SureVote Privacy Policy

SureVote records ballot submissions and provides a receipt for each accepted ballot.

The receipt code (e.g. SV-2026-000001) confirms that a ballot was accepted.

To authenticate voters and guarantee 1-person-1-vote compliance, SureVote processes the following categories of data:

• Account & Institutional Identity: Full name, institutional university email address, assigned personal Voter Code (e.g. VC-2026-XXXX), username, and account status.
• Authentication Credentials: Passwords are cryptographically hashed using standard one-way algorithms (bcrypt with automated cost scaling). Plaintext passwords are never stored or logged.
• Participation Records: The election ID, submission timestamp, ballot reference token, and registration status.
• Support Reports: If you request help, we store your contact email, issue category, subject, message, status, and administrator reply. Signed-in reports are linked to your account and visible to you and administrators. Guest reports are accessible to administrators. Do not submit passwords, voter codes, receipts, or ballot choices. Reports are retained until removed by the site operator; request removal through your institution’s election administrator.
• Security & Audit Logs: Client IP address, browser User-Agent string, and security-relevant event timestamps (such as login attempts, password updates, and session terminations) to protect against brute-force attacks and session hijacking.
• Site Traffic: SureVote records pages opened and links clicked, the time, a random browser-session identifier, IP address, device type, browser, and operating system. When you are signed in, events are associated with your account. Administrators can inspect these records to understand usage and investigate problems. URL query strings, form entries, ballot choices, and receipt codes are not recorded in traffic events.

SureVote offers single-sign-on (SSO) via Google OAuth 2.0 to simplify authentication for university students and staff.

Google Limited Use Compliance:

SureVote's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• We only use Google data to authenticate your account and provision your voter credentials.
• We do not transfer or disclose Google user data to external third parties.
• We do not use Google user data to serve advertisements, train artificial intelligence models, or build consumer profiles.
• Human staff cannot view your Google password, tokens, or external Google Drive/Gmail contents.

All data collected by SureVote is used exclusively for legitimate civic election operations:

1. Voter Authentication: Confirming your identity before presenting the election ballot.
2. Enforcing One-Person-One-Vote: Ensuring each eligible voter can submit only one ballot per election.
3. Receipt Issuance & Verification: Providing you with verifiable confirmation of participation.
4. Security & Abuse Prevention: Detecting brute-force login attempts, cross-site request forgery (CSRF), and unauthorized admin access.
5. Auditing & Election Certification: Producing anonymized turnout statistics for election inspectors and committees.
6. Site Operations: Understanding navigation through the site and diagnosing broken or confusing pages and links.

We do not sell, rent, license, or monetize your personal information. Data is never shared with commercial brokers, advertising networks, or third-party marketing services. Information is shared only under strict institutional necessity:

• University Election Committee: Certified aggregate tallies and voter participation lists (confirming turnout without candidate link).
• Legal & Compliance Obligations: In response to official university disciplinary proceedings or court orders concerning election fraud.

SureVote employs state-of-the-art technical security controls to safeguard data integrity:

Election records and audit trails are retained in accordance with university record-retention policies (typically 1 academic year following election certification to allow for official appeals and audits).

Your Rights: You have the right to inspect your account registration status, review your personal participation history in your voter profile, and request account de-linking from Google OAuth.

If you have questions regarding this Privacy Policy or wish to inquire about your voter data, please contact the election administrator: