Privacy Policy
Last updated: May 25, 2026
BallotFlow is a voting platform at ballotflow.io. This page covers what we collect, what we do with it, and how to get in touch.
Two kinds of users
Account holders create and administer elections. We have your email address (for sign-in) and the elections and organizations you manage.
Voters cast ballots. If an administrator invited you by email, we have your address from them and the ballot you submitted. If you voted through an open link without signing in, we have neither your email nor any way to connect the ballot to you.
What we collect
Account holders: email address, organization membership, role, and server logs (IP, user-agent, timestamp).
Email-invitation voters: email address (from the administrator) and the ballot.
Open-link voters: a random browser cookie
called bf_open_voter that blocks the same browser
from voting twice in one election. No personal data in it.
Your IP address is used for rate limiting and appears in our
web server logs. It is not stored with your ballot.
Marketing site and playground visitors: server logs. The playground runs entirely in memory and writes nothing to our database.
What we use it for
Authenticating you, sending invitations, displaying your elections, counting ballots, investigating abuse. That is the full list.
Sub-processors
Three services see your data because we need them to operate. Postmark sends transactional email and receives the recipient address and message contents. DigitalOcean hosts the servers and database. Cloudflare provides DNS and CDN.
We do not sell, rent, or share data with anyone else. We disclose only under legal compulsion or to prevent harm.
Cookies
A session cookie for signed-in account holders, and bf_open_voter for open-link voters. Both are HttpOnly, Secure,
SameSite=Lax. That is the full list.
Retention and anonymization
During voting, each ballot is tied to whoever cast it: the voter record for email invitations, or a hash of the browser cookie or account for open links. That stops double voting and lets voters change their ballot. The dashboard shows administrators who has voted, not how.
In anonymous elections, closing the vote deletes that tie, along with each ballot's submission time and the order ballots arrived in. After close, the database cannot match a ballot to a voter, for us or anyone else.
The limits: while voting is open, anyone with access to the database, including us, could see which ballot is whose. Database backups are taken daily and kept for 14 days, so a backup made during voting holds that tie until it is deleted.
Audit logs persist after close so election results remain verifiable. For anonymous elections, a ballot entry records only that a ballot was cast and when: no voter, IP address or browser. For other elections it includes the voter record, IP address and browser. We keep audit logs for the lifetime of the platform.
Deleted organizations are soft-deleted and hard-purged after 90 days. Web server logs (IP address, time, page requested) are kept for 14 days.
Your rights
Email [email protected] to access, correct, export, or delete your data. We respond within the deadlines GDPR, UK GDPR, and CCPA require where they apply.
Security
TLS in transit, encryption at rest. Magic-link tokens are short-lived and single-use. Sessions invalidate on sign-out. If we have a security incident, we notify affected users without undue delay.
Children
Not for users under 13 (under 16 in the EEA and UK). If a child has signed up, email us and we will delete the account.
Changes
We update this page when our practices change and notify account holders by email for material changes.