Every secret ballot has to do two things that pull against each other. It has to know who is allowed to vote, so nobody votes twice. And it has to not know how anyone voted. Most systems that claim both are really doing the first and promising the second.
The promise that is not enough
The usual approach stores a vote with a voter attached, then puts rules around who may look. That is a policy, not a property. Policies are only as good as the people and the database permissions behind them, and if someone can run a query, the secrecy is gone — no matter what the documentation says.
We wanted secrecy that survives someone reading the database.
Two records that never touch
Anonymous Voting keeps two separate records. One is the eligibility ledger: who was invited, and whether they have voted. The organiser can see it, and should — that is how you prove turnout and confirm a quorum. The other is the ballot box: the votes themselves, with nothing linking them back to a person.
Nothing joins the two. Not a shared key, not a timestamp precise enough to line them up. The eligibility ledger can say Sarah voted. The ballot box can say someone chose Sarah's preferred candidate. Neither record, alone or together, can say those are the same fact.
We can prove that you voted. We can never see how.
What you give up
Honesty demands the caveat: this design means we cannot help you audit an individual ballot after the fact, because there is nothing to audit against. If a voter insists their vote was recorded wrongly, we can show them the count included their ballot; we cannot show them which one it was. That is not a limitation we plan to fix. It is the point.