Privacy & anonymity

This site exists so that people who cannot vote can say how they would, without that ever becoming attributable to them. Here is exactly what is stored, what is not, and what this site has committed never to build. If a claim on this page stops being true, the site should be taken down.

What a vote stores

• Nationality: kept as a country only for Berlin’s largest communities; everyone else is recorded as a world region, before it is written. A country crossed with a Bezirk can identify a person, and for some respondents that could carry immigration consequences.
• Party (or “would not vote” / “prefer not to say”), and Bezirk, never a postcode, never an address.
• Age as a band only (e.g. 25–34). The exact number is reduced to the band before anything is written, and the database refuses an exact age.
• The hour the vote arrived: the minutes and seconds are discarded before the row is written, so the database never holds a precise time.
• A random identifier that encodes nothing, including no timestamp.
• Whether the vote was verified by email: a yes/no flag only. The address itself is never on the vote.
• Links shared per group or poster carry a short id. The site counts visits, votes and email-confirmed votes per id and day; the id is never written on a vote and can never be joined to a party.
• Which pages and vote steps are used is counted per step, link id and day, as numbers only: no identifier, no cookie, no IP address, no path beyond a fixed page name. Browsers that send Do Not Track or Global Privacy Control are not counted.

What a vote does not store

• No IP address, not even hashed. A hashed IPv4 address can be reversed by brute force in seconds, so hashing would be a promise that could not be kept.
• No device identifier, cookie value, browser fingerprint or session, nothing that could link two votes to one person.
• No email address. If you verify an email, only a keyed hash used to refuse duplicates is kept, and it expires after 30 days.
• No location finer than the Bezirk, and no record of which poster you scanned.
• No free-text field of any kind.

The party match

Showing your match stores your twelve answers and the best-matching party, with the hour. Nothing else: no identifier, no cookie, no connection to any vote. Only aggregates are published from it, under the same thresholds as the poll.

How repeat voting is stopped without tracking you

A bot check runs when you submit, each internet connection can submit a limited number of votes per day (many people share one connection), and a random cookie set by the vote itself allows one vote per browser per day. The connection counter lives in a separate short-lived store keyed by a hash that cannot be reversed, expires after 24 hours and is never written to the database that holds votes. The browser counter is the hash of a random number that says nothing about a person or a connection; it is kept for 24 hours and then deleted. The connection limit is deliberately not one-per-connection: shared flats, hostels and public wifi are the norm for the people this site is for.

How email verification works

Verification is optional; unverified votes count the same. After voting you can confirm an email address. A link is sent, and the address goes on the results notification list described below and nowhere else, never onto the vote. The secret in the link is only ever handled in your browser and is stored only as a hash which, for at most 48 hours, points at your vote. For 24 hours after voting the browser also keeps a random claim in a cookie, so the address can be added later from the same browser; it is deleted as soon as it is used. Clicking it sets a yes/no “verified” flag on that vote, adds one to a counter, and destroys the ticket in the same step (while confirmation links are not yet being sent, leaving a valid, non-disposable, not-yet-used address sets the flag directly and the ticket is destroyed at once); from then on nothing in the database connects any address to any vote. The honest limit: someone holding both your inbox and a full copy of the database within those 48 hours could tell which vote is yours; afterwards, only that you took part. Verification proves an inbox exists, not that a person is unique.

The results notification list

If you leave an email address on the results page, it is stored in clear (it has to be, to send the mail) in a separate table that holds nothing but the address, your language and the day. It has no link to any vote and is unreachable from the browser. It is used for one mail with the results and the comparison with the real election, and deleted afterwards. Write to hello@everyberliner.com to be removed earlier.

How results are published

Only a fixed set of summary tables, never a combination of them. A table appears from 200 responses. The citywide party split lists every party as a share of the vote and publishes no counts at all; because a share can be turned back into a count by anyone who estimates the total, small parties there are less protected than they were before 24 September 2026, which was a deliberate choice. In every table that crosses party with Bezirk or with region of nationality, cells under 25 are still merged into “other”, with a second cell merged when needed, because those combinations are the ones that could single out a person. Those counts are rounded. Results are a daily snapshot, not a live counter. There is no way to query the underlying rows through the public site, including for the site’s operator through the public interface.

What will never be built

• No receipt and no “look up my vote”. A receipt is a coercion tool and a shareable de-anonymiser; real elections forbid them for the same reason.
• No export of individual responses, ever, however “open” it would look.
• No attribution of party choice to a poster location or code batch.
• No live ticker, and no table with an hour dimension.
• No third-party analytics on the voting pages, and no third-party map tiles: the street map on the area page is served from this site, so no map provider learns which neighbourhood you look at.

Discovery lookups

Looking up your Wahlkreis or candidates happens entirely in your browser after one download of the candidate list. Your choices there are not sent anywhere and have no connection to your vote.

Where the data lives

On servers in Frankfurt (EU). Email is sent through a provider set to EU processing with click- and open-tracking disabled, because both would log who clicked when. Because a vote holds no identifier, the dataset is designed to be anonymous rather than pseudonymous: there is nothing to hand over that points at a person.