>However, unlike cookies, existing HSTS flags are still shared with sites when using "incognito" or "private" windows.

fwiw, though Firefox is listed in there as "leaks across private mode", I get an entirely new ID when I open a private window. v34.0.5