Voter Receipts and Ballot Verification

A receipt code is a unique 12-character code generated when a voter submits their ballot. It is created on VoteAlly's server by combining the ballot's unique ID with a secret key that only the server knows. This process uses bank-level security to ensure the code is tamper-proof.

The resulting code (e.g., A7F3B9C2E1D4) serves as a fingerprint for that specific ballot. It is unique, always produces the same result for the same ballot, and cannot be reversed to reveal the ballot contents.

Each receipt code is guaranteed to be unique. No two ballots can share the same code.

After a voter clicks "Submit Vote," the server records the encrypted ballot and generates the receipt code. The voter then sees a Vote Confirmed screen that displays their unique receipt code.

Voters should save this code for their records. It is the only way for them to independently verify their ballot later. The code is shown once on the confirmation screen and is not stored anywhere the voter can retrieve it afterward.

VoteAlly uses a strict separation between voter identity and ballot content. The receipt code is derived from the ballot ID only, not from the voter's identity or their vote choices.

Ballot data is stored completely separately from voter information. The ballot itself has no connection to who cast it. Voter participation (who voted on which question) is tracked in a different place entirely. This separation means there is no way to trace a receipt code back to a voter's identity, or to connect a voter to their specific ballot.

Additional protections reinforce this separation:

• Timestamp rounding: Ballot timestamps are rounded down to the nearest hour, so there is no way to match a voter's login time to a specific ballot.
• Encrypted ballot contents: The actual vote choices are protected with bank-level encryption. The original selection is never stored in readable form.
• Secure tallying: Vote counts use scrambled candidate identifiers, so the database never sees which candidate received which votes in plain text.

Administrators can download a Ballot Audit CSV that lists every ballot recorded for a session. This file is designed for transparency: you can publish it so voters can verify their ballots were counted.

Once you publish the Ballot Audit CSV (or the ReceiptCode column from it), any voter can verify their ballot independently:

1. The voter locates the receipt code they saved after voting.
2. They search the published list for their code (e.g., using Ctrl+F in a spreadsheet or text file).
3. If the code appears, their ballot is confirmed as part of the official tally.
4. If the code does not appear, they should contact the administrator for investigation.

VoteAlly automatically purges voter Personally Identifiable Information (PII) after a configurable retention period (90 days by default). When this happens, voter names, emails, phone numbers, and candidate photos are permanently removed.

Receipt codes are not affected by personal data removal. They are stored with the ballot data, which is completely separate from voter information. Because ballots have no connection to who cast them, ballots and their receipt codes are kept permanently as part of the audit trail.