A secret ballot is only secret if nobody collects it. Psephos collects nothing, sends nothing, and has nowhere to send it. This page says exactly what that means and how each sentence is checked.
The name you give a vote, the candidate names you type, the preference orders of each ballot, the number of voters each order stands for, and one display setting. All of it lives in this app on this device. Deleting the app deletes all of it, because there is nowhere else it exists.
There is no field that ties a ballot to a person. Not a name, not an email address, not a device identifier, not a timestamp on the ballot itself. This is not an omission to be corrected later: a field that exists will eventually be filled, and the moment one is, “secret ballot” stops being true. The build fails if such a field appears in the stored ballot type.
One line, and only if you have a paired Apple Watch with the Psephos watch app open: the vote’s name, the verdict, and — only when all five rules agree — the winner’s name. The ballots themselves never go. That line travels over Apple’s own device link between your phone and your watch and does not reach the internet. If you have no watch, nothing leaves the device at all.
Collecting ballots from several phones would require a server, and a server means somebody — us — could see who ranked what. Every app that offers a “live poll” has made that trade. Psephos does not offer it, and the absence is the feature: the ballots stay on the device where they were entered.
Each claim above corresponds to a check that runs on every build and fails the build if the claim stops being true. The source is scanned with comments stripped for URLSession, URLRequest, CFNetwork, NWConnection, CLLocationManager and StoreKit; separately for CNContact, CNContactStore, ASIdentifierManager, identifierForVendor and ATTrackingManager. The stored ballot type is scanned for any field that could identify a person. Every permission key that must be absent is checked for absence, and any code path that could export ballots off the device fails the build. A privacy promise nobody measures is worse than none at all, because people rely on it.
Psephos contains no user-generated content that anyone else can see, no messaging, no web browsing and no advertising. It has nothing to collect from anyone, of any age. Rated 4+.
Psephos is a tool for understanding voting rules. It does not conduct, certify or report on any official election, and it is not affiliated with any electoral body.
If any of this ever changes, this page changes with the release that changes it, and the corresponding build gate changes too — they cannot drift apart.
Questions: hello@norea.studio.