Roll to
certificate.
Six stages, three seats, one record. This is what happens when an organisation runs an election on PollGuard, and what each person in it sees, from the day the board sets it up to the night it certifies the result.
318Waiting
12Assists
4
Chebet S.Voted 10:42Daudi S.AssistedFrom the roll
to the certificate
Each stage is opened by the board and lands in the same record. Where a step is not in PollGuard yet, it says so: the organisation runs that step by its own process today, and PollGuard support for it is being built.
- Set up the election
Positions, the voting window and the channels: the app, station tablets, or both.
- The roll
The organisation’s own register of who may vote, imported by the board.
- Members verify
A document and a live selfie, then a named reviewer’s decision.
- The ballot
On the Android app or a station tablet. A receipt for each position.
- Close and count
The board closes the ballot, and only then does the official count run.
- Certify and export
The board certifies. Results by position and candidate export that night.
What each seat sees, stage by stage
In PollGuard todayBeing built| SEAT | 01 Set up | 02 Roll | 03 Verify | 04 Ballot | 05 Close | 06 Certify |
|---|---|---|---|---|---|---|
| MemberAndroid app | Nothing to do yet | Sees their own eligibility | Document and live selfie, once | Re-checks, votes, gets a receipt per position | Nothing to do | Checks the receipt: recorded, never the choice |
| Returning officerStation tablet | Appointed to a station | — | Assists at the tablet, and is named | Sees who has voted, never how | Station close and log | Station declaration |
| Electoral boardCommand centre | Positions, window, channels, officers | Imports the roll Freezes it on a stated date | Named reviewers approve or decline each one | Opens and watches; candidate figures sealed on the wall | Closes the ballot; the count runs | Certifies; exports results |
| The recordWritten automatically | Election created and changed | Roll imports and edits | Submissions and reviewers’ decisions | The opening; votes cast, never the choice | The closing | Every other create, update or delete |
Who sees what,
and what nobody sees
Ballot secrecy on PollGuard is operational: it rests on who is allowed to see what. Each seat has its own screen and its own limits.
The member
Verifies once, votes from anywhere during the window, and checks the receipt afterwards.
- Their own eligibility and verification status
- The candidates, in ballot order
- Every receipt they hold
- Anyone else’s ballot or receipt
The returning officer
Runs a polling station for members who vote in person, and helps those who need it.
- The station queue: voted, waiting, assists
- Who has voted, and when
- Their own name on every assist
- How anyone voted
The electoral board
Opens, watches, closes and certifies, on the wall in the tally room, on a laptop, or in the officials’ app.
- Turnout, centres and the review queue, live
- The official count, once the ballot is closed
- Who changed what, and when
- Any candidate figure on the wall while voting is open
- The ballot is linked to the voter’s account in the same database.
- Running counts are visible to organisation admins before the close, outside the wall.
- Reads are not logged.
Identity and choice held apart, totals hidden until the close, and every read logged. These lines change on the day each one ships.
One election,
from setup to certificate
A sample branch election: 4,850 members on the roll, three positions, fourteen polling centres, voting on a Saturday from 06:00 to 17:00. The names, times and figures are illustrative; the steps are the real ones.
- 3 wks beforeThe board sets up the election. Chair, Treasurer and Secretary; Saturday 06:00 to 17:00; the app and 14 station tablets; officers appointed to each centre.Board
- 2 wks beforeThe roll is imported: 4,850 members. Each import and edit is written to the record. A formal freeze on a stated date is being built; until then the board fixes the roll by its own process.BoardFreeze being built
- The week beforeMembers verify on the app. Each verification waits for a named reviewer, who decides it under their own name; borderline matches get the closest look. The board previews and seals the ballot.MemberBoard
- 05:30Station tablets come online. Station and device changes are written to the record.Officer
- 06:00The board opens the ballot. The opening is written to the record. At 06:04 the first member votes on the app and a receipt comes back for each position.BoardMember
- 10:42At station 014, an officer assists. Daudi Sample has no phone with him. Grace Sample checks him in at the tablet, and her name goes on the check. He votes at the same tablet; she sees that he voted, never how.OfficerMember
- 14:15The wall reads 1,826 voted, 37.6% turnout. Candidates stay in ballot order with no count, share or leader.Board
- 17:00The board closes the ballot. The closing is written to the record. At 17:01 the official count runs, for the first time. Station close, log and declaration on the tablet are being built.BoardStation close being built
- 19:05The board certifies. At 19:12 the export is ready. Results by position and candidate, today. The certified results PDF, results by station, turnout by hour, the verification summary and the record are being built.Board5 of 6 files being built
- The next dayMembers check their receipts. Signed in, with the election ID: “Recorded”, never the choice.Member
Proof it was recorded.
Never the choice.
Every ballot returns a receipt for each position voted: a 64-character code of the letters a to f and numbers. It lets the member check their ballot is on record, and tells nobody, including the member, how they voted.
The code cannot be turned back into the ballot. The ballot itself is stored encrypted, and the tally runs after the close.
on their PollGuard voter account
the long code in the election’s address
one per position
The board’s view,
on one wall
Turnout, centres and the clock to the close, live, in the tally room, on a laptop or in the officials’ app. While voting is open, the wall shows no candidate figure anywhere.
Sealed while voting
Candidates appear in ballot order, with no count, share or leader on the wall until the board closes the ballot.
Never a single voter
Activity is released in batches of three or more, and small counties are grouped, so no ballot can be timed to a person.
Honest when it fails
Every panel names its source and time. A read that fails says so; it is never drawn as zero.
Said plainly
The wall is sealed, but organisation admins can see running counts elsewhere before the close today. Hiding them is being built.
Who changed what,
and when
Every stage writes to the same record, with the person and the time. When an aspirant or a member asks what happened, the board answers with the record, not with memory.
- R1Roll imports and edits
- R2Verification submissions and reviewers’ decisions
- R3Election changes, including each opening and closing
- R4Station and device changes, and votes cast, never the choice
- R5Every other create, update or delete
- —Not written yet: reads, and exports with a reason typed by the person.
- R1 · 26 Sep 2026, 16:00 EATMembers imported · 4,850 rowsby chair@sample-branch.example
- R2 · 6 Oct 2026, 09:31 EATVerification approved · borderline matchby Wanjiku Sample, reviewer · “Back photo and selfie agree.”
- R3 · 10 Oct 2026, 06:00 EATBallot openedby the electoral board chair
- R4 · 10 Oct 2026, 10:42 EATOfficer-assisted check, then vote cast · station 014checked by Grace Sample · choice not recorded here
- R3 · 10 Oct 2026, 17:00 EATBallot closed · count startedby the electoral board chair
Two ways to cast a ballot.
Only two.
The board chooses the app, station tablets, or both, when it sets up the election. Both run the same verification and the same ballot, and both return receipts to the same record.
The PollGuard Android app
Installed directly from pollguard.africa. The member verifies, reads the candidates, votes from anywhere during the window and keeps every receipt.
- Face re-check or the phone’s own biometric before casting
- Every receipt kept on the Receipts page
- No iPhone app
A station tablet
For members without a phone, or who prefer to vote in person. A returning officer runs the station and assists where needed.
- Same checks; every assist carries the officer’s name
- The officer sees who has voted, never how
- How receipts are handed out at a station is set by the board
Straight answers
Can the board see results while voting is open?
Not on the wall: it shows no candidate figure until the close. Said plainly, organisation admins can see running counts elsewhere today; hiding them is being built.
Can a member vote twice?
No. A second ballot from the same member for the same position is refused by the database.
Does the receipt show how I voted?
No. The check says “Recorded” and nothing more. Nobody can see the choice through it.
Why do I have more than one code?
There is one receipt for each position you voted on.
I voted at a station. Where is my receipt?
Ask your electoral board how receipts were handed out at your station.
My receipt says “Not found”.
Check for a mistyped character and the right election ID. If it still fails, tell your electoral board before any appeal window closes.
Can members vote by SMS or on the web?
No. Only on the Android app or a station tablet.
Do you check members against a government register?
No. Eligibility comes from your own roll. How identity checks work
Is PollGuard linked to the IEBC?
No. PollGuard is independent. Only the IEBC declares national election results.
Run your next election on PollGuard.
Practise the whole thing, roll to certificate, in the free sandbox: up to 200 voters and one practice election. Live elections run on an annual licence.