Privacy Policy
Effective Date: November 10, 2026
This Privacy Policy explains how Sabian Colbert (“we”, “us”, “our”) collects, uses, and protects your information when you use the Prismal Planning website and services (the “Site”). If you do not agree with this Policy, please do not use the Site.
Prismal Planning is intended for people 18 and older. You must be 18 or older to create an account (see Section 7).
1) What We Collect
A) Information You Provide directly
When you create an account, we collect the username, password, email address, and birth date you provide, and we record when you agreed to this Privacy Policy and the Terms of Use. We ask your birth date only to make sure you're 18 or older; if you typed it wrong, you can fix it in Settings. We store your account details and your budget and finance data, for each budget you keep (such as your entries and the notes you add to them, recurring payments, goals, the wavelengths you name for what your money is for and which one each title is on, what you keep in the calculators, the pay settings of any calendar you connect, history, and change logs, which keep what each change did so it can be undone) in our Cloudflare SQL database. We never store your password itself, only a protected one-way form of it (see Section 5). You can sign in with your username or your email address (or another email of yours you add and confirm, see Section 1E). We use your email address to send you account emails, such as email verification links, password reset links, and security notices. When you create your account or change your email, we email you a link to verify that the address is yours, and we record when it's verified. Connecting a spreadsheet or a calendar requires a verified email (see Section 1E). To keep automated sign-ups out, the Create Account form uses Cloudflare Turnstile, which looks at information from your browser and device (not your budget or what you type) to check that you're a person; Cloudflare handles it under its own privacy policy, and we only receive whether the check passed.
B) Passkeys (Face ID, Touch ID, Windows Hello)
Passkey sign-in is optional. If you turn it on, your device (or the password manager it uses, such as iCloud Keychain, Google Password Manager, or Windows Hello) makes a passkey for the Site, and we store the passkey's public key and ID, the name you give it, the site address it was made on, when it was added and last used, whether your device reports it as synced, and a sign-in counter. We also store a random ID for your account that your devices keep with its passkeys, and whether you chose to turn passkey sign-in on or off (so we only ask you once). The private part of a passkey never leaves your device or password manager. Your face, fingerprint, or device PIN is checked only by your device: we never receive, see, or store any biometric data, only a yes from your device that the check passed. Your device or password manager keeps the passkey along with your username (so it can show which account it's for), and those companies handle it under their own privacy policies. Your browser also remembers the ID of the passkey it last signed in with (in its own storage, even after you sign out), so the login page can ask your device for that passkey right away; nothing else about you is kept with it.
C) Reminders, Notifications & Quick Entry
If you turn on reminders, we store your reminder time, your time zone, which kinds of reminders you want, which of your budgets they're about, which days that budget needs a reminder, and for each entry you set a reminder on, its title and day (so the reminder can name it). If you turn on push notifications, we store the push address your browser gives us for that device (provided by your browser's push service, such as Apple, Google, or Mozilla). If you turn on a calendar link, we store the private code in that link. If you set up a Quick Entry home screen icon, we store a protected form of its key and which budget it adds to, along with the entries you make with it until they're added to that budget (entries from an icon on another device wait on the budget's Home until someone who can open it adds or deletes them), any prisms (saved entries you add often) you make on its page, and whether your icons show balances (a choice in Settings).
D) Analytics Data
We use Google Analytics to understand how the Site is used. It may collect general device and browser information, approximate location (derived from IP address), and site usage events. Google Analytics never sees your budget, and the page addresses we send it leave out everything after the page's name, such as the private code in a password reset link. It doesn't load at all if your browser sends a Global Privacy Control or Do Not Track signal, or if you turn analytics off for your device in Settings. Our infrastructure provider, Cloudflare, also counts page visits for us (Cloudflare Web Analytics); it doesn't use cookies or follow you across other websites. We don't show ads, and we don't use advertising services.
E) Connected Spreadsheets & Calendars
Connecting a spreadsheet is optional, and requires your email address to be verified. If you connect one on the Spreadsheets & Calendars page, we store its link, the name you give it, the names of its tabs, which cells each part of an entry comes from (or what you typed in instead), and the entries it makes (their dates, titles, amounts, refraction types, and Equity accounts), along with any problems found reading it, like a cell that isn't a date. Each time Home or the Spreadsheets & Calendars page reads your spreadsheets, our server downloads each one from where it's kept (Google, Microsoft, or Dropbox) and passes the file straight to your browser, which reads the cells you picked. We don't keep the file, or any other part of the spreadsheet. The host receives that request from our server, not from your device, so it doesn't get your IP address from it.
You share a spreadsheet with us in one of two ways. Anyone with the link: anyone who has the link can see the whole spreadsheet, so we suggest a separate spreadsheet with only the cells Prismal Planning needs. Shared with [email protected] (Google Sheets and Google Drive): our Google account can view the spreadsheet, and we read it only for the Prismal Planning account whose verified email, or another email it confirmed under Other Emails, matches the Google account that owns it or shared it, never for anyone else, and only the way described above. If you add an email under Other Emails in Settings (under Email), we store it and when it was confirmed, and email it a link to confirm it's yours, with your username so you can tell which account asked. Once it's confirmed, you can also sign in to your account with it (with your password), and use it for Forgot Password, which emails the reset link to it. Removing it there, or deleting your account, deletes it. You can remove our access at any time in the spreadsheet's Share settings. Deleting a connection on the Spreadsheets & Calendars page deletes everything we stored about it, except the entries already on days that passed, which stay part of your budget.
Connecting a calendar of your work shifts is optional too, and also requires a verified email address. If you connect one, we store its link (anyone who has a calendar's link can see its events, so we keep it with your budget like the rest of your data, and Download My Data includes it), the name you give it, its paychecks' title, refraction type, and Equity account, the pay settings you enter (such as your pay rates, paydays, deductions, and tax settings, including what you enter from your Form W-4, like your filing status and amounts), and what each paycheck came to (its pay period, hours, pay, deductions, taxes, and take home), along with the entries they make and any problems found reading it. Each time Home or the Spreadsheets & Calendars page reads your calendars, our server downloads each one from its link (from the calendar's provider, such as Apple, Google, Microsoft, or a work scheduling app) and passes it straight to your browser, which works out your pay from its events. We don't keep the calendar or its events; your browser keeps the shifts it found only while the page is open, to show them. The provider receives that request from our server, not from your device, so it doesn't get your IP address from it. Deleting a calendar on the Spreadsheets & Calendars page deletes everything we stored about it, except the paychecks already on days that passed, which stay part of your budget.
F) Budgets You Keep And Share
You can keep more than one budget, and share any budget you own with other Prismal Planning accounts. For each budget, we store its name, which account owns it, and when it was made, and we remember which budget you opened last. To share one, you type the other account's username or email address (its own, or another email it confirmed under Other Emails): we tell you whether an account has it, and we store that you invited that account, what you typed, and when it joined. Until it joins, the invitation shows in that account's budget list with the budget's name and your username, and nothing else of the budget. Once it joins, it can see and change everything in that budget, just as you can (including the links and settings of the spreadsheets and calendars connected to it, such as a calendar's pay and tax settings), and it sees your username and the usernames of everyone else who joined; you see its username. We don't show anyone your email address, your other budgets, or anything else of your account. Only a budget's owner can share it, rename it, or delete it. Change Logs in a shared budget record which username made each change.
What anyone adds to a shared budget becomes part of that budget, which belongs to its owner (including the Change Logs rows with their username): it stays there when they leave or the owner stops sharing it, and it's deleted when the owner deletes the budget or their account. Leaving a budget, or the owner stopping sharing it with you, ends your access to it and stops your Quick Entry icons for it. Only share a budget with people you trust with everything in it.
G) Sign-Ins & Security Records
Each time you sign in, we keep a record of that sign-in (when it started and when it ends) so that signing out ends it on our side too. Each one is deleted when you sign out, when it ends after 24 hours, or when you change your password or sign out everywhere. To protect accounts and the Site from abuse, such as password guessing and spam, we also briefly keep counts of certain actions, like failed sign-ins. When a count is for a network, we store a scrambled form of the IP address it came from, never the address itself, and each count is deleted within about an hour.
2) Cookies & Browser Storage
Cookies: The Site itself doesn't set cookies. When Google Analytics is on, it sets its own cookies for this Site (named _ga and _ga_ followed by an ID) to count visits and tell a new visit from a returning one; turning analytics off in Settings, or a Global Privacy Control or Do Not Track signal, keeps it from loading. Cloudflare may set a short-lived security cookie if it needs to check that a visit comes from a person, including the check on the Create Account form. We don't use advertising cookies. You can block or delete cookies in your browser's settings, and the Site works without them.
Storage in your browser: The Site keeps your sign-in (a signed token that stops working within 24 hours) and a few conveniences, like your Undo history and the budget you have open (only in the open tab) and, when a budget first opens, whether to show the Getting Started card, in your browser's storage on your device. Signing out removes them, except your device's own choices (whether analytics is off, the date format you picked, whether you turned the Site's music or sound effects off, the theme you picked (and a Custom theme's colors and choices), the Quick Entry icon you made (with a small copy of any image you uploaded for it, which stays on your device), your Reduced Motion switches, the kind of phone you picked for the help's steps, and the day you picked for Bob's Equity window), the ID of the passkey it last signed in with (see Section 1B), and a scrambled form of the Quick Entry icons it made or used (so their entries are added when you sign in there).
3) How We Use Information
We use the information we collect to:
• operate and improve the Prismal Planning platform
• securely sync and display your personal budget data
• sign you in with your password or a passkey
• send account emails (such as email verification links, password reset links, and security notices when your password or email changes or a passkey is added), notices when this Policy or the Terms of Use change, and the reminders you turn on
• troubleshoot issues, prevent fraud, and maintain security (like limiting password guesses)
We do not sell your personal financial data or budget information to anybody. Your data is strictly used to provide the budgeting service to you.
4) Sharing & Third Parties
We share information with service providers only as needed to operate the Site. This includes our website host (GitHub Pages), our server and database infrastructure provider (Cloudflare), our email delivery provider (Resend), which receives your email address and the contents of the emails we send you, your browser's push notification service (such as Apple, Google, or Mozilla) if you turn on push notifications, the services that keep any spreadsheets or calendars you connect (such as Google, Microsoft, Dropbox, Apple, or a work scheduling app), which receive our server's requests for them (see Section 1E), and our analytics provider (Google Analytics). These third parties process data according to their own terms and privacy policies.
If you share a budget with other accounts, the people using those accounts can see and change everything in it, and see your username (see Section 1F). That's the only way other users see anything of yours, and only when you choose to share.
When you pick a new password, our server checks it against Have I Been Pwned's list of passwords exposed in data breaches. It sends only a small, scrambled piece of information that hundreds of different passwords share, so the service never receives your password, your username, your email address, or your IP address.
5) Security & Data Retention
We have reasonable administrative, technical, and organizational security measures in place to protect your account and your information from unauthorized access, loss, misuse, and alteration, and we review them as the Site changes. Your financial data and account details are stored with our infrastructure provider (Cloudflare) and sent over encrypted connections. Your password is never stored in plain text, and we keep only the public part of a passkey, which can't be used to sign in. Account emails tell you when your password or email changes or a passkey is added, and in Settings you can sign out every device at once. Changing your password in Settings signs out your other devices and stops your Quick Entry icons; resetting it with an emailed link signs you out on every device, stops your Quick Entry icons, and turns passkey sign-in off until you turn it back on in Settings. To keep these protections effective, we don't publish the details of how they work. No method of transmission or storage is 100% secure, so we can't guarantee absolute security. We retain your data as long as your account is active or as needed for legitimate business purposes. When you delete your account, we delete it and all of its data from our database right away, including the budgets you own, for everyone you shared them with (what you added to budgets other accounts shared with you stays in those budgets, which are theirs), though copies may remain in our database provider's backups for up to 30 days.
6) Your Choices
• Account Data: You may update or delete your budget data on the Site. Your Change Logs keep what each of your recent changes did, including an entry or a note you deleted, so the change can be undone, until newer changes take its place. In Settings, you can change your email address (and verify it), add or remove other emails of yours, change your password, fix your birth date if you typed it wrong, or delete your account and all of its data at any time. Under Budgets, you can stop sharing a budget of yours with anyone, delete a budget of yours (other than your first), or leave a budget someone shared with you.
• Connected Spreadsheets & Calendars: On the Spreadsheets & Calendars page (in the menu), you can turn each connected spreadsheet or calendar off or delete it at any time. To stop us from reading a spreadsheet at all, turn off its link sharing, or remove [email protected], in the spreadsheet's Share settings; for a calendar, stop sharing it (or make a new link) in your calendar app.
• Download Your Data: In Settings, Download My Data gives you a copy of everything stored for your account (your budgets, who they're shared with, settings, and account details) as a JSON file, at any time. Budgets other accounts shared with you belong to them, so the file only names them. Passwords, keys, and private link codes are left out. Upload A Backup, next to it, brings a budget back from such a file into the budget you have open: the file is read on your device, and what it brings back is saved like any other change to your budget.
• Analytics: In Settings, you can turn Google Analytics off (or back on) for your device. Browsers that send a Global Privacy Control or Do Not Track signal never load it.
• Signed-In Devices: In Settings, you can sign out every device at once, turn off your Quick Entry icons, or keep them from showing any balances.
• Passkeys: In Settings, you can turn passkey sign-in on or off at any time, add passkeys, or remove them. Removing a passkey deletes it from our database (you can also delete it from your device or password manager), and deleting your account deletes all of its passkeys.
• Reminders: You can turn push notifications and the calendar link on or off in Settings.
• Cookies: You can block or delete cookies in your browser's settings (see Section 2).
• Quick Entry: A Quick Entry icon can only add entries to your budget, and change or delete the ones it added until they join your budget. It can't see your budget, only those entries, what's in your bank account today and the lowest it's expected to get (with that day), your Equity accounts with their balances and each one's Max (so you can pick one), whether your budget asks each entry's wavelength, and your wavelengths' names (not which titles are on which), and the prisms (saved entries you add often) you make on its page, which it can also change or delete. With Show balances on Quick Entry icons turned off in Settings, it gets no balances at all, just your Equity accounts' names. To stop all of your Quick Entry icons from working, turn them off in Settings or change your password.
7) Ages 18 And Older
Prismal Planning is intended for people 18 and older, and isn't for children. Creating an account asks for your birth date, and an account can't be made for anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has an account, contact us (see Section 9) and we'll delete it.
8) Changes To This Policy
When we change this Privacy Policy or the Terms of Use, we update the Effective Date at the top, and we email every account with a verified email address about it, with a short summary of what changed. Using the Site after the new Effective Date means you agree to the updated version.
9) Contact
Questions about this Privacy Policy can be sent to [email protected].
Terms of Use
These Terms of Use (“Terms”) govern your access to and use of Prismal Planning. By using the Site, you agree to these Terms. If you do not agree, do not use the Site.
1) Intellectual Property
Unless otherwise noted, all Site content, design, and graphics are owned by Sabian Colbert, or by third parties with permission and are protected by intellectual property laws. “Prismal Planning” is our trademark. Prismal Planning is not in any way affiliated with Prism Wallet, Prism Data, Prism Financial, Prism Money, Prism Bill Pay, or any other entity not named exactly “Prismal Planning”. Other companies' names on the Site, like Apple, Google, Microsoft, and Dropbox, are trademarks of their owners, who don't sponsor or endorse Prismal Planning.
2) Eligibility
Prismal Planning is intended for people 18 and older. You must be at least 18 years old to create an account or use the Site, and the birth date you give us must be your real one.
3) Permitted Use
You may access and use the Site for your personal, non-commercial financial tracking and budgeting purposes. You may connect only spreadsheets and calendars you have the right to share, and you're responsible for who can see a spreadsheet or calendar you share by its link. You're responsible for what you put in your budget, such as your entries' titles and notes, and for any file you bring in with Upload A Backup. You're responsible for who you share a budget with: everyone you share it with can see and change everything in it.
4) Prohibited Use
You agree not to:
• attempt unauthorized access to our databases (including Cloudflare SQL), servers, or networks
• scrape, harvest, or collect data from the Site by automated means
• interfere with the Site’s operation, security, or performance
• use the Site for any illegal financial activity or fraud
• keep anything unlawful in your budget (such as in a note), or anyone else's personal information you don't have the right to keep
• use budget sharing to send unwanted invitations, or to harass anyone
5) Not Financial Advice
Prismal Planning is a tool to help you organize your finances. We are not financial advisors, planners, or brokers. The information provided through the Site is for informational purposes only and does not constitute professional financial, tax, or legal advice. Paychecks worked out by the Paycheck Calculator or from a connected calendar, including their taxes and withholding, are estimates: your employer's payroll decides your actual pay. Interest, balances, payoff dates, and anything shown for a day still to come (on the Equity page, in the Debt Calculator, and in Bob's graphs) are estimates too, worked out from what you enter: your bank's or lender's own statements decide the real amounts.
6) Third-Party Services
Our Site relies on third-party integrations (such as Cloudflare for our servers, Resend for account emails, Google, Microsoft, or Dropbox for spreadsheets you connect, and the providers of calendars you connect). We do not control and are not responsible for the uptime, accuracy, or practices of these third-party services, or for what a connected spreadsheet or calendar contains.
7) Disclaimers & Limitation of Liability
The Site is provided “as is” and “as available” without warranties of any kind, express or implied. To the fullest extent permitted by law, Sabian Colbert will not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of data, profits, or goodwill, arising from or related to your use of (or inability to use) the Site.
8) Governing Law
These Terms are governed by the laws of the State of Oklahoma, without regard to conflict of laws principles.