Privacy and One-Vote Protection

This poll is designed to reduce duplicate participation while minimizing the personal information retained by the system.

• No readable identity record: the voter ID or passport number and date of birth are combined, normalized, and converted into a keyed SHA-256 hash before storage.
• One vote across both constituencies: the voter hash has a database-wide unique constraint. A matching identity combination cannot vote for a second candidate in Tongatapu 2 or Niua 17.
• Network privacy: IP addresses and browser information are stored only as keyed hashes for rate limiting and risk analysis.
• Integrity signatures: every vote receives an HMAC signature that can be checked by the Python audit tool for unexpected alteration.
• No public identity display: public pages never display voter information.