Guides · Voters
Voter & member guide
You cast only from your device. Officers cannot vote for you in the admin portal. After you cast, you hold a tracker to prove your ballot is in the box — without publishing how you voted.
Path
From invite to verified ballot
-
Receive a bind invite
Your institution sends a QR code, deep link (publicvoting://bind?…), or short-lived token out of band (in person, email, member portal — not a random social post).
-
Check the system fingerprint
Before accepting, confirm the name and fingerprint match what your officers published. Look-alike systems are a common phishing pattern — reject mismatches.
-
Bind your device
The app generates device keys on the phone. Write down the recovery secret offline if shown (once). You now have an active membership binding for that voting system.
-
Review the decision
Open the motion or election: title, options or for/against material, community notes, public banners (e.g. uncontested, no formal opposition). Note the vote window times.
-
Cast during the window
Confirm your choice, seal the ballot (Mode B), sign with your device key, submit. Double-taps should not double-count (idempotent cast).
-
Keep the receipt (inclusion, not choice)
Save the tracker and open the verify links. Do not share a “I voted X” screenshot if you care about coercion resistance.
What your receipt shows
| Field | Why it matters |
|---|---|
| Tracker | Public identifier of your sealed ballot envelope |
| Log sequence | Position on the append-only chain |
| Inclusion page | Confirms the tracker is in the log (not your choice) |
| System hub / results | Official public pages for the decision |
| Verify log | Anyone can re-check the hash chain |
| Roll commitment | Eligible count frozen at open (no names required) |
Phone lost or replaced
Transfer (old phone still works)
Start transfer on the old device → new device registers a new key → old binding revoked. No long cooling-off in the normal path.
Recover (old phone gone)
Enter your recovery secret on the new device. Expect rate limits and possibly a cooling-off period (often 24 hours) before cast is allowed again. Officers may unlock only after identity checks.
Multi-system wallet
One phone can hold memberships for many institutions (club, board, union). Credentials are partitioned per voting system — binding to one does not grant votes in another.