Privacy policy

This policy explains what personal data ElectionKeeper ("we") handles, why, and what you can do about it. If you have a question, email hello@electionkeeper.com.

Who's responsible for what

• Organizer accounts and our website: we decide how this data is used, and we're responsible for it.
• Voter data (the member lists organizations upload, and their elections): the organization running the election decides how it's used. We handle it on their behalf and only to run their elections. If you're a voter, contact that organization first; we'll help them answer.

Organizers: what we collect

• Account details: your name, email address and organizations.
• Your password is stored only as a salted hash, never in readable form. When you choose one, we check it against known data breaches by sending only the first five characters of a hash of it to the Have I Been Pwned service, never the password itself.
• Google sign-in, if you use it: your name, email address and profile picture from Google. We don't keep Google's access, refresh or identity tokens.
• Sign-in sessions: a session cookie, your browser's user-agent string, and a keyed hash of your IP address (not the address itself), used to protect your account.
• One-time codes we email you to confirm your address, sign in or reset your password. We store them only as hashes, and they expire after 10 minutes.
• Your organization's settings: its name, time zone, language, contact email and branding.
• Staff invitations: the email address someone was invited with, their role and who invited them, kept with the organization's records.
• An admin log of actions taken in your organization, such as launching an election or changing roles.
• Two-factor sign-in and passkeys, if you set them up: the information needed to check them (for a passkey, its public key; for an authenticator app, its secret, stored encrypted).
• Results keys for Strict elections: only locked copies, which we can't open. The key itself stays on your devices and in your recovery code.
• Payments: handled by our payment provider, Polar. We never see your card details; we receive what you bought and its status.

Voters: what organizations give us

• From the organization: each voter's name, email address and, if used, voter groups (for example a faculty or region).
• Voter keys are stored as a keyed hash for checking, plus an encrypted copy whose encryption key is kept outside the database. Revealing or printing keys is recorded in the organization's admin log.
• Email delivery: whether each invitation, reminder or announcement was delivered, bounced or marked as spam. We don't track opens or clicks.
• A second voter detail, if the organization uses one (for example a member number or postcode): stored only as a keyed hash, used to check it, and never shown or exported.
• Whether a voter has voted. Ballots are locked in the voter's browser before they're sent and are stored with no voter, no name and no timestamp, so they can't be linked back to anyone. How this works, and its limits, is set out on the security page.
• Suppressions: if a voter's address bounces, marks our email as spam, or unsubscribes from announcements, we keep a keyed hash of the address (not the address) so we don't email it again.
• We don't store voters' IP addresses.

Candidates and observers

• Candidates who submit their own details: their name, email address, statement and photo. They're shown on the ballot once the organization approves them, and kept with the election record.
• Observers invited to watch an election: their account details, and a record of their sign-off in the official report. Observers never see voter details or ballots.

Website visitors

• Bot protection: the sign-up, sign-in, password-reset and contact forms use Cloudflare Turnstile, which looks at technical signals from your browser to tell people from bots.
• The contact form: your name, email address, organization (if given), topic and message, sent to our inbox by email. It isn't stored anywhere else, and we keep it like any other email to us.
• Analytics: marketing pages may use Cloudflare Web Analytics, which doesn't use cookies or track you across sites. No analytics run on the voting page or in the organizer dashboard.
• Your browser stores a few preferences, such as theme and language, on your own device.

How we use it

• To run elections and your account: signing you in, sending invitations, counting votes, producing results.
• To keep the service secure: preventing abuse, spam and attacks on accounts.
• To answer you when you contact us.
• To meet legal obligations, such as keeping payment records.

We don't sell personal data, use it for advertising, or send marketing email to voters. Voters only receive email about elections they're part of.

Who processes data for us

Where data is stored

Our database is in the United States. Pages and requests are served from Cloudflare's network, close to you. Data is encrypted in transit.

How long we keep it

Your rights

You can ask to see, correct, export or delete your personal data, or object to how it's used. Email hello@electionkeeper.com and we'll reply within 30 days. Voters: please ask the organization running your election, which controls that data; we'll help them respond. You may also have the right to complain to a data protection authority where you live.

Age

Organizer accounts are for people aged 18 or over. Voters can be younger, for example in a student election; their data is provided by, and handled for, the organization running it.

Cookies

We use only the cookies needed to keep you signed in and to protect sign-in (for example, during Google sign-in). We don't use advertising or tracking cookies.

Changes to this policy

If we change this policy in a way that matters, we'll email organizers before it takes effect, and update the date at the top.