Privacy

Privacy and your data

आपका डेटा कितनी देर रहता है

Last reviewed: 11 November 2026

The 6 August 2026 Lok Sabha reply is the wording this page quotes. Read it beside the Foundation privacy policy.

What Parliament was told

• The Digi Yatra Central Ecosystem is built on privacy.
• The app is built on privacy by design, and there is no central storage of a passenger’s personally identifiable information.
• Passenger data is encrypted and stored in the smartphone wallet.
• It is shared only for a limited time with the origin airport, where the ID has to be validated.
• It is purged within 24 hours of the scheduled departure.
• DigiYatra complies with the Digital Personal Data Protection Act, 2023 and the rules under it. Regular security assessments, vulnerability assessments and audits are undertaken.

The Foundation policy describes the Foundation, the central ecosystem, verifiable credentials and self-sovereign identity. It says personal data is processed to establish identity and validate travel documents, kept only as needed or as the Digi Yatra Policy prescribes, and not used beyond closely related purposes. Use the live policy page for the full text.

An older ministry policy PDF is linked from official pages. It was not successfully opened for this write-up, so it is not quoted here. The guidelines landing page is on the ministry site.

Deletion and lookalike apps

This website cannot delete a DigiYatra credential, because it never receives one. The 24-hour purge above is what the Lok Sabha reply says happens to data shared with the airport system. Account controls, if any, are inside the official app.

Enrol only through digiyatrafoundation.com. A page or a caller that asks for Aadhaar, a face photo, a PNR, or a one-time password is not this site and is not a step described in the sources above.