How we keep your vote secret

When you confirm your vote the system writes two different things, in two different tables, that share no field.

Voter register

First and last name
Email (encrypted)
Invitation date
"Voted": day only

Does not contain: your choices

≠

Ballot box

Random ballot key
The choices
The day
Receipt fingerprint

Does not contain: name, email, time, any reference to the voter

Blind signature: the link is impossible, not just "not stored"

Your browser creates a random token and "masks" it with a number only it knows.
First request, with your personal link: the server checks that you are entitled to vote, marks "voted" and signs the masked token without being able to see it.
The browser removes the mask: it now holds a signed token the server has never seen in clear.
Second request, a few seconds later and without any data identifying you: the browser submits the ballot with the signed token. The server accepts the ballot because the signature is valid, but cannot know whose it is.
Each token is valid for one ballot only. The code that masks the token runs in your browser and is public (js/AN05_blind.js): anyone with technical skills can check it.

What we do not store

the exact time of the vote, neither next to your name nor on the ballot: times could be used to line votes up;
a sequential ballot number: the key is random, so the order in the box does not tell who voted first;
the receipt code: the box holds only its fingerprint, a one-way calculation; only you know the code;
your choices in the confirmation email.

What you can check yourself

Right after voting you see the two records just stored, read back from the database: no choices next to your name, no name on the ballot.
With the receipt code you check, on the results page, that your ballot is in the box and was counted.
When voting closes the ballot box is public (without names): you can recount every ballot with one click and compare with the results.
The system compares the totals with the ballots and with an encrypted copy of the counters and flags any difference.

Limits, stated plainly

With the blind signature the link is impossible even for whoever runs the server, because the server never sees the token next to your name. Two indirect traces remain, reduced but not eliminated: the internet address the requests come from (we do not store it in our tables, but the hosting provider's technical logs keep it) and how close in time the two requests are, softened by the random wait before submission.

In elections without blind signature the separation between name and choices holds for the stored data: nobody, not even the organiser, can rebuild it afterwards. Whoever technically runs the server, watching the system live exactly while you vote, would in theory have more options.

For the same reason the ballot box is not published if there are fewer than 5 ballots: with very few voters the combinations of choices could reveal who voted for what.

Try it yourself

Vote in a practice election in less than 30 seconds, with no account, or check a receipt.

Try voting Check a receipt

Purpose	Legal basis
Creating and managing the account, providing the reserved area and support (tickets)	Performance of a contract (art. 6.1.b)
Running elections on behalf of the organiser: invitations, ballot, counting, results, results email and PDF counting report for the organiser, receipt check	Contract with the organiser and their instructions (art. 28); for the organiser, the basis of their own relationship with voters
Showing the organiser the invitation progress (emails opened, links opened, vote cast)	Organiser's legitimate interest in checking that the notice arrived and in sending an email reminder (at most one every 12 hours) to those who have not voted yet (art. 6.1.f)
Handling payments and accounting and tax obligations	Contract and legal obligation (art. 6.1.b and 6.1.c)
Answering contact form messages	Pre-contractual measures / request of the data subject (art. 6.1.b)
Providing the Poll service and preventing double votes	Performance of the requested service (art. 6.1.b)
Checking that Poll and Find a date are not used for illegal purposes, suspending or deleting surveys that breach the terms of use or the law	Legitimate interest in preventing illegal use of the service and protecting participants; legal obligation when the authorities request it (art. 6.1.f and 6.1.c)
Providing the free services: Free plan, single unlock, PDF report, demo, Find a date, public receipt check	Performance of the requested service (art. 6.1.b)
Sending news and offers from METIS Italia by email	Optional consent, withdrawable at any time (art. 6.1.a)
Counting the use of the free services (events without voter data) and preventing abuse (limits per IP address, reCAPTCHA, refusal of disposable emails)	Legitimate interest in offering the free service in a sustainable and secure way (art. 6.1.f)
Elections overview for super-administrators (service data only, without voter and candidate data)	Legitimate interest in running, sizing and protecting the service; for election data within the organiser's instructions as processor (art. 6.1.f and art. 28)
Security: blocking repeated login attempts, anti-bot protection of forms (reCAPTCHA), access log, backups	Legitimate interest in the security of the service (art. 6.1.f)
Visit statistics of the Poll voting page (Google Analytics)	Consent, given through the cookie banner (art. 6.1.a)
Defending our rights in case of disputes	Legitimate interest (art. 6.1.f)

Data	Retention period
Organiser account (profile data)	As long as the account is active. With "Delete profile" and the confirmation from the link received by email they are deleted immediately, together with all elections (candidates with photos, voters, ballot box, blind-signature tokens) and support tickets.
Elections: candidates, voters, invitation progress, anonymous ballot box, token fingerprints	On behalf of the organiser, until they delete the election (possible before it starts or from 7 days after closing, a period during which results and receipts remain available) or their profile. We recommend organisers delete finished elections when no longer needed.
Vote resume data in the voter's browser (blind signature)	Until the ballot is submitted, then deleted automatically. If the vote is not completed they remain only on that device and can be removed by clearing the site data in the browser.
License and unlock payments	10 years, as required by accounting and tax rules (art. 2220 Italian Civil Code), also after the account has been deleted.
Consent to news and offers	Until you withdraw it or delete the account.
Organisation logo and free-service usage events	As long as the account is active; deleted with the profile (the logo also when you replace or remove it).
Imported rows waiting for the unlock	At most 30 days; earlier if the election is unlocked (they become voters or candidates) or deleted.
Public demo (test voters and ballots)	At most 24 hours.
Find a date (poll, names, answers, creator email)	Deleted automatically 90 days after the last proposed date; earlier if the creator deletes it.
IP address fingerprints for usage limits	Until the end of the check window, at most 24 hours.
Support tickets	As long as the account is active; deleted with the profile.
Contact form messages	24 months from sending.
Poll surveys (contents, preferences, IP addresses)	12 months after the survey deadline; earlier at the creator's request.
Access log of the website and reserved area (IP, browser, pages)	12 months.
Failed login attempts (email hash, IP)	At most 24 hours; deleted right after a successful login.
Session cookie	Until the browser is closed; reserved-area access expires after 30 minutes of inactivity.
Poll technical cookie (to change your answer) and cookie-banner choices cookie	120 days the former; up to 12 months the latter.
Meeting minutes draft and calculator figures (browser only)	Until you delete them; the minutes PDF is not kept.
Find a date technical cookie (to change your own answer)	120 days.
Google Analytics statistics (Poll voting page)	According to the Google service settings, only with your consent.
Hosting provider technical logs	According to the periods set by Aruba for the security of the service.
Database backups	Kept for a limited period and then replaced by newer copies: deleted data may remain in backups until they are overwritten, without being used for any other purpose.