Built like it's carrying your
family's IDs. Because it is.

Government IDs

Indian hotels, airlines, and visa processes routinely require guest IDs, so Baraati includes a dedicated pipeline for them — separate from photos and everything else.

Each document is encrypted with AES-256-GCM envelope encryption the moment it is uploaded: every document gets its own key, and those keys are themselves encrypted by a master key that never leaves the server. Documents live in a private storage bucket that has no public access.

• ✦Viewing an ID is a streamed decrypt for that single request — there is never a shareable link to the file.
• ✦Only the hosts of that specific wedding (and the guest who uploaded it) can access a document.
• ✦Every access is audit-logged: who, when, from which IP and device.
• ✦Hosts export one encrypted master PDF for hotel check-in instead of forwarding individual photos.
• ✦ID features are disabled on rooted or jailbroken devices, and require recent re-authentication.
• ✦Documents are automatically and permanently deleted 3 days after the wedding's last day — or sooner, whenever the guest chooses.

Your account

There are no passwords on Baraati, which means there are no passwords to reuse, guess, or leak. Sign-in uses one-time codes delivered to your email or phone, and sessions are stored in your device's encrypted secure storage.

• ✦OTP-only sign-in — a code per sign-in, verified server-side.
• ✦No social logins, no third-party identity providers.
• ✦Full account deletion available in-app and at baraati.co.in/delete-account.

Wedding isolation

Every wedding on Baraati is a sealed space. Access rules are enforced at the database layer with row-level security — not just in the app — so a member of one wedding cannot read another wedding's data, even in principle. Joining requires an invite code from the hosts.

• ✦Row-level security on every table.
• ✦Invite-only joining, controlled by the hosts.
• ✦Hosts and guests see different data, enforced server-side.

In transit and at rest

All traffic uses HTTPS/TLS, and the app pins our certificates so it refuses to talk to an impostor server even on a hostile network. Sensitive operations are rate-limited, and error messages never leak internal details.

• ✦TLS everywhere, with certificate pinning in the app.
• ✦Encrypted secure storage for sessions on the device.
• ✦Rate limiting on sensitive operations.

What we don't do

No advertising, no behavioural tracking, no selling of data, no GPS location collection, and no advertising identifiers. Baraati's business is wedding plans, not your data. The full detail lives in our privacy policy.