In short
- Necessary cookies keep you signed in, protect the forms and remember this choice. They run without asking, because the site cannot work without them.
- Everything else (Google Analytics 4, Google Ads, TikTok) is off until you turn it on. Before you do, none of it is loaded, requested or given an identifier.
- You can change your mind at any time from Cookie Settings at the bottom of any page.
- This policy covers instantsite.app. Websites our customers publish are covered separately at the end.
Jump to a section
What cookies and similar technologies are
A cookie is a small piece of text a website asks your browser to keep and send back on the next request. Related technologies do the same job with a different mechanism: local storage and session storage hold data in the browser without sending it anywhere, and a tracking pixel is a script that reports back to whoever supplied it.
A first-party cookie belongs to the site you are on, instantsite.app. A third-party cookie belongs to another company’s domain and can be read by that company across the sites it appears on. This page says which is which for every cookie we are responsible for.
The categories we use
- Necessary
- Keeps you signed in, protects the forms and remembers this choice. The site cannot work without them, so they are always on. Your session with our sign-in provider, the bot check on the sign-in and sign-up forms, the fraud check on the card form, and the cookie that stores this decision.
- Analytics
- Lets us see which pages are used and where the build-a-website flow breaks down. Aggregate numbers, not a profile of you. Google Analytics 4.
- Functional
- Optional conveniences from other companies: a chat widget, an embedded player, a personalisation service. Nothing on Instantsite currently uses this category. It is listed so that turning it off keeps meaning something if we ever add one.
- Marketing
- Measures whether an advert brought you here. These are advertising technologies and they are cross-site by design. Google Ads and TikTok.
Necessary cookies
These are the cookies without which a feature you asked for cannot work. They are not optional, and there is no toggle for them.
| Cookie | Provider | What it is for | Party | How long it lasts |
|---|---|---|---|---|
| __session | Clerk | The signed session that keeps you logged in. Every page behind sign-in depends on it. | First party | Session, refreshed by Clerk |
| __client_uat | Clerk | Lets the page tell "signed out" from "not known yet" without a round trip, so the sign-in state does not flicker. | First party | Session |
| __clerk…, __refresh… | Clerk | Session handling and refresh. Which of these exist depends on how you signed in. | First party | Set by Clerk |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention on the card form in your dashboard billing settings. They are written by Stripe’s script and only on that screen. | First party | About a year and about 30 minutes respectively, per Stripe’s documentation |
| instantsite_consent | Instantsite | Your cookie choice. It holds three true/false values, a version number and the date you chose. It carries no identifier of any kind. | First party | 180 days |
Two other necessary services run without setting a cookie on our domain: the Cloudflare Turnstile bot check, which appears only on the sign-in, sign-up and job-application forms, and the video player on the home page, which requests nothing at all until you press play.
Analytics
| Cookie | Provider | What it is for | Party | How long it lasts |
|---|---|---|---|---|
| _ga | Google Analytics 4 | Counts page views and shows which parts of the product people reach, so we can see where the flow from description to published website breaks down. | First party | 2 years |
| _ga_… | Google Analytics 4 | One per measurement id, e.g. _ga_T54LSYQ813. | First party | 2 years |
| _gid | Google Analytics 4 | Universal Analytics era. Cleaned up if an older visit left one. | First party | 24 hours |
| _gat… | Google Analytics 4 | Request throttling. | First party | 1 minute |
These are set by the provider’s script running on instantsite.app, so they are first-party cookies on our domain. Nothing in this table exists in your browser until you switch the category on, and turning it back off deletes them.
Functional
Nothing on instantsite.app currently uses this category. It appears here and in the cookie settings so that the choice keeps meaning something if that ever changes. If it does, this page and the consent version change with it.
Marketing
| Cookie | Provider | What it is for | Party | How long it lasts |
|---|---|---|---|---|
| _gcl_au | Google Ads | Tells us whether an advert led to a sign-up. It measures the advert, it does not build a profile of you here. | First party | 90 days |
| _gcl_… | Google Ads | Conversion-linker variants: _gcl_aw, _gcl_dc, _gcl_gs, _gcl_gb. | First party | up to 90 days |
| _ttp | TikTok | Measures whether a TikTok advert led to a sign-up. It is an advertising pixel and it is cross-site by design. | First party | 13 months |
| _tt_enable_cookie | TikTok | Records that the pixel is allowed to use cookies. | First party | 13 months |
These are set by the provider’s script running on instantsite.app, so they are first-party cookies on our domain. Nothing in this table exists in your browser until you switch the category on, and turning it back off deletes them.
These providers also set cookies on their own domains (google.com, doubleclick.net, tiktok.com). We cannot delete those; no website can delete a cookie belonging to another domain. Your browser’s settings and the provider’s own controls can.
Browser storage that is not a cookie
A few things are kept in your browser without being cookies. None of them is used for tracking and none of them is sent anywhere on its own.
- The description you typed
- Kept in session storage so it survives the trip through sign-up instead of being lost. It expires after an hour, is cleared once it has been used, and disappears when you close the tab.
- The plan you picked
- If you choose a plan before signing in, the plan and billing cycle are held in local storage so checkout resumes where you left off. They are removed as soon as checkout starts.
- Sign-in conveniences
- Your email address if you tick "remember me", and which form started a social sign-in so you land back in the right place.
- Dashboard state
- That a website was just published, so the dashboard shows the right thing before the server catches up.
How you choose, and how you change your mind
- Accepting
- “Accept all” on the banner turns on every optional category. The relevant scripts are added to the page at that moment, not before.
- Rejecting
- “Reject optional” is on the banner itself, next to Accept and the same size. It stores necessary-only consent, and nothing optional is loaded on this or any later visit.
- Choosing per category
- “Manage preferences” opens the settings dialog, where each optional category has its own switch. Every one of them starts off.
- Changing your mind
- Select Cookie Settings at the bottom of any page. It opens the same dialog whatever you chose before.
When you switch a category off after having had it on, we record the new choice, tell the provider’s script that consent is withdrawn, delete the first-party cookies listed in the tables above, and reload the page so the next one is built without those scripts in it. Cookies a provider has set on its own domain are outside our reach; your browser settings can clear those, and the provider’s own opt-out pages can too.
You can also refuse or delete cookies in your browser directly. Necessary cookies are included in that; blocking them will sign you out and break parts of the product, which is the sense in which they are necessary.
How long your choice lasts
Your choice is stored for 180 days, after which we ask again. It is also re-asked when what we do with the data materially changes (a new provider, a new purpose, a category moving) because a decision about the old set is not a decision about the new one. This page is at consent version 1. We do not reset your choice for a wording or layout change.
Websites published with Instantsite
This policy is about instantsite.app. It is not about the websites our customers build and publish with it.
A published website can have its own Google Analytics property, which its owner sees the traffic for. The consent controls described here do not extend to those sites and are not shown on them; consent for published websites is a separate piece of work that does not exist yet. If you publish a website with Instantsite, what its visitors are told and asked is your responsibility, and the Privacy Policy says the same.
Questions about this page
Privacy and data questions, including anything on this page, go to accountassistance@instantsite.app. What we do with personal information more generally is in the Privacy Policy.
Privacy Policy
What Instantsite collects when you build and publish a website, which companies process it, and how you get it changed or deleted.
Read the Privacy Policy