Scan with a phone camera to open this seat's ballot. Each code works once.
The chair opens a session and sends one private link to each committee member. Members open their link on their own device.
Candidate names, institutions, career stages, gender, metrics and key publications are
typed into the chair's browser and held there. Before the list is sent to committee
members it is encrypted in that browser with AES-256-GCM. The key travels to members
inside their seat link, in the part after the #, which browsers never
transmit to a server. The server therefore holds ciphertext it has no key for.
These sit in two separate tables with no column joining them, which is why no one — including the chair, and including whoever operates the server — can determine how any member voted. That is a property of the schema, not a promise.
On Cloudflare Workers, in a storage object pinned to the European Union, so processing and storage stay in the region. The object's random identifier is logged outside that region for billing and diagnostics; it contains no personal data.
Until the chair presses "Delete all session data", which erases everything for that session immediately. Automatic deletion once voting ends is not yet implemented and is the next change planned. The chair's own working copy lives in the browser tab and disappears when that tab is closed.
Nothing is transmitted to AKC's open dataset unless a chair explicitly chooses to contribute, and the exact record is shown before it is sent. It contains coarse buckets only — no names, no institutions, no exact counts, no dates finer than a quarter, and no reference to the session it came from. It is anonymous rather than pseudonymous, which is why it can be published openly. Ticking the opt-out box when opening a session removes the option altogether.
No cookies, no analytics, no tracking, no advertising, no third-party scripts, and no accounts. Candidate data is never used to train anything.
The committee running the selection is the controller of its candidates' data and is responsible for informing them, for its own legal basis, and for retention. AKC supplies the software and operates the open dataset.