Your OFW password, and what we do with it.

OurFamilyWizard doesn't let you give another app read-only access. There's no "Sign in with OurFamilyWizard" button and no access key you can hand out. The only way to read your calendar is to sign in as you, the same way OFW's own website does.

So we ask for your OFW email and password once, check them with OFW straight away, and use them to keep your calendar in sync.

Your OFW email and password are encrypted with AES-256 before they're saved, and so is the temporary access token OFW gives us when we sign in. The encryption key is kept apart from the database, so a copy of the database alone doesn't reveal them.

Your password is never shown back to you or to us in the app, never sent in an email, and never written to our logs.

Your OFWSync password is separate. It's handled by WorkOS, our sign-in provider, and we never store it.

We sign in to OFW and read three things: your calendar, the details of each event (such as its location, notes and reminders), and the names of the parents on your account, so we can label parenting time.

OFW's access tokens last about two hours, so we reuse one rather than signing in on every check. On Plus we check your calendar every hour; on Lite, once a day.

We never open your messages, so we can't mark one as read. We never look at expenses, journal entries, the info bank or files.

We never post, reply, approve a trade or change anything in OFW. Apart from signing in, every request we make to OFW only reads.

We never sell or share your OFW sign-in or calendar. It's sent only to OurFamilyWizard, when we sign in.

OFW counts failed sign-ins against your account. If it ever refuses your saved password, we stop signing in straight away instead of retrying, and email you. Your feed keeps showing the last schedule we synced until you enter the new password.

Connect attempts are rate limited too, so a mistyped password can't lock you out of OFW.

Disconnect OurFamilyWizard from OFWSync at any time. We delete your saved OFW sign-in, access token and synced events straight away.

Or change your OFW password. Our saved copy stops working, so once the access token we already hold runs out, within about two hours, we can't sign in again. Nothing syncs until you give us the new password.

Deleting your OFWSync account removes everything: your OFW sign-in, events, feed and account.

Your feed link is long and random, served only over HTTPS, and asks search engines not to index it. Anyone with the link can see your schedule, so treat it like a password. Reset it from Feed settings and the old link stops working right away.