys: only a hash of each key and its first characters, so you can tell keys apart, and when each was last used. The key itself is shown once, when you make it.
• Billing: your plan, its status and dates, your trial’s dates, and Stripe’s customer and subscription references. Card details are entered on Stripe’s pages and never reach our servers. For the Outpost discount we keep whether Outpost last said you have an active plan, and when it said so.

The early-access list

Before sign-up opened, the front page had an early-access list. For each address on it we keep the address, the page it was sent from, when, and the sentence the person agreed to. We have never emailed it, and we will only ever use it as that sentence said. Write to us and we will delete yours.

04What Tally records about your visitors

When a page with Tally’s tag loads, the visitor’s browser sends us what happened there. For each visit we keep:

• The page: its host name and path. The query string and the part after # are dropped before anything is stored, with one exception: on a payment’s success page, a Stripe Checkout session id is read, to link the sale to the visit, and kept with that link.
• Where they came from: the referring page’s host and path (never its query), the campaign tags in the address (utm_source, utm_medium, utm_campaign, utm_term, utm_content, and ?ref= or ?via=), and the channel that makes (search, social and so on). Ad click ids are used to tell the channel and then dropped.
• Their device: browser and operating system with their major versions, and whether it is a phone, tablet or computer, read from the browser’s user agent (which isn’t stored), plus the width of the window.
• Where they are: country and city, and the city’s coordinates, looked up from the IP address (see below).
• What they did: time actively spent on each page, how far down they scrolled, the goals the site records with up to ten properties the site chooses, and links they followed to other sites (without the link’s query).
• A visitor id: random, or a daily hash, depending on the site’s mode (see the next section), and ids for the visit and the page view.

The IP address

We use a visitor’s IP address for three things, and then it is gone: it is never stored, logged or written to disk. We look up its city in a copy of DB-IP’s IP to City Lite database kept on our own server, so the address goes to no one else (see Credits). In cookieless mode it goes into the daily hash described below. And it limits how fast one sender can send, keyed by a hash that is held only in memory.

Payments

When you connect a payment provider, Tally reads your payments, refunds and chargebacks from it and keeps, for each: the amount, tax and currency, the amount in US dollars at the European Central Bank’s rate for that day, the kind and date, the provider’s ids for the payment, customer, subscription, checkout and payment link, a hash of the customer’s email address, and the visitor ids your checkout passed in its metadata (only under the keys tally_visitor_id, tally_session_id, datafast_visitor_id and datafast_session_id). We keep no customer name, postal address, card details or plain email address.

The messages a provider sends to Tally’s webhook can carry the customer’s name, email and address. Each is kept only until it is processed; one that fails is cleared after 30 days at the latest.

Linking a payment to a visit

A sale is linked to the visit that brought the buyer by evidence, shown on its receipt: the visitor id in the checkout’s metadata or a Payment Link’s client_reference_id, the Checkout session on the success page, or a matching email hash. If a site calls tally('identify', {email}), the visitor’s browser sends their email address; Tally turns it into a SHA-256 hash of the lowercased address as it arrives and keeps only the hash, to match it with the hash of a payment’s email. The address itself is never stored or logged. A hash like this can be matched against an address someone already knows, so it is still personal information, and we treat it as such.

AI crawlers

Visits from known AI crawlers and assistants are counted apart: which one, who runs it, what for, the page and the country. Every other bot is dropped. Most crawlers never run a page’s script, so a site can also report them from its own server: that report carries the crawler’s user agent, the page and the crawler’s IP address, which we turn into a country and then drop without storing. Visits from links Outpost made carry a signed tag that proves it; we keep only that link’s reference and when it was made.

05Cookies and modes

Each site chooses how its visitors are counted. The tag sets its cookies on the site’s own domain; Tally’s servers never set a cookie on a visitor, and the tag sends its requests without any.

Payment Links: when there is a visitor id (cookie mode, or consent mode after consent), links to Stripe Payment Links on the page get it as their client_reference_id, so the sale can be linked to the visit. Stripe then holds that id with the payment, in the site owner’s Stripe account.

On Tally’s own website and app

There is no advertising and no third-party analytics on our pages: every script, style sheet, font and image comes from our own server.

06Session replay and heatmaps

Session replay is off for every site until its owner turns it on, and can record a share of visits (sampling) rather than all of them. When it is on, the visitor’s browser sends a recording of the page’s structure and its changes, pointer movement, scrolling and clicks. It doesn’t record canvas drawings, the browser’s console, frames from other sites, or the query string of the page’s address.

• Masking: every form field is masked, always; a password field’s length isn’t kept either. Text is masked inside elements marked data-tally-mask or tally-mask and in editable areas, or on the whole page when the site turns that on. Elements marked data-tally-block are recorded as empty boxes. Our server applies the masking again to what arrives, so an altered recorder can’t store more.
• What masking doesn’t cover: text a page puts in its style sheet (CSS content) and attributes nobody reads on screen, such as class names, are kept as the page sent them.
• Consent: in consent mode nothing is recorded until the visitor agrees. In the other modes the site owner decides whether to ask; in the EU and the UK, visitors usually have to agree first.
• Limits: a recording stops at 8 MB, and a site records at most 5,000 visits and 1 GB a day.
• Heatmaps: where on the page each click landed (as a share of the page’s width and a height), the page’s size, the clicked element’s CSS selector (never its text), and whether it was a rage or dead click. The scroll view is drawn from the scroll depth above.
• How long: recordings are deleted after 30 days, click points after 90.

07How we use it

• To provide Tally: count and show visits, link payments to them with receipts, play recordings, send the alerts and digests you set up, and answer the API, the command-line tool and the MCP server with your keys.
• To email you: account emails (verifying your address, resetting your password), billing notices (three about your trial ending, and one in a month your sites pass your plan’s events), and the alerts and digests you ask for, each address confirmed before anything is sent to it.
• To keep it safe: rate limits, sign-in lockouts and investigating problems.
• To bill you, through Stripe.

We don’t sell or rent anyone’s information, we don’t use it for advertising, we don’t use your visitors’ data for anything but your account, and we don’t use any of it to train AI models.

08Alerts and digests

Alerts and digests go where you send them: email, Slack, Discord, Telegram or a webhook of yours. An email address gets a confirmation link first, and nothing until it is clicked. A sale alert carries the amount, the source, the buyer’s city and device, the pages of the visit and a link to the receipt. Our emails load one image, our logo, from our own server: the same file for everyone, so it can’t tell who opened what. There are no tracking pixels and no tracked links. Records of what was sent are deleted after 30 days.

09Who receives it

These services receive information from Tally to provide it. The ones marked “when you connect” receive nothing until you set them up.

We may disclose information if the law requires it, and it would pass to a successor if Tally were sold or merged; we would tell you first.

10How long we keep it

11How we protect it

• Every page is served over HTTPS under a strict content security policy: no third-party scripts, styles or fonts.
• Passwords are stored only as Argon2id hashes. Payment provider keys, webhook secrets and alert addresses are encrypted (AES-256-GCM) with a key kept outside the database. API keys are stored only as hashes, are read-only and reach one site each.
• A site’s data is shown only to the members of the account it belongs to.
• Error reports are scrubbed of keys, tokens, email addresses and long numbers before they leave our servers.

12Your rights and choices

If you have an account

You can change your name, email address and password, sign out everywhere, and delete your account (which deletes its sites and their data, and disconnects the payment providers you connected) yourself, in your account settings. You can also ask us to show you what we hold about you, to correct it, to send you a copy, to delete it, or to stop using it for something: write to support@tallybyoutpost.com from the address on your account. We may ask you to confirm the request is yours, and we answer within 30 days.

If you visited a site that uses Tally

That site’s owner decides what is recorded about you, so ask them first; we will help them answer. You can also write to us. Deleting the site’s cookies in your browser ends a cookie-mode visitor id; a site in consent mode counts you without one until you agree; and a site in cookieless mode never sets one.

If you are unhappy with how we handled your information, please tell us. You can also complain to the data protection authority where you live.

13Where it is processed

Tally stores and processes information in the United States, and sends its email from there too. Stripe and our other providers are also in the United States, so information may be processed outside the country where you or your visitors live. Where the law requires it, we rely on safeguards such as the European Commission’s standard contractual clauses in those providers’ data processing terms. Customers can find the providers who process their visitors’ data in our Data Processing Agreement.

14Children

Tally is a business service and isn’t meant for anyone under 16. We don’t knowingly collect information from children for our own purposes; if you think a child has given us information, write to us and we will delete it.

15Changes to this notice

When what Tally collects or how it uses information changes, we update this notice and its date first. For significant changes we email account owners before they take effect. The terms of use and the Data Processing Agreement say how we change those.

16Credits

IP geolocation

IP geolocation by DB-IP. The countries and cities Tally shows for visitors come from DB-IP’s IP to City Lite database, used as DB-IP publishes it under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence.