Secret ballot: how it works and where its limits are
Each invited person votes exactly once. Wannja stores THAT someone has voted, but never WHAT – not even you as the organiser can see it. This page sets out exactly how this works, and just as precisely what an online vote cannot do.
The secret ballot is part of Wannja Pro (CHF 7 per month or CHF 70 per year) and is a setting of the poll. More about Pro
In brief
One person, one vote
Only invited people can vote, with the personal link from their email – and so exactly once.
A vote without a name
The ballot has no connection to the person: no name, no address, no time, no link to the invitation.
A voting register, as at a general meeting
You see who has already voted (with the date) and who is still missing. You never see how someone voted.
Results only at the end
The results only appear once voting has been closed, and only from 3 votes. There are no interim results, not even for you.
How a secret ballot works, step by step
Create a poll set to “Secret”
Create a poll with your questions. Under “Who sees who voted for what?” choose “Secret ballot (with list of participants)”, and under “Who can vote?” choose “Invited people only”. All question types are possible.
Confirm what the ballot can do
Before you can save, you tick a box to confirm: Wannja does not store who voted for what, but it cannot check who is voting – and you won’t use the secret ballot for legally binding or sensitive decisions.
Invite the eligible voters
Choose lists, groups, individual people or guests. Only people with an email address who allow emails to be sent to them are invited; anyone without one is skipped, and you’re told who. Each person gets their personal link by email – with a note not to pass the email on.
Voting
The link first shows a short explanation and the button “Go to the ballot”. It opens a ballot that is valid exactly once. “Cast vote” saves the vote; after that it can no longer be changed.
Closing and results
Voting closes when the response deadline has passed, when all invited people have voted or when you close it with “Close voting”. The results then appear – provided at least 3 people have voted. When you close the ballot, you can inform everyone who voted about the results by email.
The screenshots show the German interface.
What is technically stored – and what is not
The separation between person and vote is built into the program itself, not just into what is displayed:
| What | Stored | Not stored |
|---|---|---|
| Invitation | Name and email address of the invited person, a personal link and “has voted” with the date only. | The time the vote was cast. Any reference to the ballot. |
| Ballot | A random number, the poll and the answers. The only date on the ballot is the date the poll was created – the same on every ballot. | Name, email address, invitation, edit link, day and time the vote was cast. No sequential number either: the order does not reveal who voted first. |
| Single-use ballot | “Go to the ballot” creates a single-use key; only a checksum of it is stored, and only until the vote has been cast. If the ballot is opened a second time, only the new one is valid. | The key itself. Once the vote has been cast, the checksum is deleted too. |
| Transmission | The vote is sent to an address that contains no personal key; the key is only in the form. | Along this route there is no entry with an IP address for abuse protection, no spam log line and no entry in the anonymous daily counter. |
Only the invitation records the day someone voted. The ballot carries no voting date, just the poll’s creation date, which is the same on all ballots. So a vote cannot be linked to a person even if only one person voted on a given day.
What you see as the organiser – and what you don’t
| Topic | What you see | What you don’t see |
|---|---|---|
| Participation | Who is invited, who has voted and on which day. | The time, and how the person voted. |
| Results | The totals per question, once voting has been closed and there are at least 3 votes. Free-text answers sorted alphabetically. | Interim results. Individual ballots. The Excel and CSV files only contain the totals. |
| Reminders | One joint reminder to everyone who hasn’t voted yet; sent automatically if you have set a deadline and switched on the reminder. | Reminding individual people is not part of the secret ballot. |
| Changes | Invite more people and move the deadline while voting is open. Remove invitations of people who haven’t voted yet. | View, change or delete votes. After closing: reopen, change the deadline or invite more people. |
Why the results only come at the end
If the results were visible all along, every vote could be read off: a new tick appears next to Anna in the voting register, and at the same time “Yes” goes up by one. That’s why a secret ballot has no interim results – for anyone. And once all invited people have voted, the ballot closes automatically, so that nobody can be invited and the deadline can’t be moved afterwards.
The minimum of 3 votes prevents the results from simply showing the individual vote when there are only one or two votes. Even so, we recommend the secret ballot only from about 5 people – see the limits.
What the secret ballot cannot do
To be honest: an online vote is not a ballot box with a polling station. You should know these limits before you use it.
- No identity check. Wannja does not check who opens the link. Anyone who gets another person’s invitation email – forwarded, on a shared computer, read over their shoulder – can vote in their place. The eligible voter only notices when they try to vote themselves.
- Only as good as the list of invited people. You decide who is invited. If an address is wrong, or you invite someone twice under two addresses, that person has two votes.
- Small groups and unanimous results. The voting register shows who has voted. If everyone votes the same way, one look at the results reveals every vote. With 3 people, 2 yes and 1 no, it’s often possible to guess who said no. The same applies if you close the ballot when only a few people have voted.
- Free text can give people away. The content and writing style of an answer can show who wrote it. Wannja points this out when you create the poll and on the ballot.
- Collusion and screenshots. Nobody can stop someone from showing their vote, taking a screenshot or voting under pressure.
- No later checks on individual votes. Because there is no connection to the person, a single vote can be neither checked nor corrected nor deleted – not even by us.
What applies on the operations side
Wannja is hosted on Microsoft Azure in the EU and operated by e-sys (Switzerland). The separation of person and vote is built into the database itself: there is no column that would link a ballot to an invitation, no time the vote was cast and no order. One limit remains, as with any online vote without a cryptographic voting protocol: anyone who compares states of the database from different points in time, such as two backups, where only a single vote was added in between, can link that vote to the person who voted during that period. Only someone with direct access to the servers and backups can do this – as the organiser, you see neither interim results nor individual ballots.
Like every website, the web server keeps an access log with the time and IP address of each request. It may show when someone opened their personal link – but not the vote, because the vote is sent without a personal identifier in the address. Invitation and reminder emails go through our mail server; they show who was invited, not how anyone voted. How long such logs are kept is set out in the privacy policy.
A secret ballot, including its invitations and ballots, is deleted when you delete it or delete your account. Archived ballots remain stored until you delete them.
When paper or a verified procedure is the better choice
Wannja’s secret ballot is not certified e-voting and not an election system that meets specific legal requirements. Whether an online vote is permitted for a decision is governed by your statutes, the law or your organisation’s rules – not by Wannja. We do not give legal advice on this.
- Elections and votes that must be binding under statutes, the Swiss Code of Obligations or municipal law and could be challenged.
- Staff decisions, votes with financial or legal consequences, political votes.
- Very small groups in which votes can be guessed.
- When you need to be certain that it really is the eligible voter who votes.
In such cases: vote with ballot papers on site, or use a procedure that checks identity. Wannja works well for gauging opinion, consultative votes and decisions where everyone accepts these limits.
What it works well for
Gauging opinion before the general meeting
How do members feel about the new annual fee? A secret straw poll beforehand helps the board prepare the motion. Example
Board election in a small club
If your statutes allow it and everyone agrees: candidates as options, invite the members, results after the deadline.
Team feedback
Honest feedback to the team without anyone having to fear being recognised – from about 5 people. Example
In the room?
The secret ballot is not meant for a quick QR code vote in the room – it needs personal invitations by email. In the room, use an anonymous QR code vote; there, however, it cannot be guaranteed that each person votes only once.
With names, anonymous or secret?
| With names | Anonymous | Secret ballot (with list of participants) | |
|---|---|---|---|
| Who can vote? | Anyone with the link or invited people only | Anyone with the link | Invited people with an email address only |
| One vote per person? | Guaranteed only for invited people | No, only curbed | Yes, exactly one per personal link |
| Organiser sees who voted for what? | Yes | No | No |
| Organiser sees who has voted? | Yes | No | Yes (with date) |
| Vote can be changed? | Yes | No | No |
| Results while voting is open? | Depends on the setting | Depends on the setting | No, only after closing and from 3 votes |
| Plan | Free (inviting: Pro) | Free | Pro |
Frequently asked questions
Can the organiser find out how I voted?
Not from Wannja’s data: the vote is stored without a name, without a time and without a link to the invitation, and there are no interim results. A vote can be guessed, though, if the group is very small or everyone voted the same way.
Is this legally valid, for example for a board election?
That depends on your statutes and the applicable law, not on Wannja. Wannja is not certified e-voting and does not check who is voting. For binding decisions or decisions that could be challenged, use a procedure that checks identity, or vote on site.
I’ve lost my invitation email. What now?
Contact the person organising the ballot. They can send one joint reminder to everyone who hasn’t voted yet; the reminder contains your personal link.
What happens if I close the ballot page without voting?
Nothing. Open the link from the email again and click “Go to the ballot”. The previous ballot is then no longer valid, the new one is.
Someone else voted with my link. What can I do?
The vote cannot be found or deleted, because it is not connected to anyone. Tell the organiser; depending on how important the decision is, the vote will have to be repeated.
Why does every person need an email address?
Because the personal link should go directly to the eligible voter, not via the organiser. People without an address are therefore not invited to a secret ballot.