Legal
Cookie Policy
Every cookie and similar storage used on the Tallrung app, our landing page, and the Merchants’ sites we host.
Effective 11 November 2026
1.About this policy
This policy lists the cookies and similar storage (local storage and session storage) used on the Tallrung app, on our landing page, and on the Merchants’ sites that Tallrung hosts. A cookie that is strictly necessary for a service you asked for needs no consent. Every other one needs your consent before it is set (ePrivacy Directive, art. 5(3); French Data Protection Act, art. 82).
A third party’s lifetimes are its own, as its documentation gives them on the date this policy took effect, and may change.
2.The app
The app sets only cookies and storage that it needs to work or to keep a setting you chose. It loads no analytics or advertising tags, so it asks for no consent.
| Name | Set by | Purpose | Lifetime | Strictly necessary |
|---|---|---|---|---|
better-auth.session_token | Tallrung | Keeps you signed in. Over HTTPS its name starts with __Secure-. | 7 days, renewed while you use the app; deleted when you sign out | Yes |
| Better Auth’s sign-in state cookies | Tallrung | Protect a sign-in with Google from forgery while it’s in progress. | 5 minutes | Yes |
shopify_oauth_state | Tallrung | Protects the Shopify app install from forgery while it’s in progress. | 15 minutes | Yes |
sidebar_state | Tallrung | Remembers whether you closed the sidebar. | 1 year | Yes: a setting you chose |
setup_done | Tallrung | Remembers that your setup is done, so the sidebar saves the setup row’s space. | 1 year | Yes: a setting the app keeps for you |
funnel-editor.effort | Tallrung (local storage) | Remembers the AI effort you last picked in the editor. | Until you clear it | Yes: a setting you chose |
__stripe_mid, __stripe_sid | Stripe | Fraud prevention, when the Billing page shows Stripe’s card form. | __stripe_mid: 1 year. __stripe_sid: 30 minutes. | Yes |
The sign-up form runs Vercel BotID, which checks in your browser that a person sent the form: a script solves a challenge, and the browser sends the answer with the form, in request headers. It sets no cookie of ours, and Vercel’s documentation names no cookie or storage that it sets. Stripe Checkout and the billing portal open on Stripe’s own site, under Stripe’s cookie policy.
3.Our landing page
Our landing page sets no cookies and uses no local storage or session storage. It loads no analytics or advertising tags, and its fonts are served from our own host. Our host, Vercel, logs each request to run and protect the site, as the Privacy Policy describes.
4.Merchants’ sites
A Merchant’s Funnels and Landers serve on the Merchant’s own domain, or, for testing, on a subdomain of tallrung.site that search engines are told not to index. On them, the Merchant is the controller, and it decides which ad tags, videos, and custom code its pages load. What a page can set:
| Name | Set by | Purpose | Lifetime | Strictly necessary |
|---|---|---|---|---|
fnl_vid | Tallrung | Recognizes a returning visitor, keeps them in the same split-test variant, and attributes their visits. HTTP-only. | 1 year | Exempt from consent only where it serves this site’s own measurement and split tests alone, as the CNIL’s audience-measurement exemption allows. Otherwise the Merchant must get consent. |
fnl_sid | Tallrung | Holds the visit: its currency, its attribution, and the order it opened, which only this session may act on. HTTP-only. | 30 minutes after the last request | Yes |
checkout-started:<order> | Tallrung (session storage) | Brings the payment step back as it was if the Buyer reloads the checkout. | Until the tab closes | Yes |
fx-countdown:<page>:<n> | Tallrung (session storage) | Keeps a page’s countdown from restarting when the page reloads. | Until the tab closes | Yes: part of the page the Buyer sees |
__stripe_mid, __stripe_sid | Stripe (the Merchant’s account) | Fraud prevention on the checkout’s payment form and express buttons. | __stripe_mid: 1 year. __stripe_sid: 30 minutes. | Yes |
| PayPal’s cookies | PayPal | Run the PayPal buttons and their sign-in, in PayPal’s own frames. | As PayPal sets them | Yes, for a Buyer who pays with PayPal |
_fbp, _fbc | Meta, when the Merchant connects it | Advertising measurement and targeting. | _fbc: 90 days. _fbp: as Meta’s pixel sets it; Meta’s documentation gives no lifetime. | No: needs consent |
_ga, _ga_<id>, _gcl_au | Google, when the Merchant connects it | Analytics, and Google Ads conversion measurement. | _ga and _ga_<id>: 2 years. _gcl_au: 90 days. | No: needs consent |
_ttp, _tt_enable_cookie | TikTok, when the Merchant connects it | Advertising measurement and targeting. | 13 months from when it was set or last used | No: needs consent |
| The video player’s cookies | YouTube, Vimeo, or Wistia | Play an embedded video, and the player’s own measurement. | As the provider sets them | No: needs consent, except where the player sets none |
| Anything the custom code sets | The Merchant | Whatever the Merchant’s code does. | As the Merchant sets it | The Merchant decides |
Pages also load the Google Fonts families they name from Google’s servers, which sets no cookie but sends the Buyer’s IP address and browser to Google.
The server also reads the values of _fbp, _fbc, _ga, and _ttp when they exist, stores them with the visit, and sends them with the purchase to the Merchant’s connected accounts. It never creates them.
5.Consent on Merchants’ sites
Tallrung doesn’t provide a consent banner today. When a Merchant connects Meta, Google, or TikTok, its pages load those tags as soon as they open, before any choice by the Buyer.
So the Merchant is responsible for getting the consent the ePrivacy rules require from its Buyers before any tag, video, or custom code that needs it runs, for example with a consent tool in its custom code, as the CNIL’s guidance on cookies and other trackers describes. A Merchant who can’t do this for its Buyers in the EU must not connect those tags for them.
6.Your choices
You can delete cookies and block them in your browser’s settings. Blocking the strictly necessary ones may stop you from signing in to the app, or from paying on a checkout.
On a Merchant’s site, use the Merchant’s consent tool where it has one, and contact the Merchant about its tags. For our own app and pages, write to privacy@tallrung.com.