Put it to a vote that counts.
Anyone can gather signatures. VoteSavy gathers votes from people proven to be voters in the constituency it affects, on a ballot that cannot be traced back to any of them.
- One voter, one ballotDigiLocker consent, face match.
- Blind-signedWe sign a ballot we never see.
- Mixed before countingNo live tally can identify you.
Start a petition
One moment...
Open right now
See all petitionsLoading...
How a vote here works
Three steps, in this order. The first proves you are a voter. The other two make sure nobody, including us, can tell how you voted.
- 1Verify once
Consent to share your Aadhaar record via DigiLocker, then a face match against your Aadhaar photo. Knowing someone else's Aadhaar number is not enough to vote as them.
- 2Collect a ballot nobody can trace
Your browser scrambles a token before we sign it. We put our signature on something we cannot read, so the ballot that comes back cannot be matched to the person who asked for it.
- 3Vote, and stay unreadable
Votes are released from a mixing pool after a delay, and thin districts are rolled up before any result is shown. Nothing links a choice back to a voter.
Verify with Aadhaar
Do this once. After that, every petition you are eligible for is a single click. It takes about a minute and you will need:
- DigiLocker access, to consent to sharing your Aadhaar record.
- A quick selfie, matched against your Aadhaar photo and then discarded.
Step 1 of 3 — Start verification
Verify with Aadhaar
You'll consent to share your Aadhaar record via DigiLocker, then take a quick selfie to confirm it's really you.
We never see your Aadhaar number. DigiLocker shares a verified record with us once, we reduce it to a fingerprint and a coarse age/gender bucket, and discard the rest.
Why your vote cannot be traced
When you ask for a ballot, your browser blinds it first -- it multiplies the ballot by a secret only you hold. We sign that blinded value without ever seeing what is underneath, and your browser divides the secret back out. What you are left with is our valid signature on a ballot we have never seen.
So the server knows you collected a ballot. It does not know, and cannot work out, which ballot is yours or what it says. That is not a policy we promise to keep. It is arithmetic.
- We sign what we cannot readYour browser blinds the ballot before it reaches us. Our signature lands on a value we have never seen.
- Results lag on purposeVotes sit in a mixing pool for up to an hour. A live counter would reveal who had just voted.
- Small groups are never exposedConstituencies with too few votes are rolled up before any result is published.
Something worth putting to a vote?
Write the case, list the arguments either way, and let verified voters in your constituency settle it.