Track Tally Forms submissions in Google Tag Manager with this Free GTM Recipe

(function () {
  if (window.__converlyRecipeTally) return;
  window.__converlyRecipeTally = true;
  window.dataLayer = window.dataLayer || [];

  function fireConversion(formId, formName) {
    window.dataLayer.push({
      event: 'tally_form_submitted',
      form_id: formId || '',
      form_name: formName || ''
    });
  }

  function parseMessageData(data) {
    if (!data) return null;
    if (typeof data === 'string') {
      try {
        return JSON.parse(data);
      } catch (e) {
        return null;
      }
    }
    if (typeof data === 'object') return data;
    return null;
  }

  // HTTPS-only, host-anchored so "evil-tally.so.attacker.io" (substring)
  // and "http://tally.so" (scheme downgrade) both fail.
  var TALLY_ORIGIN_PATTERN = /(^|\.)tally\.so$/;

  function isTrustedOrigin(event) {
    if (!event) return false;
    // Reject self-posted messages: Tally never posts from our own window.
    if (event.source === window) return false;
    // Reject messages with no source — a real cross-origin iframe message
    // always carries a source WindowProxy.
    if (!event.source) return false;
    if (!event.origin || typeof event.origin !== 'string') return false;
    var hostMatch = /^https:\/\/([^/]+)/.exec(event.origin);
    if (!hostMatch) return false;
    return TALLY_ORIGIN_PATTERN.test(hostMatch[1]);
  }

  function handleMessage(event) {
    try {
      if (!event || !event.data) return;
      var msg = parseMessageData(event.data);
      if (!msg) return;
      var eventName = msg.event || msg.type;
      if (eventName !== 'Tally.FormSubmitted') return;
      if (!isTrustedOrigin(event)) return;

      // Payload-schema check: a well-formed Tally.FormSubmitted carries a
      // payload object whose `fields` is an array. Without this a malformed
      // (but origin-trusted) message could still fire a phantom conversion.
      var payload = msg.payload || msg.data || msg;
      if (!payload || typeof payload !== 'object' || !Array.isArray(payload.fields)) return;

      // formId/formName are Tally's own form metadata carried directly on
      // the payload — not user-submitted field values — so reading them
      // costs nothing beyond the object property access already needed for
      // the shape check above.
      fireConversion(payload.formId, payload.formName);
    } catch (e) {
      // Never throw back into the page's own message handling.
    }
  }

  if (typeof window !== 'undefined' && window.addEventListener) {
    window.addEventListener('message', handleMessage, false);
  }
})();