Skip to content
Condorcet.vote Alpha
← Advanced options

Anonymity & transparency

By default, your online vote is anonymous: the public register lets nobody link a ballot to a voter. Two options, for votes that must be attributable, deliberately reduce that secrecy.

Without changing anything: anonymous ballots, no names published. Both options are off by default and frozen at launch, and if you turn one on, every voter is warned before voting.

01 · By default

Anonymous by default: what nobody can link.

The public register shows who took part, under a random identifier, and publishes every signed ballot. Between the two there is no link: neither the public nor a later reader of the register can tell who voted for what. Nor can the organizer, with one caveat, detailed below.

How ballot secrecy is protected

The attendance list

  • A random identifier per voter, no names
  • Whether they voted and, if so, in which signing group
  • Published once, at close
No link

The ballots

  • Each ranking, signed on behalf of its group
  • No time, no arrival order
  • Published in batches of at least 600, or at close
The public register, by default: two lists with nothing linking them.

Anonymous voting

What it does
Each ballot is signed in the voter's browser on behalf of a group of voters (a ring signature): the signature proves it comes from an authorized voter, without saying which one.
When to choose it
Always, unless you decide otherwise: it is the setting of every election, free or Official, with nothing to turn on.
What it changes
The register publishes, for each voter, a random identifier and whether they voted. Ballots are published with nothing that points to their author.
In detail

Neither the time nor the arrival order of ballots is published: they appear in batches of at least 600, in an order unrelated to when people voted. An election with fewer than 600 voters therefore publishes its ballots at close.

The attendance list is published only once, at close, so it cannot be matched in time against the ballots.

The platform records no correspondence between a voter and their ballot.

The ring signature, for experts When ballots reach the register

What the organizer sees

What it does
During the vote, you follow turnout in your electoral roll: how many voters have voted, and which ones.
When to choose it
To remind everyone who has not voted yet in one go, or to resend a lost voting link.
What it changes
You know who voted, not what they voted (one caveat for near-empty groups, below). No result is visible, not even to you, before the close and the count.
In detail

Voting links and keys do not go through you: the platform sends them directly to each voter.

One limit, whatever the key mode: you can see which signing group each voter voted in. The ballot stays hidden among that group's ballots; but if almost nobody else votes in it, you could guess their choice. The public can never make that connection.

What each key mode changes Reminders and the electoral roll
02 · The two options

Less anonymity, only if you decide so.

Two options deliberately reduce secrecy, for votes that must be attributable. They are part of the Official offer, are set while the election is a draft and are frozen at launch; every voter is warned before voting.

The Official offer and its pricing

What the public register shows, option by option

By default

Every election

Participation
A random identifier per voter, and whether they voted. No names.
Ballot
Published and signed, with no link to its author.

Nominative participation

Official offer

Participation
In addition, for each person who voted: their name and a fingerprint of their email. Abstainers stay anonymous.
Ballot
Still secret.

Non-anonymous voting

Official offer

Participation
As with nominative participation, turned on automatically.
Ballot
Linked to its author's identifier, and so to their name: anyone can read who voted for what.

For experts: the exact content of the attendance register, field by field. The public register in detail

Nominative participation

Official offer
What it does
The public register shows the name and a fingerprint of the email address of each person who voted. The ballot itself stays secret.
When to choose it
When your bylaws require an attendance sheet, or so that everyone can check who took part in the vote.
What it changes
Personal data becomes public: you need a legal basis (bylaws, consent…).
In detail

Only people who voted are named: the option reveals who voted, never who abstained.

The email fingerprint is not a protection: anyone who already knows an address can check whether its owner voted. That is intended: a verifier holding the real electoral roll can check that the voters shown are the right people.

Avoid it for very small votes: if only one person votes within a signing group, their ballot ends up publicly linked to their name.

Personal data and compliance

Non-anonymous voting

Official offer
What it does
Each published ballot carries its author's voter identifier. With nominative participation turned on automatically, anyone can read on the register who voted for what.
When to choose it
Only for votes that are attributable by nature: some condominium or assembly decisions, where each person's vote must be traceable.
What it changes
Ballot secrecy is gone for every voter. The ballot is still signed, published and recountable by anyone.
In detail

The link between a ballot and its author is checked by the platform on receipt: it is the platform's attestation, not a mathematical proof. The signature still proves that the ballot comes from an authorized voter.

The dependency works one way only: non-anonymous voting requires nominative participation, but nominative participation can also be used on its own, revealing nothing about ballots.

Since identities and choices are published in clear, you need a legal basis, as with nominative participation.

The voter identifier in the signed ballot Personal data and compliance
03 · In full transparency

What anonymity does not protect.

Cryptographic anonymity has limits, and we would rather state them plainly. They apply to every election, free or Official, whatever the key mode.

For everyone, the public included

What the result, the register or the voter themselves can reveal.

  • Very small votes

    The result itself can reveal choices: with two voters, each can guess the other's vote, and a unanimous result tells what everyone voted. No cryptography can help with that.

  • A near-unique weight

    In a weighted vote that stays anonymous, the weight appears on each ballot and on the register: a voter who alone holds 87 shares can be recognized by anyone who knows whose shares they are. You are warned when you turn weighting on.

    Weighted voting

  • A voter can prove their vote

    Every voter keeps a receipt and can, if they wish, prove to someone else which ballot is theirs: the system does not resist coercion or vote buying.

    The vote proof

Towards the organizer and the platform

They know more than the public. Here is exactly what they can learn.

  • A near-empty signing group

    Each ballot hides among those of its signing group. The organizer, who knows every voter, sees which group each one voted in, whatever the key mode: if almost nobody else votes in it, they could guess that voter's choice. The public only sees a random identifier, unless nominative participation is on.

    What the register lets through

  • The platform, at vote time

    During the vote, the platform is a trusted third party: it sees each voter's connection when their ballot arrives. Open and auditable, but not trustless. Keys generated by the voters themselves reduce what you have to entrust to it.

    Voting keys
All the guarantees and their limits All frequently asked questions

Frequently asked questions

Can the organizer find out who I voted for?
No, in an anonymous vote, which is the default. The organizer sees whether you voted, so they can remind you, and in which signing group, never your ballot. One caveat: if almost nobody else votes in your group, they could guess your choice. Only non-anonymous voting openly links ballots to names, and the voting page warns you before you vote.
Does my name appear on the public register?
Not by default: you appear only under a random identifier. Your name is published only if the organizer turned on nominative participation or non-anonymous voting, and only if you voted; you are told before voting.
Can an online vote really be anonymous?
Yes, as long as we say where the promise stops. Here, a ring signature stops the public from linking a ballot to its author, today and later on. The organizer and the platform know a little more: in a near-empty signing group they could guess a choice, and the platform remains a trusted third party at vote time. Finally, a vote among three people cannot hide what its result reveals.

Lots of options? We'll guide you.

No worries: tell us about your vote and we will help you set it up step by step, from the voting method to the voter list.

Get support

The other options

Security, public register and proofs How ballot secrecy and verifiability hold together: signatures, public register, blockchain, verification. See security All the advanced options