Privacy Policy
Last updated: October 31, 2026
Prism is a tool for keeping track of your personal assets and cash flow. This policy explains what data we collect, where it is stored, how it is used, and how you can view, export and delete it. We don't sell your data and we don't show ads.
What we collect
- Account: your email address, used to sign in and to send you sign-in codes.
- What you enter: accounts, balances and their history, cash-flow plan items and notes, plus settings such as display name, base currency, language and time zone.
- Security: your app passcode is stored only as a one-way hash. To prevent abuse we count sign-in requests, keeping IP addresses and emails only as one-way hashes.
- Usage: how many AI requests you make each day and their size, to enforce the daily limit.
- Error logs: when something fails, our servers log technical details — error type, code location and page path — without amounts or email addresses.
How we use it
- Only to provide the service to you: net worth, currency conversion, trends and forecasts.
- Never for advertising, never sold, and never shared with third parties for their marketing.
- We don't connect to your bank or exchange accounts; you enter all financial data yourself.
AI features
- Data is sent to an AI model only when you use an AI feature (Quick entry, Health check, Ask Prism).
- Only what the task needs is sent: totals, account types and currencies. With "AI anonymization" on (the default), account and institution names are replaced with placeholders.
- Your email and user ID are never sent.
- AI requests go through OpenRouter to the model providers (currently DeepSeek and Google Gemini models).
- Ask Prism conversations are not stored on our servers.
Where your data is stored
- Database and sign-in: Supabase, in Mumbai, India.
- Hosting: Vercel, with servers in Mumbai, India; static files are delivered through a global network.
- Sign-in emails: Resend.
- AI: OpenRouter and its model providers (see above).
- Exchange rates come from public rate services; those requests contain none of your data.
- These providers process data only to deliver their part of the service.
Cookies and local storage
- Only essential cookies: your sign-in session, language preference and app passcode state.
- Preferences such as theme and privacy mode are kept in your browser. Offline mode keeps recently viewed pages on your device; they are cleared when you sign out.
- No advertising cookies and no cross-site tracking.
Security
- All traffic is encrypted with HTTPS.
- The database separates users: each user can only reach their own data.
- The database is backed up daily, encrypted, for disaster recovery.
Retention and your rights
- Your data is kept until you delete your account.
- You can export everything at any time in Settings → Data (JSON or CSV), and permanently delete your account in Settings → Account; deletion removes your data from the database immediately.
- Encrypted backups are kept for at most 90 days and then deleted, so deleted data also leaves the backups within 90 days.
- Server error logs are kept only briefly by our hosting provider.
Children
- The service is not intended for anyone under 16.
Changes
- If this policy changes in an important way, we'll let you know in the app and update the date at the top of this page.
Contact
For any question or request about your data, email us at:
privacy@app.prismapp.me