Security & data hosting

TheJury is built for organisations that can't put member or staff data in overseas tools. Your polls, votes and member details are hosted in Australia. This page explains, in plain terms, where your data lives, what we store, and how voting works. It is not marketing copy.

Poll content, votes and account details are stored on Australian-hosted infrastructure in [Australian region: to confirm]. We run our own database and storage rather than a shared overseas platform.

Two supporting services operate overseas, and we keep them to the minimum: Stripe processes payments, and Google Analytics records aggregate usage (for example, that a poll was created). We do not send poll content, member rolls or individual responses to either of them.

• Poll content: the questions, options and settings you create.
• Votes: the option each response selected, and the running counts.
• Account details: the email and username of the person who owns the account, and the plan they are on.
• For paid accounts: Stripe customer and subscription identifiers (never card numbers).

• Card numbers. Payment details stay with Stripe.
• A voter account for people who only vote. No one needs an account to respond to a poll.
• Message content from any linked Discord server.

A poll can be run as anonymous. When it is, the ballot is recorded through a server-side process that never stores a name or an account against the vote — so the result is anonymous to you, the poll owner, and to your admins. You see the tallies, never who cast which ballot. We also record only the day a vote was cast, not the exact time, so ballots can't be put in order or matched to when someone was seen voting.

To stop the same signed-in person voting twice, the poll stores a one-way hash of their account, salted with a per-poll value and a server secret that no account can read. It can't be turned back into an identity, including by us in normal operation.

One honest limit: if you share an anonymous poll as an open link that guests can use without signing in, there is no reliable way to stop a determined person voting more than once. When one vote per person must be guaranteed, use verified voting below. Anonymity here means anonymous from the poll owner; access by the hosting provider or a database administrator is governed by this security policy, not by cryptographic anonymity.

Verified voting gives each member their own single-use link. Only those links can vote, and each one works once — so you can run an election or a motion with one vote per member. The link is the only key; no account or login is required to use it.

You can see turnout — how many of the issued links have been used — but if the poll is also anonymous, you cannot see how any individual member voted, and their redemption time is never exposed. That combination is the secret ballot: a verifiable turnout with an unlinkable vote.

You generate the member links and hold them, so it's up to you to send each member their own link and keep the list secure. Turnout is measured against the links you created, so for a meaningful result, check it against the links you actually distributed.

We back up the database on a regular schedule, kept within Australia [backup location, frequency and retention: to confirm]. You can delete a poll at any time, which removes its votes. Deleting your account removes your personal data, other than records we are required to keep for legal or accounting reasons, such as billing history.

We handle personal information in line with the Australian Privacy Principles. Our Privacy Policy sets out what we collect, why, and how to access, correct or delete it.

If you have a security question, or you need to report something, email [security contact: to confirm]. We would rather hear about a concern early than late.