This page lists every cookie and similar storage that usanakidseat.org, or something embedded on it, can place in your browser. We keep it by hand, so it describes what the site actually does rather than what a scanner guessed. Cookies come in three groups. Necessary cookies make the site work, including the donation and contact forms. Statistics cookies help us understand how the site is used. Marketing cookies belong to the videos and social posts embedded on the home page, the Resources page and some blog stories. No optional cookies are set until you choose. One thing does happen when a page opens, before you choose: Google Analytics receives a cookieless count of the page view, which includes your IP address (see Statistics).
Last updated October 27, 2026. Cookie list version 1.
Where your choice is stored
Your choice lives in your own browser, in one small first-party cookie called usf_consent. It records which groups you allowed, when you decided, and which version of this list you saw. Nothing about your choice is sent to or stored on our servers. If you want a copy for your own records, open Cookie settings and press Download a copy: your browser saves a short text file with your choices, the date and time, and the version of this list. To change your mind at any time, use the Cookie settings link at the bottom of every page, including the search and page not found pages.
Browser privacy signals
If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as an answer of only necessary cookies and do not show you the banner. You can still opt in later through Cookie settings, and that explicit choice is the one we follow.
Necessary
Needed for the site to work: our own cookie that remembers your choices, and the cookies set inside the Donorbox donation form and the Airtable contact form so you can give or write to us. Those two forms load only on the donate page and the contact page. Always on.
Remembers which cookie groups you allowed, when you decided, and which version of this list you saw. It is also the record shown under Your current choices in Cookie settings.Used on: All pages, once you have made a choice
Keep the donation form working while you give. Set inside the Donorbox frame, not by our pages.Used on: Donate page (1 page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22: Donorbox's privacy policy confirms it uses cookies and that Stripe and PayPal process payments, but does not name its cookies or their lifetimes.
Session
HTTP cookie
__stripe_mid
Stripe (inside the Donorbox form) (third party) Provider details
Fraud prevention. Helps Stripe judge whether a card payment attempt is genuine. Needed to donate by card.Used on: Donate page (1 page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22 against Stripe's cookie settings page: Essential, 1 year.
1 year
HTTP cookie
__stripe_sid
Stripe (inside the Donorbox form) (third party) Provider details
Fraud prevention for the current payment session.Used on: Donate page (1 page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22 against Stripe's cookie settings page: Essential, 30 minutes.
30 minutes
HTTP cookie
m
Stripe (inside the Donorbox form) (third party) Provider details
Fraud detection. Helps Stripe assess the risk of a payment attempt. Set from m.stripe.com.Used on: Donate page (1 page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22 against Stripe's cookie settings page: Essential, 2 years.
2 years
HTTP cookie
_GRECAPTCHA
Google reCAPTCHA (inside the Donorbox form) (third party) Provider details
Tells real donors from automated bots before a payment is accepted.Used on: Donate page (1 page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22: Google's reCAPTCHA FAQ names _GRECAPTCHA as a necessary cookie for risk analysis but does not state a lifetime; 6 months is Google's commonly published value.
6 months
HTTP cookie
cf_clearance
Cloudflare (inside the Donorbox form) (third party) Provider details
Proof that your browser passed Cloudflare's bot check, so you are not asked again.Used on: Donate page (1 page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22: Cloudflare describes cf_clearance as strictly necessary; the 1 year lifetime is from Vimeo's player cookie list.
1 year
HTTP cookie
__cf_bm
Cloudflare (inside the Donorbox form and the Airtable contact form) (third party) Provider details
Cloudflare's bot manager, which tells people from automated traffic.Used on: Donate page and contact page (2 pages)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22: Cloudflare states it expires after 30 minutes of inactivity and is strictly necessary.
30 minutes
HTTP cookie
_cfuvid
Cloudflare (inside the Donorbox form) (third party) Provider details
Lets Cloudflare tell apart visitors who share one internet address, for rate limiting.Used on: Donate page (1 page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22 against Cloudflare's cookie reference and Vimeo's player cookie list (session).
Session
HTTP cookie
NRBA_SESSION
New Relic (inside the Donorbox form) (third party) Provider details
Performance monitoring for the Donorbox form, so Donorbox can see when their form is slow or failing.Used on: Donate page (1 page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Reported by the previous scanner inside the Donorbox frame; not re-verified against New Relic's documentation on 2026-09-22. Spot-check in a browser before cutover.
Session
HTTP cookie
Airtable session cookies (including AWSALB and AWSALBCORS)
Keep the contact form working and route your form session to the right Airtable server.Used on: Contact page (1 page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22: Airtable's cookie policy describes a strictly necessary category but does not name cookies; its linked cookie list is a JavaScript page that could not be read. AWSALB and AWSALBCORS are Amazon load balancer cookies with a default life of 7 days.
Up to 7 days
HTTP cookie
hmt_id
hCaptcha (inside the Airtable contact form) (third party) Provider details
Tells real people from bots on the contact form.Used on: Contact page (1 page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22 against hCaptcha's privacy policy cookie table: strictly necessary, 30 days.
30 days
HTTP cookie
__cflb
Cloudflare (inside the Airtable contact form, via hCaptcha) (third party) Provider details
Keeps your form session on the same server while you fill it in.Used on: Contact page (1 page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22: Cloudflare states from several seconds up to 24 hours; hCaptcha lists it as strictly necessary.
Up to 24 hours
HTTP cookie
The donation form and the contact form are frames from Donorbox and Airtable. The cookies inside them are set by Donorbox, Stripe, Google reCAPTCHA, Cloudflare, New Relic, Airtable and hCaptcha, not by our pages, and they are needed to donate or to send us a message. We list them so you know they exist, but we cannot switch them off without breaking the forms. Fonts are loaded from Google Fonts on every page; Google Fonts sets no cookies, but Google does see your IP address when your browser fetches the font files.
Statistics
Help us see how the site is used: which pages are read, from which countries, on what kind of device. Google Analytics sets these cookies only after you say yes. Before that, Google still receives a cookieless count of each page view; that request carries your IP address and browser details, which Google says it does not use to identify you.
Tells one visitor from another so we can count visits and returning visitors. Set only after you accept statistics cookies.Used on: All pages (live site only; analytics is off on the staging address)Same Google Analytics cookie as the Foundation list, checked 2026-09-22. Earlier note: Checked 2026-09-22: Google states 2 years, used to distinguish users.
Keeps the pages you view in one visit together as a session. Set only after you accept statistics cookies.Used on: All pages (live site only)Named for the Kids Eat measurement id G-MMERZQEBMM (property 393781559). Lifetime and purpose checked for the Foundation on 2026-09-22. Earlier note: Checked 2026-09-22: Google states 2 years for _ga_<container-id>, used to persist session state.
2 years
HTTP cookie
Turning Statistics off tells Google Analytics to stop and deletes its cookies at once.
Marketing
Videos and posts embedded from YouTube, Instagram and Issuu on the home page, the Resources page and some of our blog stories. Those companies set cookies to recognise you across websites and, for their own purposes, to personalise what you see, including advertising on their platforms. We do not run ads. On this site each embed stays covered by a Load button until you accept marketing cookies or press the button; pressing Load on one item loads only that item unless you also tick the remember box under it.
Estimates your connection speed and can enable personalised recommendations on YouTube based on past views.Used on: The 3 pages that embed a YouTube video (the home page, Resources and the Holiday Bag Project page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22 against Google's cookie list: expires 6 months after last use. Independent tests report YouTube can set this cookie on youtube-nocookie.com as well, which is why the video stays covered until you choose.
Makes sure requests within one browsing session come from you and not from another site.Used on: The 3 pages that embed a YouTube video (the home page, Resources and the Holiday Bag Project page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22 against Google's cookie list: lasts for the browsing session.
Stores player preferences such as autoplay choices and player size.Used on: The 3 pages that embed a YouTube video (the home page, Resources and the Holiday Bag Project page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22 against Google's cookie list: expires 8 months from last use.
Lets YouTube launch new features and measure them when other identifiers cannot be used.Used on: The 3 pages that embed a YouTube video (the home page, Resources and the Holiday Bag Project page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22 against Google's cookie list: 6 months.
Helps YouTube detect spam, fraud and abuse, and supports Google's advertising purposes on YouTube.Used on: The 3 pages that embed a YouTube video (the home page, Resources and the Holiday Bag Project page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Checked 2026-09-22 against Google's cookie list: 13 months, to detect spam, fraud and abuse and for advertising purposes. Google lists the older __Secure-YEC with the same lifetime and purpose alongside it.
Browser storage the YouTube player uses to remember the device and any connected screens.Used on: The 3 pages that embed a YouTube video (the home page, Resources and the Holiday Bag Project page)Carried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Local storage written by the embedded player, widely reported by cookie scanners; Google's cookie list does not describe it. Spot-check in a browser before cutover.
Security token that protects Instagram's embed against forged requests.Used on: The 19 blog stories that embed Instagram postsCarried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Instagram is covered by Meta's cookie policy, whose per-cookie table could not be read by an automated check on 2026-09-22; 1 year is the lifetime Meta publishes. Spot-check in a browser before cutover.
Machine identifier that ties the embed to your browser.Used on: The 19 blog stories that embed Instagram postsCarried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Instagram has requested lifetimes as long as 10 years for this cookie; modern browsers cap any cookie at 400 days. Spot-check in a browser before cutover.
Device identifier used when showing embedded Instagram posts.Used on: The 19 blog stories that embed Instagram postsCarried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Instagram has requested lifetimes as long as 10 years for this cookie; modern browsers cap any cookie at 400 days. Spot-check in a browser before cutover.
Identifies the browser for security on Instagram's embed.Used on: The 19 blog stories that embed Instagram postsCarried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Same cookie name as Facebook's, set on the instagram.com domain. Lifetime per Meta's published list.
Recognises your device and remembers which Issuu documents you have read.Used on: The 2023 annual report story, which embeds the Issuu readerCarried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Issuu's cookie list page rendered only navigation on 2026-09-22 and its privacy policy names no cookies; description per third-party cookie databases. Spot-check in a browser before cutover.
Short-lived identifier used by Issuu's reader analytics.Used on: The 2023 annual report story, which embeds the Issuu readerCarried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Lifetime per third-party cookie databases; not readable from Issuu's own page on 2026-09-22.
Audience measurement and advertising analytics for Issuu.Used on: The 2023 annual report story, which embeds the Issuu readerCarried over from the Foundation list, which checked it on 2026-09-22; Kids Eat uses the same provider. Kids Eat pages counted 2026-09-30. Earlier note: Lifetime per third-party cookie databases; not readable from Issuu's own page on 2026-09-22.
13 months
HTTP cookie
YouTube videos use youtube-nocookie.com, YouTube's privacy-enhanced player, which stops your viewing here from shaping your YouTube recommendations, but YouTube can still set cookies once the video runs. The covered box for a video is drawn by our own page, not a preview picture from the provider, so nothing is fetched from these companies until you choose. Lifetimes are the values each company publishes and can change without notice; where a company does not publish one, we say so.
