Last updated: November 4, 2026

Cookie Policy

Prism is operated by Prism Learning LC (“Prism,” “we”). Short version: we set the cookies that keep you signed in and nothing else, and our web analytics sets no cookie at all. There are no advertising or tracking cookies on Prism. This page lists every cookie by name, what it does, how long it lasts, and what the cookie notice asks.

1. What a cookie is

A cookie is a small text file your browser stores for a site and sends back on later visits. Sites use them to remember things between pages, most often that you are signed in. Your browser also offers “local storage,” a place a site can keep settings on your device that is never sent to the site's servers. We use both, and we list both below.

2. The cookies we set

Cookie	What it does	How long
`sb-…-auth-token` Session cookie, sometimes split into numbered parts	Keeps you signed in. It is set when you sign in and holds the token our authentication provider uses to recognize you on each request. Without it, every page would ask you to sign in again.	Until you sign out, or until the session expires and is not renewed.
`lti_session` Only on launches from a learning platform	When your school opens Prism from Canvas, Moodle, Blackboard or D2L, the launch arrives from the platform's site. This cookie carries a one-time code that turns that launch into a signed-in Prism session. Because the launch crosses sites it is marked SameSite=None and Secure; it is HttpOnly, so scripts cannot read it.	Two minutes, then cleared. It is also cleared as soon as the code is used.

Both are first-party cookies, set by Prism for Prism. Both are strictly necessary: the site cannot keep you signed in without them.

3. Browser storage that is not a cookie

A few settings live in your browser's local storage so the page can remember them between visits. They stay on your device and are never sent to us:

prism-theme: whether you chose light, dark or “follow my system.”
prism:lessonDock…: whether the lesson side dock is open, how wide it is, and which widget it shows.

Clearing your browser's site data removes them; Prism falls back to its defaults.

4. Web analytics

We use Vercel Web Analytics to count page views and see which pages help. It records the page, the referrer, the country, and the browser and device type. It sets no cookie and stores no identifier tied to a person, so it cannot follow you between visits or to other sites. On our public pages it runs only after you choose “Accept all” on the cookie notice; “Only necessary” keeps it off in that browser. Inside the signed-in product it runs under the school's agreement, and it never sees a student's name.

5. What we do not use

No advertising cookies, no pixels, no session recording, no fingerprinting, and no social-media widgets. We do not sell or share personal data for advertising, so there is nothing to opt out of, and Global Privacy Control signals change nothing because there is no tracking to stop.

One exception to note: when a lesson embeds a video, the player comes from YouTube or Vimeo. We load YouTube through its no-cookie domain (youtube-nocookie.com), which does not set tracking cookies until you press play. Once a video plays, those services may set their own cookies under their own policies. Lessons without video never contact them.

Cookie laws (the EU ePrivacy rules and the U.S. state privacy laws that reach cookies) require consent for anything beyond what is strictly necessary. Our cookies are all strictly necessary and our analytics sets none, so the notice on our public pages asks one question only: whether analytics may run. Your answer is kept in your browser, and clearing site data asks again. Students never see the notice: inside the product there is nothing to ask them, and the school's agreement covers what runs. If we ever add a cookie that needs consent, we will update this page first and ask before it is set, as our Privacy Policy promises.

7. Your choices

You can block or delete cookies in your browser's settings at any time. If you block the session cookie, Prism will still load, but you will be signed out on every page. If your school launches Prism inside a learning platform and your browser blocks third-party cookies, the launch may fail inside the frame; opening Prism in its own tab from the launch page fixes that without changing any settings.

8. Changes to this policy

We will update the “Last updated” date whenever a cookie is added, removed or renamed, and for anything that needs consent we will ask before it ships.

9. Contact

Questions about cookies or storage: art@onprism.org. For everything else about your data, see the Privacy Policy and the Student Privacy page.