What is guaranteed, how you can check it yourself, and what is deliberately not claimed.
Nobody can change a vote, including us
A cast vote is written once and never updated or deleted — the database has no rule that permits either, so there is no administrator action, no support request and no query that can alter one. Corrections are made by saying what was wrong, in public, beside the result.
Nobody can see how you voted, including us
A vote row carries no account on it at all. There is no column to join back to a person, so "who voted for what" is not a question this database can be asked — not by an administrator, not by the person who opened the vote, not by the owner of a company room, and not by anyone with a copy of the data.
No count exists before the clock runs out
Not hidden — refused. The result table will not answer a request made before the closing time, and the count is computed once, on the server, at the close. A phone can only ever display a result; nothing in the app is capable of calculating one.
You can verify your own vote was included
Each vote keeps a chain: every sealed vote carries a fingerprint of the one before it, so removing, inserting or reordering a single vote breaks every link after it. Your receipt proves your vote is in the chain without revealing what it was. The Receipt control on any result checks the chain in front of you.
The rules live in the database, not in the app
Every guarantee above is enforced by the server. That is deliberate and it is the whole design: a rule enforced by the app is a rule that anyone who can write a script gets to skip, and holding an app is not the only way to reach a server.
⚠ What is NOT claimed
Anonymity here is that nobody is shown your name — it is not a cryptographic guarantee that nobody could ever link a vote to a person given enough other information. A vote is unlinked in the data rather than mathematically unlinkable, and this app is not built to protect someone whose safety depends on a vote never being traced. Saying so is part of the promise: overstating this is how people get hurt trusting a product.
⚠ And what is still a single point of failure
One person runs this. Reports are read by one person, the database is administered by one person, and there is no second pair of eyes on an emergency at three in the morning. That is a real limitation, it is not fixed by an assurance, and it changes on this page the day it changes in fact.
Found a hole? Tell us, and nothing bad happens to you
Reporting a genuine security flaw in good faith is welcome and will never be met with legal action. Send it privately rather than publishing it, give us a reasonable window to fix it, and do not access, alter or keep anyone else's data while proving it — a demonstration on your own account is always enough. Use the Report control, or the contact address in the Impressum, with SECURITY in the subject.
There is no cash bounty, and here is the honest reason
A bounty that cannot be paid reliably is worse than none: it attracts volume, sets an expectation, and turns a goodwill report into an invoice dispute. What is offered instead is a real answer from the person who wrote the code, a fix, and public credit if you want it. This changes when there is a company to pay from.