Privacy Policy

How you voted. Your ballot is encrypted in your own browser before it is sent, and it stays unreadable to everyone, us included, until the reveal time. The ballot carries no name, email, phone number, or invite, and the anonymous credential that authorises it is issued in a way that cannot be traced back to the voter who received it. Nobody, including the organizer and us, can tell which voters cast a ballot. How this works

• Your account. Your email address or phone number. If you use a password, we store only a salted Argon2 hash of it. If you sign in with Google, we store Google's identifier for your account.
• Elections you run. The question, the options, the schedule, and the roster of email addresses and phone numbers you invite.
• Invitations you receive. The address or number you were invited at, and whether you collected your voting credential — which is not the same as whether you voted, and we cannot tell the two apart.
• The public record of each election. Encrypted ballots, a log of credential requests signed by voters' browser-generated keys, and the result. This is published so anyone can recount it. It contains no names, addresses, or phone numbers.
• Requests to join an election through its shared link: the name you gave and your number, so the organizer can see who joined — or, if they chose to let each person in themselves, decide whether to. They see your number in full while your request is waiting, and only its last four digits after.
• Texted codes, only as a keyed hash, valid for ten minutes.
• Operational logs kept by our hosting provider, which record events such as an email or text being sent and to which address. Text logs show only the last four digits of a phone number.

Your browser stores your session and your vote receipts. We do not use analytics, advertising, or tracking of any kind.

To sign you in, to deliver ballot links and the messages that go with them, to run the election and publish its result, and to keep the service from being abused — for example, limiting how often a sign-in code can be sent to one number.

We text a phone number only to send a code its owner asked for, or a ballot link and related notices for an election the number was invited to or asked to join. See our text messaging page for every message we send. Receiving texts is optional, and never a condition of using ZeroVote.

We do not sell, rent, or share mobile phone numbers or text message opt-in consent with third parties or affiliates for marketing or promotional purposes. Phone numbers are shared only with the provider that delivers the texts (Twilio), for the purpose of delivering them.

We don't sell personal information. It is shared only with the services that run ZeroVote, for that purpose:

• Twilio, which delivers text messages
• Resend, which delivers email
• Google, if you choose to sign in with Google
• Fly.io and Vercel, which host the service and the website
• Neon, which hosts the database

An organizer can choose to have results sent to a web address of theirs. That message carries the result, not voters' details.

Reply STOP to any text to stop receiving them. To delete your account, or to ask what we hold about you, write to support@zerovote.app. A published election's public record — its encrypted ballots and result — stays published, because removing it would let anyone erase a count people relied on.

If this policy changes, the date at the top changes with it. Questions go to support@zerovote.app.