# Tally Sign Cookie Notice **Last updated:** September 27, 2026 This notice explains the cookies and similar browser storage that Tally Integrations LLC ("Tally", "we", "us") uses on: - our website at **www.tallysign.com** (the "website"); - the Tally Sign app at **app.tallysign.com**, and an earlier Tally Sign address that some integrations still use (**sign.gettally.io**) (the "app"); - the pages people use to sign documents sent through Tally Sign ("signing pages"); and - the Tally Sign screens that appear inside Salesforce ("Salesforce panels"). For how we handle personal data in general, see our [Privacy Policy](/legal/privacy-policy). --- ## 1. The short version 1.1 We only use cookies and browser storage that are **strictly necessary** to make Tally Sign work: to keep you signed in, to protect your account and your sign-ins (including sign-ins with Google, Microsoft, Salesforce or your company's single sign-on), to connect and work with Salesforce, and to keep your place while you sign a document. 1.2 We **don't** use analytics, advertising, social media or tracking cookies. We don't let third parties set cookies on our website or app. We don't use cookies to follow you across other websites, and we don't sell or share cookie data. 1.3 The website sets **no cookies at all**. 1.4 Because we only use strictly necessary cookies and storage, we don't show a cookie consent banner. If we ever add cookies that aren't strictly necessary, we will update this notice first and ask for your consent where the law requires it (see Section 9). --- ## 2. What cookies and browser storage are 2.1 A **cookie** is a small text file that a website asks your browser to keep and send back on later visits. A cookie can last only while your browser is open, or until a set expiry date. 2.2 **Session storage** is space in your browser where a web page can keep information for as long as that browser tab stays open. It is cleared when you close the tab. Unlike cookies, it isn't sent to our servers automatically. 2.3 **First-party** cookies are set by the site you are visiting. **Third-party** cookies are set by a different site. All the cookies in this notice are first-party cookies set by Tally Sign. 2.4 We don't use local storage (browser storage that persists after you close the tab), tracking pixels, web beacons, or device fingerprinting on the website, app or signing pages. Our emails, including signing requests sent on behalf of our customers, don't contain tracking pixels or tracked links, and we don't record when you open an email. --- ## 3. Cookies the app sets All of these are strictly necessary. Each one is marked "HTTP-only", which means scripts running in the page can't read it. In production each is sent only over secure (HTTPS) connections. | Cookie | Who gets it | What it's for | How long it lasts | |---|---|---|---| | `ts_session` | Anyone who signs in to the app | Keeps you signed in. It holds a signed token that identifies your user account and your company, and it lets us sign you out everywhere when your password changes. | 30 days, or until you sign out | | `ts_session` (Salesforce panel version) | Tally Sign users who open the editor or automations inside Salesforce | Keeps you signed in to the editor inside Salesforce, separately from your normal app sign-in. It works only for the document (or automations screen) you opened from Salesforce, not the rest of the app. It is a "partitioned" cookie, which means your browser keeps it only for Tally Sign inside Salesforce and doesn't use it anywhere else. | The sign-in inside it lapses after 2 hours without activity; the cookie itself is kept for up to 7 days so the editor can check it's still you when it signs you back in | | `ts_device` | Anyone who signs in to the app | Recognizes a browser you have signed in from before, so we can email you when someone signs in to your account from a new browser. It holds a random identifier. We store only a scrambled (hashed) copy, along with the browser type and IP address it was used from, and delete that record 13 months after the browser was last used. | 400 days | | `ts_sso` | Anyone who signs in with Google, Microsoft, Salesforce or their company's single sign-on, and admins testing their company's single sign-on | Protects a sign-in while it's in progress. It holds a signed record of the sign-in you started (random check values, which provider, and the page to return to), so we can confirm that the answer from the provider belongs to the sign-in this browser started. It is sent with cross-site requests (SameSite=None) so it also comes back when a company's identity provider sends its answer from its own site. It is deleted as soon as the sign-in finishes. | 15 minutes | | `ts_sso_signup` | People who start a new Tally Sign account with Google or Microsoft | Holds the name, email address and account ID that Google or Microsoft sent us, in a signed form that can't be changed, while you name your company to finish signing up. It is deleted when you finish. | 30 minutes | | `ts_sf_oauth` | Company owners and admins connecting Salesforce | Protects the Salesforce connection process from interference while you sign in to Salesforce and approve the connection. It is sent only to the page that finishes the connection. | 15 minutes | | `ts_sf_conn` | Users in a company that has connected Salesforce, when they connect an org or choose "Work in this org" | Remembers which of your company's connected Salesforce orgs (production or a sandbox) you work with in the app. It holds the connection's ID, not information about you. | 1 year | | `ts_session` (support version) and `ts_platform_return` | Tally support staff only | Used only in the browser of a Tally staff member who signs in as a customer's user (see our [Privacy Policy](/legal/privacy-policy), Section 9.4). They let the staff member return to their own account afterwards. These cookies are never set in a customer's browser. | 2 hours (`ts_session`) and 4 hours (`ts_platform_return`) | **Signing out** deletes the `ts_session` cookie from your browser. --- ## 4. Browser storage the app and signing pages use All of these use session storage, so they are cleared when you close the browser tab. They are strictly necessary for the feature you are using. | Storage key | Where | What it's for | |---|---|---| | `tally-sign-consent:` | Signing pages | Remembers, for that signing link, that you agreed to use electronic records and signatures, so you aren't asked again each time the page reloads. | | `tally-sign-draft:` | Signing pages | Keeps the fields you have filled in and the signature or initials you have adopted, so you don't lose your work if the page reloads before you finish. It is removed as soon as you finish signing. | | `tse-inbox-tab` | Salesforce panels | Remembers whether you were last looking at the Documents or Templates tab. | | `tally-sign:send::