Privacy Policy

RosaVote runs elections without keeping a file on you. This page says what the system stores, what it never stores, and who touches data on the way through. It's short because the honest answer is short.

Effective August 4, 2026. Contact: support@rosavote.org.

Who does what

RosaVote is an independent open-source project (AGPL-3.0) operated by Walker Green. It is not affiliated with DSA or any organization that votes here. The organization running an election supplies the voter roll and owns it. RosaVote hosts and processes that roll for one purpose: running the election. If an organization runs its own copy of the software instead, that organization is the data controller for its deployment.

What we store

Less than you'd guess. A one-time voting code for each eligible voter, stored only as a SHA-256 hash: we can check a code, we can't recover one. Attached to that hash: a member ID number, a chapter, and a vote weight. That's the whole voter record.

Ballots depend on the section type, and the ballot itself discloses which is which above Question 1. Secret-ballot questions (such as convention delegates) are stored with no name and no chapter. Named sections store your answers with your member ID and chapter, exactly as disclosed. Provisional ballots additionally hold the contact details you provide, sealed until adjudication. Every administrative action lands in an append-only audit log with the admin's name.

What we don't store

No voter names, emails, phone numbers, or addresses in the voter records (the one exception is sealed provisional contact info, above). When an organization sends ballot links by email or text, the contact info passes through at send time and is not kept. Those sends go through Mailgun, Twilio, or Scale to Win, depending on the organization's setup. Each has its own privacy policy worth reading.

Who can see what

Named answers: election administrators and your own chapter's admins. Secret-ballot rankings: no one by name. Administrators can trace a specific record only for troubleshooting, under audit. Each organization decides its own publication, and secret-ballot rankings are never published by name.

Ballot secrecy and verification

Your receipt code confirms your ballot was stored (/p/<poll>/verify) without revealing its content. Anyone can download the anonymized ballots and re-run the tally. That's the point of the project: you shouldn't have to trust us, and the data model is built so you don't have to.

Where it runs

Google Cloud, in the United States, in RosaVote's own project. Like every web server, ours writes standard request logs (IP address, browser type, timestamps). Backups are point-in-time recovery with a 7-day window; nothing lives in backups longer than that.

Selling and sharing

We don't sell data. We don't share it. No ads, no tracking pixels, no third-party analytics.

Retention and deletion

Ballot records are kept as the organization's permanent election record, and voided ballots are flagged rather than silently deleted. When the organization deletes an election, or asks us to, its data goes with it; backups age out within 7 days. If you're a voter with a question about your data, start with the organization that ran your election, since they own the roll. You can also write support@rosavote.org.

The demo

The demo deployment uses publicly available data. Sample ballots use historical figures and published convention materials, and living people's surnames are abbreviated.

← Back to RosaVote