Anonymous voting
Anonymous voting, also known as blind voting, separates the record of who has voted from the votes themselves. After the poll closes, anyone who can see the results can see who took part. No one using Loomio can connect a submitted vote with the person who submitted it.
This page explains the protections provided by anonymous voting, the information that is retained, and the limits of the guarantee.
How anonymous voting protects voters
An anonymous poll keeps two separate sets of records:
| Participation records | Submitted votes |
|---|---|
| Who is eligible to vote | The selected options or scores |
| Who was invited, and by whom | The poll the vote belongs to |
| Whether each eligible person has voted | No name or user account |
| No selected options or scores | No link to a participation record |
There is no shared identifier that connects these records. Submitted votes also omit the actual submission time, invitation information, written reasons, attachments, and other metadata that could help identify a voter.
This separation is enforced when the vote is stored. It does not depend only on hiding names in the interface.
While voting is open
Results remain hidden from everyone until the poll closes. This includes thread admins, group administrators, and instance administrators using the application.
When someone votes:
- their submitted vote is stored without their name or participation record;
- their participation record is marked to show that they have voted;
- no vote event, notification, email, comment, or activity entry is created;
- no copy of their selections is returned after submission; and
- the interface confirms only that their vote was recorded.
The participation record does not store a precise time for when the person voted. Submitted votes are not ordered by submission time.
Votes cannot be changed
Each eligible person can vote once. A submitted anonymous vote cannot be reviewed, changed, withdrawn, or replaced, including by an admin.
Allowing a person to retrieve or replace their vote would require a persistent link between that person and the vote. Anonymous voting deliberately does not create that link.
Review your selections carefully before submitting.
Why anonymous votes do not have reasons
New anonymous votes cannot include a written reason or an attachment. Reasons can contain names, personal details, writing patterns, mentions, or other information that identifies the voter. They would also make individual votes easier to distinguish from the aggregate result.
Participants can still discuss the poll in its thread where discussion is available. Those comments are ordinary named discussion contributions and are not attached to an anonymous vote.
Results and exports
After the poll closes, the results are calculated from the detached votes and displayed as totals and other aggregate results supported by the poll type.
The application does not publish vote identifiers, submission order, or submission times. Poll exports contain aggregate results rather than a row for each anonymous vote, except that a closed STV election can be exported in BLT format. A BLT export contains the candidate rankings needed to recount the election, grouped when multiple ballots have the same ranking, without voter identities or ballot metadata.
An anonymous poll cannot be reopened after it closes.
Who took part
After an anonymous poll closes, anyone who can see its results can see who took part. No one can see this while voting is open.
Select View votes to see the list. It always shows who was eligible. It shows whether each person voted only if enough people voted. That means the poll's quorum if it has one, otherwise half the eligible voters, and never fewer than three votes. The list never shows how anyone voted, or when.
Group members and the poll's voters also see when each person joined the group and who invited them. Group admins also see email addresses, to tell apart people with the same name.
Because everyone who can see the results can see who voted, a one-sided result can reveal how people voted. For example, if every vote is Agree, everyone who voted agreed.
Admins can add eligible people while voting remains open, including after other people have voted. Existing voters cannot be removed from an anonymous poll.
Reminders
For an anonymous poll lasting at least 24 hours, eligible people who have not voted receive one automatic reminder during the final 24 hours.
The reminder is selected from participation records only. It does not inspect submitted votes or create a connection to them. If the deadline changes, the hourly reminder check uses the current deadline without maintaining a separate scheduled reminder for the poll.
Polls with a total voting period of less than 24 hours do not send this automatic reminder.
What admins can see
Through the application, a thread admin, group administrator, or instance administrator may be able to see:
- the poll and its eligible voters;
- whether each eligible person has voted, where their role permits access and enough people have voted; and
- aggregate results after the poll closes.
They cannot use application features to see:
- which selections belong to a person;
- individual votes or voting patterns;
- when a particular vote was submitted; or
- a reason, attachment, event, or notification associated with a submitted vote.
Limits of anonymous voting
These protections prevent application users from linking a submitted vote to its voter. They are not a cryptographic protection against an operator who can inspect the database, backups, server logs, process memory, network traffic, or a modified version of the application.
The result itself may also reveal information. A small electorate, a unanimous result, a distinctive combination of selections, or information shared outside the poll can make a person's choices easier to infer. Voters may also choose to identify themselves in discussion outside their submitted vote.
Consider the size of the electorate and the sensitivity of the decision when deciding whether application-level anonymous voting is suitable.
Questions
Can anyone see how I voted?
No. Once enough people have voted, people who can see the results can see whether you voted. No one can connect you with a submitted vote through the application. Until then, whether you voted stays hidden.
Can I see my vote after submitting it?
No. The application confirms that your vote was recorded, then discards the selections from the voting interface. It cannot retrieve your vote without creating the link that anonymous voting is designed to avoid.
Can I change or withdraw my vote?
No. There is no link that would let the application identify which submitted vote to change or remove.
Will I receive an email confirming my vote?
No. Voting creates only the on-screen acknowledgement and updates your participation record. It does not send a confirmation email or create a notification or activity event.
Does a public poll reveal more information?
After a public poll closes, anyone can see its results and who took part. They cannot see individual votes, or membership and invitation details.
Is anonymous voting suitable for every election?
No. It provides application-level separation between identities and votes. Decisions requiring protection from system operators or independently verifiable cryptographic elections need a system designed for those requirements.