Security

Family Data Isolation

Farmark stores account and household data with family-level tenant boundaries. App routes and database rules prevent one family from reading, updating, connecting, syncing, or deleting another family's data.

Encryption

Farmark uses HTTPS in transit and AES-256-GCM encryption for sensitive stored data, including connected calendar tokens and private calendar content.

Family-scoped data is protected with separate 256-bit data keys. Searchable private fields use keyed blind indexes where practical, and authentication secrets are stored as one-way hashes rather than plaintext.

Calendar Connections

Calendar imports are read-only. Farmark does not write back to iCal, ICS, or Google Calendar sources without separate permission for a feature that clearly requires it.

OAuth callback state is tied to the initiating user/session so calendar connections cannot be silently attached to the wrong family account.

Support Access

Farmark's support and admin tooling is metadata-first. Routine support uses account status, subscription state, sync status, audit history, and connection metadata rather than decrypted family calendar details.

Farmark accesses family content only with customer authorization, for security investigation, or when legally required.

Private Events

Farmark includes privacy controls for family displays. Private event details are limited or shown as busy on shared views when those settings are enabled.

Responsible Disclosure

If you believe you found a security issue, email [email protected]. Include a clear description, affected URL or feature, and steps to reproduce.

Please do not access, alter, disclose, or download another family's data. We do not authorize testing that harms users, degrades service, bypasses rate limits, or targets third-party providers.

Important Limits

No online service can guarantee perfect security. Farmark is also not an emergency alert system, home security system, child safety monitor, or backup calendar of record. Always independently confirm safety-critical events and deadlines.