Privacy policy

Prism is a personal finance app made by Bespoke Intelligence Solutions (BIS), called “we” and “us” here. This policy covers the Prism website and app. Questions or requests: email privacy@bis-rgv.com.

Your account

• Your email address, to sign you in with a one-time code. There is no password.
• Your first name, if you give it, so Prism can greet you.
• Your time zone, so “today” and “this month” match yours.
• The language you last used Prism in (English or Spanish), so its emails and phone alerts come in it too.
• If you turn on two-step sign-in, the secret your authenticator app shares with us. Our sign-in provider keeps it, to check your codes.

Money you choose to connect

• Banks, cards, loans and investments, through Plaid: account names, the last four digits of account numbers, balances, transactions (merchant, amount, date and category) and investment holdings. You sign in to your bank through Plaid; Prism never sees your bank username or password. With your permission, which Plaid asks for when you connect, Prism also reads loan details: each card's or loan's due date, minimum payment, statement balance and interest rate, at most once a day. It uses them to show when each payment is due, on Future, on Net worth, in your calendar reminders and to AI apps you connect, and keeps them encrypted with the rest of that bank's copy. They aren't shown to your household.
• Coinbase, if you connect it: your crypto balances, read-only.
• Connecting either needs a Prism account. The connection is kept in your account, where your sign-in (and two-step sign-in, if you turn it on) protects it, and deleting your account removes it.

What you set up

• Your budgets and goals.
• Your household, if you join one: who is in it, which of your accounts you share with them, and the budgets and goals you keep together, with who changed them last.
• Things you add yourself, such as your home, a car or a loan, and what you say they're worth, stored encrypted.
• If you ask Prism to keep a home's value up to date, its address, stored encrypted and never shared with your household, and RentCast's monthly estimates of its value.
• History you import from a file, such as a Mint or Monarch export: the transactions you choose to import (each one's date, description, amount and category), stored encrypted in your account. The file itself is read on your device and never sent to Prism.
• If you add a Venmo, PayPal or Cash App activity file: for each payment that matches a line from your bank, who it was to or from (another person's name, as that app shows it) and the note on it, stored encrypted in your account and never shown to your household. The file itself is read on your device and never sent to Prism, and payments that don't match a line from your bank aren't kept.
• If you add your Amazon order history: for each Amazon charge that matches a line from your bank, the order number, the day you placed it, and each item's name, quantity and cost, stored encrypted in your account and never shown to your household. The file itself is read on your device and never sent to Prism; the addresses in it are never read, and orders that don't match a line from your bank aren't kept.
• The public address of each crypto wallet you add, or for a whole Bitcoin wallet its extended public key, and what it last held, stored encrypted and never shared with your household. A public address is the one you'd give someone to pay you, and an extended public key shows every address in a wallet:Prism can see what they hold and can never move it, and never asks for a recovery phrase or private key.
• Categories you fix, such as “everything at this shop is groceries”, so Prism files your purchases where you put them. They name the shops, so they're stored encrypted, like your transactions.
• What you add to a transaction yourself: how you split it across categories (or every purchase at a shop, which names the shop), your tags, who owes you for it (the name you type and the amount), and which transactions and accounts you leave out of your totals, stored encrypted in your account and never shown to your household. A reminder about what someone owes is written on your device and goes wherever you send it; Prism never sends it.
• Your upcoming bills and paydays, if you turn on the calendar feed.
• If you turn on alert emails: what you chose them to cover; what your last visit found worth one, such as a bill that may not be covered, and the figures for your summaries (last week's and last month's), stored encrypted; and a fingerprint of each alert sent, so none is sent twice. A fingerprint is a scrambled code that names no bank, shop or amount.
• If you turn on alerts on a phone or other device: what its browser gives Prism to reach it (an address at its notification service, and the keys to encrypt messages for it), stored encrypted, and which kind of device it is, such as “iPhone”, so you can tell your devices apart.
• If you also leave “Check my banks each morning” on, Prism reads your banks' balances and new transactions once each morning, even when you haven't opened it, so an alert email speaks for that day. It keeps them encrypted like the rest, and never does this with Coinbase connected. Turn it off on the Account page and only your own visits read your banks again.
• Which AI apps you've allowed to read your money, if any.

Technical details

Like any website, our hosting and sign-in providers keep short-lived technical logs (IP address, browser type and the time of each request) to keep Prism secure and working. We don't use advertising or analytics trackers.

• To show you your money: balances, spending, budgets, goals, bills and insights.
• To keep your connections up to date, and to tell you when one needs attention.
• To sign you in and send your sign-in codes.
• To email you alerts and summaries, and send the same alerts to your devices, if you turn them on.
• To answer questions from AI apps you've approved, read-only.
• To keep Prism secure, prevent abuse, and fix problems.

We don't sell your data, use it for advertising, or use your financial data to train AI models.

Only the companies that run Prism for us, and only what each one needs:

• PlaidConnects your bank, card, loan and investment accounts. You sign in to your bank through Plaid, and Prism never sees your bank username or password. Their privacy policy
• CoinbaseShares your crypto balances, read-only, if you connect Coinbase. Their privacy policy
• SupabaseRuns Prism's database and sign-in, in the United States. Their privacy policy
• VercelHosts the Prism website and servers, in the United States. Their privacy policy
• ResendSends your sign-in codes by email, and your alert emails if you turn them on. For an alert it receives your email address and the email itself, which can name a bank or a shop and, if you allow it, amounts. Their privacy policy
• mempool.spaceReads the balance of a Bitcoin wallet you add. It receives the wallet's public address, and nothing else about you, about every 15 minutes while you use Prism. For a whole wallet it receives each of the wallet's addresses, which Prism works out itself, never the extended public key, about every 30 minutes. Their privacy policy
• AlchemyReads the balance of an Ethereum or Solana wallet you add. It receives the wallet's public address, and nothing else about you, about every 15 minutes while you use Prism. Their privacy policy
• RentCastEstimates the value of a home you ask Prism to keep up to date. It receives the home's address, and nothing else about you, about once a month, and is asked not to keep it in its logs. Their privacy policy

And, only when you choose:

• AI apps you connect, such as Claude or ChatGPT. They read your accounts, transactions, budgets and goals only when answering your questions, can never change anything, and that company's own privacy policy covers what they receive. Disconnect them any time on the Account page.
• People in your household, if you join one. They see the balances and transactions of the accounts you choose to share, and nothing else: not your other accounts, not your bank sign-in, and never a way into your bank. You can stop sharing an account, or leave the household, at any time, and it takes effect at once. If you share Coinbase, they see only its total value as of your last visit, and Prism keeps that one number, sealed, only while you share it. The household's budgets and goals belong to the household: everyone in it sees them and can change them, and they stay with the household if you leave. History you import is never shared with them, even for an account you share.
• Your calendar app, if you subscribe to the bills feed. It reads your upcoming bills and paydays, and amounts only if you choose to include them.
• Your browser's notification service, if you turn on alerts on a device. It carries each alert to that device, and it's run by the company that makes your browser: Apple for Safari, on an iPhone, iPad or Mac; Google for Chrome, and Android; Mozilla for Firefox; Microsoft for Edge on Windows. Each alert is encrypted for your device before it leaves Prism, so the service can't read it: it sees only that a message went to your device, how big it was, and when.

We may also share information when the law requires it, to protect someone's safety, or if BIS is ever merged or sold. In that case we'd tell you, and this policy would keep protecting your data. We never sell or rent your personal information.

• Everything travels over encrypted connections (HTTPS).
• The keys that let Prism read your banks and Coinbase, your synced transactions, and your calendar feed of bills are encrypted (AES-256) before they're stored.
• Our database is encrypted at rest, and every account can reach only its own data.
• AI apps you connect are read-only. The database itself refuses any change they try to make.
• Sign-in uses a one-time code sent to your email, so there's no password to steal.
• You can add two-step sign-in with an authenticator app. Then your email alone can't open your account: until the second code is entered, the database refuses to show or change any of your data.

No system is perfectly secure. If a breach ever affects your information, we'll tell you as the law requires.

• While you have an account, we keep your data so Prism can show it to you.
• Transactions from your bank older than about two years drop out of Prism's copy of them.
• History you import stays until you remove it on Connections, or delete your account.
• A home's address stays until you turn off its estimates, remove the home, or delete your account.
• A wallet's address or extended public key stays until you remove the wallet on Connections, or delete your account.
• What's kept for your alert emails, and every device you get alerts on, is deleted the moment you turn them off. A device is also deleted when you stop alerts on it, or when its notification service says it no longer exists. The fingerprints of alerts already sent are deleted after 120 days.
• When you delete your account, we disconnect every bank and Coinbase link first, then erase your account and everything in it. Encrypted database backups roll off shortly after.
• Using Prism without an account keeps your budgets and goals on your device, in the cookies listed below. Clearing this site's data removes them. A bank or Coinbase connected on a device before connecting needed an account stays there, encrypted, until you sign in, which moves it into your account, or until it expires.

• Disconnect any bank, Coinbase or AI app at any time from Connections or Account.
• Change your name, and turn the calendar feed off, whenever you like.
• Turn alert emails on or off, and choose what they cover, on the Account page, or stop them with the link in any of them. Turn alerts on or off for each of your devices there too.
• Delete your account for good on the Account page.
• Download a copy of everything Prism shows you, whenever you like, from the Account page: spreadsheets of your transactions, accounts and balances, budgets and goals, and one file with all of it. It's made from your own accounts only, never anyone else's in your household.
• Ask us for a copy of anything else we hold about you, or to correct it, at privacy@bis-rgv.com.

Depending on where you live, such as California, you may have more rights over your information. We honour these requests wherever you live, and we never treat you differently for making one.

Prism stores only what it needs to work. There are no advertising or tracking cookies. Here is everything, and what each one does:

• prism-authCookie · kept until you sign out, or 400 days

  Keeps you signed in to your Prism account.

• prism-auth-code-verifierCookie · kept until you finish signing in

  Makes the link in your sign-in email work only in the browser that asked for it.

• prism-nextCookie · kept 15 minutes

  Remembers what you were doing when sign-in interrupted it, such as approving an AI app.

• prism-vaultCookie · kept 30 days

  A bank connected on this device before connecting one needed an account, encrypted so only Prism's server can read it. Signing in moves it into your account.

• __Host-prism-bank-returnCookie · kept up to 1 hour

  Holds your connection in place while your bank signs you in on its own website.

• prism-coinbaseCookie · kept 400 days

  A Coinbase connection made on this device before connecting one needed an account, encrypted. Signing in moves it into your account.

• prism-coinbase-oauthCookie · kept 10 minutes

  Keeps a Coinbase sign-in secure while it's in progress.

• prism-langCookie · kept 1 year

  Remembers the language you chose for Prism, English or Spanish.

• prism-budgetsCookie · kept 400 days

  Budgets you set on this device without an account.

• prism-goalsCookie · kept 400 days

  Goals you set on this device without an account.

• prism-carryoverCookie · kept 30 days

  Remembers that you chose to decide later about moving this device's budgets and goals into your account.

• prism-viewCookie · kept 1 year

  Whether you're looking at your own money or your household's.

• prism-household-inviteBrowser storage · kept until you accept it or close the tab

  Holds a household invitation you opened while you sign in to accept it, in that tab only.

• prism-tzCookie · kept 1 year

  Your time zone, so days and months line up with yours.

• prism-themeBrowser storage · kept until you clear it

  Whether you picked light or dark.

Prism is for adults 18 and over. It isn't meant for children, and if we learn we've collected information from a child under 13, we'll delete it.

When this policy changes, the date at the top changes too. If a change matters, such as a new kind of data or a new company that sees it, we'll tell you in the app or by email before it takes effect.

Questions, requests or concerns: email privacy@bis-rgv.com. Bespoke Intelligence Solutions.