This page lists every cookie and similar storage that usanafoundation.org, or something embedded on it, can place in your browser. We keep it by hand, so it describes what the site actually does rather than what a scanner guessed. Cookies come in three groups. Necessary cookies make the site work, including the donation and contact forms. Statistics cookies help us understand how the site is used. Marketing cookies belong to the videos and social posts embedded on some blog stories and on the Who we are page. No optional cookies are set until you choose. Two things do happen when a page opens, before you choose: Google Analytics receives a cookieless count of the page view, which includes your IP address (see Statistics), and the home page shows a background video from Vimeo with Vimeo's do not track setting on (see Necessary).
Where your choice is stored
Your choice lives in your own browser, in one small first-party cookie called usf_consent. It records which groups you allowed, when you decided, and which version of this list you saw. Nothing about your choice is sent to or stored on our servers. If you want a copy for your own records, open Cookie settings and press Download a copy: your browser saves a short text file with your choices, the date and time, and the version of this list. To change your mind at any time, use the Cookie settings link at the bottom of every page, including the search and page not found pages.
Browser privacy signals
If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as an answer of only necessary cookies and do not show you the banner. You can still opt in later through Cookie settings, and that explicit choice is the one we follow.
Necessary
Needed for the site to work: our own cookie that remembers your choices, and the cookies set inside the Donorbox donation form and the Airtable contact form so you can give or write to us. Those two forms load only on the donate pages and the contact page. Always on.
| Name | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
usf_consent | USANA Foundation (first party) Provider details | Remembers which cookie groups you allowed, when you decided, and which version of this list you saw. It is also the record shown under Your current choices in Cookie settings. | 12 months | HTTP cookie |
Donorbox session cookies | Donorbox (third party) Provider details | Keep the donation form working while you give. Set inside the Donorbox frame, not by our pages. | Session | HTTP cookie |
__stripe_mid | Stripe (inside the Donorbox form) (third party) Provider details | Fraud prevention. Helps Stripe judge whether a card payment attempt is genuine. Needed to donate by card. | 1 year | HTTP cookie |
__stripe_sid | Stripe (inside the Donorbox form) (third party) Provider details | Fraud prevention for the current payment session. | 30 minutes | HTTP cookie |
m | Stripe (inside the Donorbox form) (third party) Provider details | Fraud detection. Helps Stripe assess the risk of a payment attempt. Set from m.stripe.com. | 2 years | HTTP cookie |
_GRECAPTCHA | Google reCAPTCHA (inside the Donorbox form) (third party) Provider details | Tells real donors from automated bots before a payment is accepted. | 6 months | HTTP cookie |
cf_clearance | Cloudflare (inside the Donorbox form; also set by the Vimeo player on the home page) (third party) Provider details | Proof that your browser passed Cloudflare's bot check, so you are not asked again. | 1 year | HTTP cookie |
__cf_bm | Cloudflare (inside the Donorbox form, the Airtable contact form and the Vimeo player on the home page) (third party) Provider details | Cloudflare's bot manager, which tells people from automated traffic. | 30 minutes | HTTP cookie |
_cfuvid | Cloudflare (inside the Donorbox form; also set by the Vimeo player on the home page) (third party) Provider details | Lets Cloudflare tell apart visitors who share one internet address, for rate limiting. | Session | HTTP cookie |
player_clearance | Vimeo (home page background video) (third party) Provider details | Bot prevention for the Vimeo video player that shows the home page background video. | 7 days | HTTP cookie |
NRBA_SESSION | New Relic (inside the Donorbox form) (third party) Provider details | Performance monitoring for the Donorbox form, so Donorbox can see when their form is slow or failing. | Session | HTTP cookie |
Airtable session cookies (including AWSALB and AWSALBCORS) | Airtable (third party) Provider details | Keep the contact form working and route your form session to the right Airtable server. | Up to 7 days | HTTP cookie |
hmt_id | hCaptcha (inside the Airtable contact form) (third party) Provider details | Tells real people from bots on the contact form. | 30 days | HTTP cookie |
__cflb | Cloudflare (inside the Airtable contact form, via hCaptcha) (third party) Provider details | Keeps your form session on the same server while you fill it in. | Up to 24 hours | HTTP cookie |
The donation form and the contact form are frames from Donorbox and Airtable. The cookies inside them are set by Donorbox, Stripe, Google reCAPTCHA, Cloudflare, New Relic, Airtable and hCaptcha, not by our pages, and they are needed to donate or to send us a message. We list them so you know they exist, but we cannot switch them off without breaking the forms. The background video at the top of the home page comes from Vimeo and loads when the page opens, with Vimeo's do not track setting on: Vimeo sees your IP address and sets only the security cookies listed here, not its analytics cookie. Those load on page open and the cookie banner does not control them. Fonts are loaded from Google Fonts on every page; Google Fonts sets no cookies, but Google does see your IP address when your browser fetches the font files.
Statistics
Help us see how the site is used: which pages are read, from which countries, on what kind of device. Google Analytics sets these cookies only after you say yes. Before that, Google still receives a cookieless count of each page view; that request carries your IP address and browser details, which Google says it does not use to identify you.
| Name | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
_ga | Google Analytics (first party) Provider details | Tells one visitor from another so we can count visits and returning visitors. Set only after you accept statistics cookies. | 2 years | HTTP cookie |
_ga_XS1J1JCEZ2 | Google Analytics (first party) Provider details | Keeps the pages you view in one visit together as a session. Set only after you accept statistics cookies. | 2 years | HTTP cookie |
Turning Statistics off tells Google Analytics to stop and deletes its cookies at once. Vimeo, which hosts the home page background video, is not in this group: that video loads with Vimeo's do not track setting on, so Vimeo sets no analytics cookie for it. Its security cookies are listed under Necessary.
Marketing
Videos and posts embedded from YouTube, Facebook, Instagram and Issuu on some of our blog stories and on the Who we are page. Those companies set cookies to recognise you across websites and, for their own purposes, to personalise what you see, including advertising on their platforms. We do not run ads. On this site each embed stays covered by a Load button until you accept marketing cookies or press the button; pressing Load on one item loads only that item unless you also tick the remember box under it.
| Name | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
VISITOR_INFO1_LIVE | YouTube (Google) (third party) Provider details | Estimates your connection speed and can enable personalised recommendations on YouTube based on past views. | 6 months | HTTP cookie |
YSC | YouTube (Google) (third party) Provider details | Makes sure requests within one browsing session come from you and not from another site. | Session | HTTP cookie |
PREF | YouTube (Google) (third party) Provider details | Stores player preferences such as autoplay choices and player size. | 8 months | HTTP cookie |
__Secure-ROLLOUT_TOKEN | YouTube (Google) (third party) Provider details | Lets YouTube launch new features and measure them when other identifiers cannot be used. | 6 months | HTTP cookie |
__Secure-YENID | YouTube (Google) (third party) Provider details | Helps YouTube detect spam, fraud and abuse, and supports Google's advertising purposes on YouTube. | 13 months | HTTP cookie |
yt-remote-device-id and related yt-remote entries | YouTube (Google) (third party) Provider details | Browser storage the YouTube player uses to remember the device and any connected screens. | Persistent (until cleared) | Browser storage |
fr | Facebook (Meta) (third party) Provider details | Meta's main advertising cookie. Recognises your browser to deliver, measure and improve ads on Meta's platforms. | 3 months | HTTP cookie |
datr | Facebook (Meta) (third party) Provider details | Identifies the browser for security, for example to detect suspicious logins and bots. | 400 days | HTTP cookie |
sb | Facebook (Meta) (third party) Provider details | Identifies the browser for security and to remember account chooser settings. | 400 days | HTTP cookie |
csrftoken | Instagram (Meta) (third party) Provider details | Security token that protects Instagram's embed against forged requests. | 1 year | HTTP cookie |
mid | Instagram (Meta) (third party) Provider details | Machine identifier that ties the embed to your browser. | Up to 400 days | HTTP cookie |
ig_did | Instagram (Meta) (third party) Provider details | Device identifier used when showing embedded Instagram posts. | Up to 400 days | HTTP cookie |
datr | Instagram (Meta) (third party) Provider details | Identifies the browser for security on Instagram's embed. | 400 days | HTTP cookie |
iutk | Issuu (third party) Provider details | Recognises your device and remembers which Issuu documents you have read. | Not published by Issuu (long-lived) | HTTP cookie |
mc | Issuu (third party) Provider details | Short-lived identifier used by Issuu's reader analytics. | 1 day | HTTP cookie |
__qca | Quantcast (via the Issuu reader) (third party) Provider details | Audience measurement and advertising analytics for Issuu. | 13 months | HTTP cookie |
YouTube videos use youtube-nocookie.com, YouTube's privacy-enhanced player, which stops your viewing here from shaping your YouTube recommendations, but YouTube can still set cookies once the video runs. The covered box for a video is drawn by our own page, not a preview picture from the provider, so nothing is fetched from these companies until you choose. Lifetimes are the values each company publishes and can change without notice; where a company does not publish one, we say so.
