How your vote stays yours
Two promises have to hold at the same time: one person gets one vote, and nobody can ever see how you voted — not a hacker, not a court order, not even us. Most systems pick one. Here's how we get both, told with an envelope.
1 — You prove you're a real person. You give an email address; we send a code; you type it in. At this moment we know "this address wants to vote on this file" — and nothing else. We mark the address as served, so it can never get a second ballot for this file.
2 — Your browser makes a blank ballot token and seals it inside a special envelope. The sealing happens on your device. We never see what's inside.
3 — We stamp the envelope without opening it. Our server signs the sealed envelope — the mathematical equivalent of a stamp that presses through the paper onto the token inside (the technique is called a blind signature, an internet standard: RFC 9474). We've now certified "one real, verified person" without ever seeing the token we certified.
4 — Your browser opens the envelope. Out comes your token carrying a valid stamp — and here's the trick: the stamp on the token cannot be matched back to the envelope we stamped. The connection between "you, verifying" and "this token, voting" is mathematically severed on your device.
5 — The token casts your ballot. Your choices arrive with the stamped token. We check the stamp is real and the token unused, count your vote, and burn the token. What our database holds: the running totals, and a fingerprint of the used token. What it doesn't hold: any thread, anywhere, from your ballot back to you.
This is why the promise on every voting panel isn't marketing. If someone demanded we reveal your vote, we would have nothing to give them. The link doesn't exist to disclose.
Full disclosure — the one thing you still trust us on: timing. If we secretly logged the exact instant you verified and the exact instant each token was spent, we could attempt to correlate them. We defeat this by letting you vote any time after verifying, and by not keeping correlatable timing logs. The cryptography removes the link; this operational discipline is the remaining promise — and we state it plainly rather than pretend it away.
← Back to the feed · Privacy & legal