Policy / privacy
Cookies and partners
This directory lists the categories of cookies, tools and partners INSTAR Lab uses or may use, what each is for, who receives the data, and how long it is kept. Policy version 2026-10-04.2, last updated 4 October 2026. ThePrivacy Policy explains your rights.
Categories
Every tool is gated by the purpose it serves, not by its vendor. Only Strictly necessary runs before you choose.
| Category | What it is for | Examples of what it covers | Default | Google Consent Mode signals |
|---|---|---|---|---|
| Strictly necessary | Keeps the site working and remembers your privacy choice. Always on. | Hosting and delivery of the pages, security, and the record of your own consent choice. These do not use advertising or analytics identifiers. | Always on | security_storage |
| Analytics and performance | Counts visits and shows which pages and features help, so we can improve the site. | Page views, engagement, scrolling, clicks, page speed measurements, approximate location, browser and device type, and masked session recordings and heatmaps that show where visitors click and get stuck. Typed text and form fields are masked and never recorded. Includes A/B testing tools when we add them. | Off until you choose | analytics_storage |
| Advertising and campaign measurement | Tells us which campaigns and ads lead to action, and lets advertising platforms count conversions. | Links a click on one of our ads to a later action on this site, and measures campaigns across platforms such as Google, Microsoft and LinkedIn, Meta, X and TikTok when we use them. Remembers the campaign tags and ad click identifiers in the address of the page you arrived on, for up to 90 days on this device, so that a form you choose to send us can carry the campaign that brought you. | Off until you choose | ad_storage, ad_user_data |
| Personalization and audiences | Lets us build audiences and show more relevant messages on this site and on partner platforms. | Audience building, remarketing, and marketing automation or CRM audience sync. No tool uses this category today; it is listed so you can decide in advance. | Off until you choose | ad_personalization, personalization_storage |
| Partner and agency tools | Lets partners and agencies we work with run their tools on this site. | Embedded or connected tools operated by research partners, program partners, or agencies on our behalf. No such tool is active today. | Off until you choose | functionality_storage |
Partners and tools in use today
These are the only tools configured on this site. Tools in the second table are not in use.
| Partner or tool | Category | Purpose | Data | Data recipients | Retention | Status |
|---|---|---|---|---|---|---|
| GitHub, Inc. (GitHub Pages hosting) | Strictly necessary | Serves the website and protects it from abuse. | Technical request data such as network address and browser type, processed to deliver the pages. | GitHub, Inc., under its own privacy statement. INSTAR Lab does not receive or analyze these logs. | Set by GitHub. | In use |
| Cloudflare, Inc. (network and delivery layer in front of GitHub Pages) | Strictly necessary | Delivers the website over an encrypted connection, adds security headers, protects it from abuse, and tells the page which country a request came from so the right privacy dialog is shown. | Technical request data such as network address and browser type, processed to deliver the pages. The country hint is a single response header on a small file; it is not stored or linked to you. No Cloudflare analytics, cookies or bot-detection scripts are used. | Cloudflare, Inc., under its own privacy statement. INSTAR Lab does not receive or analyze these logs. | Set by Cloudflare. | In use |
| Google Tag Manager (Google LLC) | Tag layer for the categories below | Loads, and only when you have allowed the matching category, runs the tools below. It sets no cookie itself. | Request data such as network address and browser type when the container is fetched. Never requested until you turn on at least one optional category. | Google LLC as our service provider. | Set by Google. | In use |
| Google Analytics 4 (Google LLC) | Analytics and performance | Counts visits and engagement: page views, scrolling, button and link clicks, page speed (Core Web Vitals), links followed to Fellowship applications and email, and reading the federal funding guide. | Page address and title, referrer, approximate location from the network address (not stored as an address), browser, device type and screen size, and the actions listed here. No name, email address or typed text: the site has no forms. | Google LLC as our service provider. | Event data up to 14 months, then deleted automatically. Cookies up to 2 years. | In use |
| Microsoft Clarity (Microsoft Corporation) | Analytics and performance | Shows where visitors click, scroll and get stuck, through heatmaps and session recordings, so we can improve pages. Masking is set to the strictest mode: all text and anything typed into a field is hidden and never recorded. | Masked page interactions (clicks, scrolls, movements), page address, referrer, browser, device type and screen size, approximate location from the network address, and Microsoft identifiers set in cookies (see the cookie table). No name, email address or typed text. | Microsoft Corporation as our service provider. INSTAR Lab does not link Clarity to Microsoft Advertising and grants it no advertising storage. | Recordings and heatmaps are kept by Microsoft for up to 30 days (13 months if favorited by us). Cookies from session to about 13 months. | In use |
| Google Ads conversion measurement and Conversion Linker (Google LLC) | Advertising and campaign measurement | Counts when a visit that began with an INSTAR Lab ad leads to one of the same actions, so we can judge and manage our own campaigns. | The ad click identifier, the action taken and its page, and the same technical data as above. Google signals and ad personalization signals are switched off in these tags. | Google LLC as our advertising partner and service provider. | Cookies up to 90 days; conversion data under Google Ads standard retention, which we do not extend. | In use |
Categories of tools and partners we may add
We list a tool here before it can run. Adding a tool to an existing category does not change your choice. Adding a new category, or using a category in a materially new way, changes the policy version and everyone is asked again.
| Partner or tool | Category | Purpose | Data | Data recipients | Retention | Status |
|---|---|---|---|---|---|---|
| Other advertising platforms (for example Microsoft Advertising and LinkedIn, Meta, X, TikTok) | Advertising and campaign measurement | Measure campaigns that run on those platforms. | Click identifiers, the action taken, and technical request data. | The platform operator, as our advertising partner. | Stated here before any tool is added. | Not in use |
| A/B testing and additional analytics tools | Analytics and performance | Test page designs and understand how pages are used. | Page interactions and technical request data. | The tool provider, as our service provider. | Stated here before any tool is added. | Not in use |
| Marketing automation, CRM and audience synchronization tools (for example HubSpot-type services) | Personalization and audiences | Build audiences and send more relevant messages. | Page and campaign activity linked to an audience segment. | The tool provider, as our service provider, and any advertising platform an audience is sent to. | Stated here before any tool is added. | Not in use |
| Partner and agency tools | Partner and agency tools | Let research, program or agency partners run their own measurement or integrations on our behalf. | Depends on the tool; stated here before it is added. | The named partner or agency. | Stated here before any tool is added. | Not in use |
Cookies and browser storage, in full
These are the only items this site or its tags can set.
| Name | Type and setter | Category | Purpose | Lifetime | Set |
|---|---|---|---|---|---|
| instar-consent-v2, instar-consent-log-v2 | Site storage (localStorage); set by instarlab.org | Strictly necessary | Your consent receipt: the choice you made, its date, a random consent ID, the policy version, your region class and whether a Global Privacy Control signal was present. It never leaves your browser unless you send it to us with a privacy request. | Until you clear it or 12 months pass, whichever is first; replaced when the policy version changes | When you make a choice |
| _ga, _ga_<container id> | Cookie; set by Google Analytics 4 (through Google Tag Manager), on instarlab.org | Analytics and performance | Distinguishes visits so page views and engagement can be counted. | Up to 2 years (Google default); event data is kept up to 14 months | Only with Analytics and performance on |
| _gcl_au, _gcl_aw | Cookie; set by Google Ads conversion tag (through Google Tag Manager), on instarlab.org | Advertising and campaign measurement | Links a click on an INSTAR Lab ad to a later action on this site so that conversions can be counted. | Up to 90 days | Only with Advertising and campaign measurement on |
| _clck, _clsk, CLID, ANONCHK, MR, MUID, SM | Cookie; set by Microsoft Clarity (through Google Tag Manager) and Microsoft, on instarlab.org and clarity.ms; set by Microsoft Corporation | Analytics and performance | Recognizes a visit and its session so masked heatmaps and recordings can be assembled. MUID is a Microsoft browser identifier that Clarity sets; INSTAR Lab does not link it to Microsoft Advertising. | From the session to about 13 months | Only with Analytics and performance on |
| instar-attribution-v1 | Site storage (localStorage); set by instarlab.org | Advertising and campaign measurement | Remembers the campaign tags (UTM) and ad click identifiers from the address you arrived on, so a form you choose to send can carry the campaign that brought you. | Up to 90 days on this device; cleared when you withdraw advertising consent | Only with Advertising and campaign measurement on |
| Core Web Vitals, scroll depth, button and form events | No storage; events sent to Google Analytics 4; set by instarlab.org page script | Analytics and performance | Page speed (Core Web Vitals), scroll depth, button and link clicks and whether a form was started or sent, never any typed value. | Not stored in your browser | Only with Analytics and performance on |
Forms and our Salesforce CRM
This is not a cookie or an advertising tag. When you send a form, your submission and the campaign link you arrived from are stored in INSTAR Lab’s Salesforce CRM through a form service on Microsoft Azure. Click identifiers and first-visit data are stored only if the Advertising and campaign measurement category is on. The full list of what is stored, why, for how long and your rights is in the Privacy Policy. Read the Privacy Policy section.
Your privacy choices
You can change or withdraw your choice at any time, including switching every optional category off. The same control is the Privacy choices link in the footer of every page. A browser Global Privacy Control signal is honored: optional categories stay off until you choose.
Privacy requests
To ask what we hold about you, correct or delete it, withdraw consent, or opt out of sharing, emailinfo@instarlab.org with the subject “Privacy request”. Include your consent ID (shown in Privacy choices) if you want us to find your consent record. We answer within the time the law allows, and we never penalize anyone for making a request.