Common questions

Open the link in your message, or go to the address on your letter and type in the code. Choose who you want, check the summary you are shown, and confirm. It works on a phone or on a computer, and there is nothing to install.

No. Your selections are stored with nothing attached to them that could point back at you — not hidden from your officers, but genuinely absent from the record. Nobody at your club, and nobody here, can work backwards from a ballot to a person.

It is how you can check your ballot was counted: when the result is published, the reference appears in the list of counted ballots. It does not show how you voted, and no copy of it is kept anywhere, so nobody can demand you produce it to prove anything.

Ask your club’s officers. They can issue you a replacement as long as the original has not already been used, and two of them have to agree to it. Nobody can look up your old code — codes are not stored anywhere they could be read back.

No. Once a ballot is submitted it cannot be changed or withdrawn — that is what makes it secret, because there is no way to find it again. You are shown a summary and asked to confirm before anything is recorded.

Your code works once and is then spent. If someone else used it before you, you will be told the ballot has already been accepted — tell your officers straight away.

Neither. There is nothing to sign up for and nothing to download. The only things stored in your browser are a token that protects the form and, if you switch languages, which language you chose.

If your club allows it, you can submit a blank ballot, which is counted as an abstention. Or you can simply not use your code.

Both halves of an AGM. Elections: one seat or several, with each member choosing one candidate or as many as you allow. Motions: adopt the accounts, amend the constitution, approve the proposed committee — you write the resolution, set whether it needs more than half, two thirds or three quarters of the votes cast, and the result page says carried or not carried. Slates work either way: put each slate on the ballot as an option with its members named, or put a single proposed slate to a motion.

Four ways, and you choose before you launch: email sent by this service from its own verified domain with your name on it; email through your own mail server; printed letters you post or hand out; or a mail-merge file you send yourself from your own system.

Yes, for anything that matters — launching, closing early, publishing the result, replacing a lost code, producing a list of codes. One officer asks, a different one agrees, and the database refuses if they are the same person. A club with a single account cannot run an election.

They can see the totals once voting has closed, which is what lets them check the count before announcing it. Nothing is counted while voting is open: there is no running tally on any screen, so there is none to leak.

You agree the tie rule when you set the election up, before any names are known. If the seats run out inside a tie, the count reports it and refuses to break it, and publication is blocked until the officers record what they did about it. Seats decided outright are not held up by it.

Yes, and we tell people how. Every published result offers the ballots it was counted from, anonymously, along with a separate program that counts them again — written in another language and sharing no code with the software that produced the page. There is a step-by-step page at /verify with the exact commands. It needs no account and nothing installed beyond Python, which most computers already have.

English, French and German. Each member reads the ballot, the emails and the result in whichever they choose, and you can supply your own translations of the election’s title, description and candidate statements.

In Frankfurt, in the European Union — both the application and the database. There is more detail, including what is encrypted and how long things are kept, on the page about how this is built.