Built like it's carrying your
family's IDs. Because it is.

Government IDs

Indian hotels, airlines, and visa processes routinely require guest IDs, so Baraati has a dedicated pipeline for them, kept separate from photos and everything else.

Each document is encrypted with AES-256-GCM envelope encryption the moment it is uploaded: every document gets its own key, and those keys are themselves encrypted by a master key that never leaves the server. Documents live in a private storage bucket that has no public access.

• ✦Viewing an ID is a streamed decrypt for that single request. There is never a shareable link to the file.
• ✦Only the hosts of that specific wedding (and the guest who uploaded it) can access a document.
• ✦Every access is audit-logged: who, when, from which IP and device.
• ✦Hosts export one encrypted master PDF for hotel check-in instead of forwarding individual photos.
• ✦ID features are disabled on rooted or jailbroken devices, and require recent re-authentication.
• ✦Documents are automatically and permanently deleted 3 days after the wedding's last day, or sooner if the guest chooses.

Your account

There are no passwords on Baraati, which means there are no passwords to reuse, guess, or leak. Sign-in uses one-time codes delivered to your email or phone, and sessions are stored in your device's encrypted secure storage.

• ✦OTP-only sign-in: a new code for each sign-in, verified server-side.
• ✦No social logins, no third-party identity providers.
• ✦Full account deletion available in-app and at baraati.co.in/delete-account.

Wedding isolation

Every wedding on Baraati is a sealed space. Access rules are enforced in the database itself with row-level security, as well as in the app, so a member of one wedding cannot read another wedding's data. Joining requires an invite code from the hosts.

• ✦Row-level security on every table.
• ✦Invite-only joining, controlled by the hosts.
• ✦Hosts and guests see different data, enforced server-side.

In transit and at rest

All traffic uses HTTPS/TLS, and the app pins our certificates so it refuses to talk to an impostor server even on a hostile network. Sensitive operations are rate-limited, and error messages never leak internal details.

• ✦TLS everywhere, with certificate pinning in the app.
• ✦Encrypted secure storage for sessions on the device.
• ✦Rate limiting on sensitive operations.

What we don't do

No advertising, no behavioural tracking, no selling of data, no GPS location collection, and no advertising identifiers. Baraati's business is wedding plans, not your data. The full detail lives in our privacy policy.