True Anonymity
中文 Log in Sign up

For voters

How your vote stays private

True Anonymity is built so that the school can see the results, but not who picked what. Plain-language answers to the questions students and parents have asked us most.

What your code actually does

  • It proves you were invited. Your one-time code only tells the server "yes, this person is allowed to vote once." It does not carry your name, email, class, or device.
  • It can only be used once. The moment you submit a ballot, the code is marked used and you can't vote again with it.
  • It is separated from your ballot. The system writes your answers into an anonymous pile, then deletes the draft tied to your code. Your code says "voted"; the ballot pile says what was chosen. The two cannot be re-joined.

What the school can see

  • How many codes were used, and how many were not.
  • How many people read the briefing, skipped it, or never opened it — in aggregate.
  • Vote counts and percentages per question, after the deadline.
  • How many people chose not to answer each question, and which reason they picked from the five categories.

What the school cannot see

  • Which option you picked on any question.
  • Whether you are the person who chose "I'd rather not answer."
  • Your email, name, IP address, browser, or device fingerprint tied to a ballot.
  • The order in which ballots came in. Submission timestamps are not stored against ballots.
  • Results before the voting deadline. Nobody — not even the operator — sees results while voting is open.

What anonymity cannot protect against

We owe you the honest picture, not a marketing promise.

  • Bad code handoff. If a teacher hands you a printed code by name and watches you scan it, the math of the system is still anonymous — but the social context is not. Operators should distribute codes through indirect channels (sealed envelopes, posted QR sheets, parent emails).
  • Tiny groups. If only three people are eligible to vote and two abstain, the result reveals the third person's answer. True Anonymity is designed for groups large enough that no single ballot stands out. The minimum-participation threshold (planned) will warn operators when results are too thin to publish safely.
  • What you write outside the ballot. Telling a friend how you voted, posting a screenshot, or letting someone watch your screen all leak information the system cannot retract.
  • Server hosting. If a school self-hosts and the IT administrator goes looking at the database files, they would not find your name attached to your ballot — but they could see that ballots were submitted. Treat the operator's hygiene as part of the anonymity contract.

The language we use carefully

We do not say "impossible to trace" or "100% anonymous" because no software can promise that against every threat. We say:

  • Designed so the database cannot connect your code to your ballot after submission.
  • Not stored with identifying metadata.
  • Cannot be linked within the system once you submit.
  • Does not protect against social pressure during code distribution.

If you're worried about a specific question

If a vote is asking you to evaluate a teacher, report a safety concern, or weigh in on something that could affect you personally, three things help:

  1. Submit from your own device, not a shared one.
  2. Use the voting link directly — don't let an adult watch your screen.
  3. If you need to abstain, "Pressure barrier" is a real reason worth picking. It tells the school that the climate around the vote was unsafe to participate in.

Questions about a specific deployment? The school administrator running the vote is the right person to ask. They can show you the operator-side dashboard so you can see exactly what they see.