No Accounts Needed For Voters

Nobody should have to create an account to vote. On RCV Lab the organizer signs in — so elections can be set up, saved, opened, and closed — but voters never have to. No sign-up, no password, no profile, no confirmation email before they can begin. A voter follows a link, ranks the options, and is finished.

That is not just a small convenience. Every sign-in you require is a share of your voters you lose before they reach the ballot, and it is the least engaged ones who drop first — which biases the result toward whoever cared or was persistent enough to register.

Three ways to reach the ballot

You choose one when you set the election up, and it is the main decision about who can vote.

Emailed one-time links. Each voter gets their own link. The link is the credential: it identifies that voter, is good for one ballot, and cannot be passed to someone else usefully. Choose this when you know exactly who is eligible — members, staff, a board, a class — and it matters that each of them votes once.

A shared link. One URL you can post, email, or put on a slide with a QR code. Anyone with it can vote, and the ballot allows one vote per device. Choose this for open polls, community decisions, and anything where the audience isn't a fixed list and where the vote can be taken in good faith rather than depending on more rigorous security. This is the default.

Unrestricted. No limit at all: every visit produces a fresh blank ballot. This is for a kiosk at an event, a tablet passed around a room, or a demonstration — situations where the same browser is deliberately used by many people, and remembering the last voter would be wrong in this context.

The receipt is the credential

Since there's no account, there's no password to prove a ballot is yours. The receipt does that job instead: a 64-character code issued at submission that identifies your ballot without revealing how you voted. It's what lets you verify your ballot was counted, and — if the election allows it — change your vote before the close.

Voters usually don't have to keep track of it. The browser they voted on remembers, so returning to the election on the same device recognizes them, and the receipts page lists every election that browser has voted in. But that convenience is fragile by design: it doesn't survive clearing browser data, a private window, or moving to a different device. The receipt itself is the durable credential, and it's worth telling voters to keep it. If voters are using shared computers they should clear their receipts.

Full detail on what a receipt is and how verification works is on Checking The Count.

What this means for the unrestricted tier

Because the kiosk tier deliberately treats every visit as a new voter, it also skips the browser's memory of the last one. Nothing is remembered between ballots on that device — which is the correct behavior for a shared tablet, and worth knowing before you choose it: a voter who wants to come back and revise will need the receipt they were shown, because the device won't recognize them.

On the other two tiers, returning voters are recognized normally.

What we don't collect

Voters have no profile because there is nothing to put in one. There's no password, no username, no verified identity, and nothing carried from one election to the next — no site-wide address book exists, deliberately.

If you invite voters by email, you supply those addresses as the organizer; they're used to automatically send that election's links and notices, and they belong to your election rather than to a global directory. A voter who arrives through a shared link doesn't even give you that much: what's stored is a ballot and a salt (a random number to help create the receipt), with no name attached to it.

When the election closes and the ballots are published for verification, they carry rankings and nothing else — no names, no addresses, no timestamps, and shuffled out of the order they arrived in.