Privacy Policy
Effective Date: October 6, 2026
This Privacy Policy explains how Sabian Colbert (“we”, “us”, “our”) collects, uses, and protects your information when you use the Prismal Budget website and services (the “Site”). If you do not agree with this Policy, please do not use the Site.
1) What We Collect
A) Information You Provide directly
When you create an account, we collect the username, password, and email address you provide, and we record when you agreed to this Privacy Policy and the Terms of Use. We store your account details and your budget and finance data (such as your entries, recurring payments, history, and change logs) in our Cloudflare SQL database. We never store your password itself, only a protected one-way form of it (see Section 5). You can sign in with your username or your email address. We use your email address to send you account emails, such as password reset links and security notices.
B) Passkeys (Face ID, Touch ID, Windows Hello)
Passkey sign-in is optional. If you turn it on, your device (or the password manager it uses, such as iCloud Keychain, Google Password Manager, or Windows Hello) makes a passkey for the Site, and we store the passkey's public key and ID, the name you give it, the site address it was made on, when it was added and last used, whether your device reports it as synced, and a sign-in counter. We also store a random ID for your account that your devices keep with its passkeys, and whether you chose to turn passkey sign-in on or off (so we only ask you once). The private part of a passkey never leaves your device or password manager. Your face, fingerprint, or device PIN is checked only by your device: we never receive, see, or store any biometric data, only a yes from your device that the check passed. Your device or password manager keeps the passkey along with your username (so it can show which account it's for), and those companies handle it under their own privacy policies.
C) Reminders, Notifications & Quick Entry
If you turn on daily reminders, we store your reminder time, your time zone, and which days your budget needs a reminder. If you turn on push notifications, we store the push address your browser gives us for that device (provided by your browser's push service, such as Apple, Google, or Mozilla). If you turn on a calendar link, we store the private code in that link. If you set up a Quick Entry home screen icon, we store a scrambled (hashed) copy of its key, along with the entries you make with it until they're added to your budget.
D) Analytics & Advertising Data
We use Google Analytics to understand how the Site is used, and third-party services, including Google AdSense, to monetize the Site. These services may collect general device and browser information, approximate location (derived from IP address), and site usage events. Google Analytics never sees your budget, and the page addresses we send it leave out everything after the page's name, such as the private code in a password reset link. It doesn't load at all if your browser sends a Global Privacy Control or Do Not Track signal, or if you turn analytics off for your device in Settings.
E) Sign-Ins & Security Records
Each time you sign in, we keep a record of that sign-in (a random ID, and when it started and when it ends) so that signing out ends it on our side too. Each one is deleted when you sign out, when it ends after 24 hours, or when you change your password or sign out everywhere. To protect accounts from password guessing and the Site from spam, we also briefly count failed sign-ins, wrong passwords entered in Settings, new accounts, sign-ups and email changes with a username or email that's already taken, password reset requests, Quick Entry and password reset links that don't work, and test notifications. When a count is for a network, we store a scrambled (hashed) form of the IP address it came from, never the address itself. Each of these counts is deleted within about an hour.
2) Cookies & Google AdSense Advertising
To keep this Site free/accessible, we use Google AdSense to serve ads. Google requires us to disclose the following regarding your privacy:
• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this Site or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our Site and/or other sites on the Internet.
• You may opt out of personalized advertising by visiting Google Ads Settings. Alternatively, you can opt out of a third-party vendor's use of cookies for personalized advertising by visiting www.aboutads.info.
Storage in your browser: The Site itself doesn't set cookies. It keeps your sign-in (a signed token that stops working within 24 hours) and a few conveniences, like your Undo history (only in the open tab) and whether you've hidden the Getting Started card, in your browser's storage on your device. Signing out removes them, except your device's own choices (whether analytics is off, and which version of the Site it has).
3) How We Use Information
We use the information we collect to:
• operate and improve the Prismal Budget platform
• securely sync and display your personal budget data
• sign you in with your password or a passkey
• send account emails (such as password reset links, and security notices when your password or email changes or a passkey is added) and the reminders you turn on
• troubleshoot issues, prevent fraud, and maintain security (like limiting password guesses)
• serve relevant advertisements to support the Site
We do not sell your personal financial data or budget information to anybody. Your data is strictly used to provide the budgeting service to you.
4) Sharing & Third Parties
We share information with service providers only as needed to operate the Site. This includes our website host (GitHub Pages), our server and database infrastructure provider (Cloudflare), our email delivery provider (Resend), which receives your email address and the contents of the emails we send you, your browser's push notification service (such as Apple, Google, or Mozilla) if you turn on push notifications, our analytics provider (Google Analytics), and our advertising partner (Google AdSense). These third parties process data according to their own terms and privacy policies.
When you pick a new password, our server checks it against Have I Been Pwned's list of passwords exposed in data breaches. It sends only the first 5 characters of a scrambled (SHA-1 hashed) form of the password, which hundreds of different passwords share, so the service never receives your password, your username, your email address, or your IP address.
5) Security & Data Retention
Your financial data and account credentials are saved using modern cloud infrastructure (Cloudflare). Passwords are never stored in plain text: we keep only a one-way hash made with PBKDF2-SHA256 (100,000 rounds), a random salt for each password, and a secret key kept apart from the database, so a copy of the database alone can't be used to work out anyone's password. New passwords that have shown up in data breaches are refused. Each sign-in lasts at most 24 hours, and signing out ends it on our server too. Password reset links work only once and expire after one hour. Like Quick Entry keys, they're stored only in hashed form. Passkeys are checked with public-key cryptography: we store only their public keys, which can't be used to sign in, and a passkey only works on this Site. Adding a passkey requires your password and sends a security notice to your email. Repeated wrong passwords are blocked for a while. Changing your password in Settings signs out your other devices and stops your Quick Entry icons; resetting it with an emailed link signs you out on every device, stops your Quick Entry icons, and turns passkey sign-in off until you turn it back on in Settings. Sign Out Everywhere, in Settings, signs out every device at once. While we use reasonable administrative and technical safeguards to protect your information, no method of transmission or storage is 100% secure. We retain your data as long as your account is active or as needed for legitimate business purposes. When you delete your account, we delete it and all of its data from our database right away, though copies may remain in our database provider's backups for up to 30 days.
6) Your Choices
• Account Data: You may update or delete your budget data on the Site. In Settings, you can change your email address or password, or delete your account and all of its data at any time.
• Download Your Data: In Settings, Download My Data gives you a copy of everything stored for your account (your budget, settings, and account details) as a JSON file, at any time. Passwords, keys, and private link codes are left out.
• Analytics: In Settings, you can turn Google Analytics off (or back on) for your device. Browsers that send a Global Privacy Control or Do Not Track signal never load it.
• Signed-In Devices: In Settings, you can sign out every device at once, or turn off your Quick Entry icons.
• Passkeys: In Settings, you can turn passkey sign-in on or off at any time, add passkeys, or remove them. Removing a passkey deletes it from our database (you can also delete it from your device or password manager), and deleting your account deletes all of its passkeys.
• Reminders: You can turn push notifications and the calendar link on or off in Settings.
• Quick Entry: A Quick Entry icon can only add entries to your budget. It can't see your budget, only your Other Accounts and their balances (so you can pick one). To stop all of your Quick Entry icons from working, turn them off in Settings or change your password.
• Advertising: You can block or delete cookies through your browser settings, or use the opt-out links provided in Section 2.
7) Children's Privacy
This Site is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.
8) Contact
Questions about this Privacy Policy can be sent to [email protected].
Terms of Use
These Terms of Use (“Terms”) govern your access to and use of Prismal Budget. By using the Site, you agree to these Terms. If you do not agree, do not use the Site.
1) Intellectual Property
Unless otherwise noted, all Site content, design, and graphics are owned by Sabian Colbert, or by third parties with permission and are protected by intellectual property laws. “Prismal Budget” is our trademark.
2) Permitted Use
You may access and use the Site for your personal, non-commercial financial tracking and budgeting purposes.
3) Prohibited Use
You agree not to:
• attempt unauthorized access to our databases (including Cloudflare SQL), servers, or networks
• scrape, harvest, or collect data from the Site by automated means
• interfere with the Site’s operation, security, or performance
• use the Site for any illegal financial activity or fraud
4) Not Financial Advice
Prismal Budget is a tool to help you organize your finances. We are not financial advisors, planners, or brokers. The information provided through the Site is for informational purposes only and does not constitute professional financial, tax, or legal advice.
5) Third-Party Services
Our Site relies on third-party integrations (such as Cloudflare for our servers and Resend for account emails). We do not control and are not responsible for the uptime, accuracy, or practices of these third-party services.
6) Disclaimers & Limitation of Liability
The Site is provided “as is” and “as available” without warranties of any kind, express or implied. To the fullest extent permitted by law, Sabian Colbert will not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of data, profits, or goodwill, arising from or related to your use of (or inability to use) the Site.
7) Governing Law
These Terms are governed by the laws of the State of Oklahoma, without regard to conflict of laws principles.