MINOMO Public Consultation

Anonymity by construction

The Anonymous Civic Polling system — Public Consultation’s technical name — separates two pieces of information from the very first instant that many systems keep linked: who took part and what they voted for. When a resident votes, the system records, in one register, only the fact that they took part — to prevent double voting — and, in a completely separate register, increments the count for the chosen option. No row connects one to the other. A single resident’s choice never exists as an isolated data point: it only ever exists as a contribution to an aggregate counter.

For as long as the consultation is open, the result stays hidden — even from the Municipality that opened it. That’s not a technical footnote: it’s what prevents the bandwagon effect — the temptation to vote “the way others seem to be voting” instead of saying what you actually think.

At closing, the most important part happens: the participation register — the one that recorded who had voted — is deleted. From that moment, reconstructing who cast which vote isn’t difficult: it’s impossible, because the data no longer exists anywhere in MINOMO’s systems. All that remains is the aggregate counts and the sealed certificate that captures them.

Results anyone can verify

You shouldn’t have to take MINOMO’s word for it: you can check for yourself. When a consultation closes, the system generates a certificate holding the final counts, protected by four independent layers of assurance:

• Ed25519 digital signature. The certificate is signed with a modern, widely standardised cryptographic key (RFC 8032). MINOMO’s public key is published online: anyone can verify the certificate is authentic using common open-source tools, without contacting us.
• Merkle fingerprint. A cryptographic fingerprint (Merkle root, RFC 6962 standard) is computed over the aggregated data, allowing verification of a single figure in the certificate — say, the count for one option — without reconstructing the entire document.
• Bitcoin time anchor. The certificate is “anchored” to the Bitcoin blockchain via the free, open-source OpenTimestamps protocol: this proves the document existed, in exactly that form, before a given Bitcoin block — preventing it from being re-issued later with a forged date.
• Distributed copy on IPFS. Every certificate is also published on IPFS, the decentralised storage network, across at least two independent mirrors. Even if MINOMO shut down one day, the certificate would remain retrievable as long as a single node in the world keeps it.

Every sealed consultation has a public verification page, where anyone — an opposition councillor, a journalist, a curious resident — can recompute the signature and the fingerprint directly in their own browser, without sending any data to MINOMO. For the full technical explanation, see the complete methodology and the related legal terms.

What the Municipality gets

For a municipal administration, Public Consultation is a governing tool, not an image exercise:

• Consultations on real issues — a pedestrianisation scheme, a bylaw, a spending priority — instead of generic surveys with no practical consequence.
• Participation without organising anything. No meeting to call, no room to book, no forms to print: the Municipality writes the question, MINOMO handles collection and counting.
• An aggregate funnel readable at a glance — how many notifications sent, how many opened, how many turned into a vote — useful for gauging how genuinely mobilised residents were on that topic.
• K-anonymity thresholds that protect small numbers. If too few people vote in a given consultation, the result isn’t hidden but published with an explicit note of low participation — so a small handful of people is never at risk of becoming identifiable from the count alone.
• Credibility of the result, in the municipal council and in front of residents alike: a figure that no one — not even the Municipality itself — could have manipulated after the fact, because the certificate proves it.

The limits, stated openly

A serious consultation is also an honest one about its own limits, and we state them openly because they’re part of how the tool should be used.

Public Consultation is not binding: it’s a listening tool, not a referendum, and the Municipality remains free — and accountable — for the final decision. A resident’s location is self-declared at MINOMO sign-up, not verified against civil registry documents: a limitation that makes the result a qualified indication, not a notarised certification of the resident population. And the sample’s representativeness grows with app adoption in that territory: in a municipality where MINOMO has just arrived, those who vote are still a minority of the people who live there; where the app has been established for a while, the sample gets closer and closer to the full population.

We’re not hiding it: it’s part of how we choose to position the tool. A consultation that’s honest about its limits is more credible than one that pretends to have none.

---

Want to see it in action?

Send us your municipality’s name: we’ll show you a real, already-closed and certified consultation, and how to launch your own within the week. (On the operational side, MINOMO Report is on its way too — for civic issue reporting, the natural extension of this same listening principle.)