Fast Elections is built around a real secret ballot, not just a promise of confidentiality. Here's exactly what that means for what organizers can and can't see.
What organizers can see
As an organizer, you can see participation: who was invited, who was reminded, who has voted, and who bounced or unsubscribed, each with a timestamp. The "voted" timestamp is rounded to the hour, so you know roughly when someone voted without it being precise enough to correlate with anything else. You can export this roster as a CSV at any time.
What organizers cannot see
You cannot see how any individual voted, and neither can we. Cast ballots carry no reference to the voter who submitted them — no name, no email, no account link. There's no admin view, database query, or export anywhere in the product that connects a person to their choices.
How this is enforced technically
- Voting links are stored only as hashes, not as reversible identifiers.
- Cast ballots are written with nothing identifying the voter attached to them.
- Ballot timestamps are rounded to the hour, so cast order and precise timing can't be used to infer who voted which way.
- Each cast ballot gets a random receipt code, generated independently of the voter's identity, that only proves a ballot's inclusion when checked against published results.
Why results stay sealed until close
Live counts are hidden while voting is open, precisely so no one — including you — can react to a partial tally. See Why we can't show live counts.
Verifying your own ballot was counted
After results are published, every voter can search the published list of receipt codes for the one they were shown after casting their ballot, confirming it was counted — without revealing their choices to anyone. See Publishing results & receipt verification.