Votech is the polling and voting platform in Tools. The new Votech runtime is separate from the historical BBVote archive.
/votech is the public Votech entry point for discovery and participation./me/votech is the signed-in owner workspace for personal polls and Votech configuration./admin/votech is the protected Votech platform area for global administration and moderation. Global Tools administrators have access, and selected Votech responsibilities can be delegated with granular Votech permissions./api/votech is the canonical Votech API root.Votech API URLs are not versioned. Clients should use /api/votech/...; URL prefixes such as /api/votech/v1 or /api/votech/v2 are not part of the contract.
Signed-in users can now manage their Votech content from /me/votech. The owner workspace includes polls, projects, communities, categories and reusable or poll-local candidate objects.
Poll editing supports:
Questions, options and poll-local candidates can be reordered from the editor. Poll duplication creates a new draft and copies the editor-owned structure, including questions, options, access rules and poll-local candidates. Vote history is never duplicated.
The editor saves mutating changes asynchronously instead of depending on normal form-post-and-redirect flows. Backend ownership checks remain authoritative regardless of which controls are visible in the page. A user cannot read or mutate another user's Votech editor resources by guessing their numeric IDs.
Draft polls can be deleted while they have no durable runtime history. Once runtime history such as votes, comments or abuse/security records depends on a poll, the owner must unpublish it instead of deleting that history.
Votech owners have a media section in the owner workspace, and Votech administrators have a protected media-management surface. Upload, replace, delete and reorder actions are handled asynchronously while backend authorization remains authoritative.
Votech media can be attached to polls, questions, options, candidates, projects and communities. Supported purposes include poll/project/community covers, question images, option images, candidate images, artwork and permitted attachments. Image uploads automatically receive bounded thumbnail and medium variants for Votech use.
Uploads are stored inside Votech itself rather than as filesystem files. Metadata such as owner, target, purpose, filename, MIME type, dimensions, byte size, order and SHA-256 checksum is kept separately from the binary payload so ordinary Votech lists do not load media bytes. Binary content is served only after the relevant owner or administrator authorization check and is returned with the stored MIME type, private caching headers, checksum-based ETag and nosniff protection.
The server inspects the uploaded payload, enforces the configured size and MIME policy and decodes image content before accepting image-only purposes. Duplicate content for the same owner/target/purpose can reuse the existing stored original when its checksum is valid. Replacing an original regenerates its variants; deleting an original removes its generated variants and stored payloads together. Successful lifecycle operations are auditable.
Published public polls are discoverable from /votech. Unlisted polls are available through their direct Votech page without appearing in discovery, while private polls remain unavailable unless the current account or invitation satisfies the poll's access rules. Scheduled polls can be viewed before they open, but voting is rejected until the opening time; closed or expired polls no longer accept new votes.
The hosted voting page establishes a short-lived participation session, obtains a short-lived one-time challenge and then submits the answers. The browser flow uses the canonical unversioned Votech endpoints under /api/votech/polls/{poll}/... for session creation, challenge creation, vote submission and result retrieval. Votech binds a session to the selected poll and, when present, the resolved identity, origin and public site identifier. IP and user-agent information is retained only as privacy-conscious hash signals for abuse detection.
Participation access is always checked by the backend. Anonymous voters are accepted only when the poll rules permit anonymous participation; account, verification, provider, group and invitation requirements continue to use the server-resolved identity/access layer. A browser cannot grant itself access by changing hidden controls or request fields.
Each accepted vote is stored as an immutable vote event with separate answer rows. One-vote policies use an atomic deduplication key, while the one-time challenge is consumed transactionally so retries, replayed requests and concurrent duplicate submissions cannot create another vote. Repeating a completed submission returns the already accepted vote rather than writing another event.
The public voting runtime supports single choice, multiple choice, yes/no, rating and named 1-5/1-10 rating variants, ranking, head-to-head, bracket-ready, quiz, prediction, media-choice and open-text questions as defined by the poll editor. Ranking results use ordered scores, rating results use numeric aggregation, and ordinary choice results expose counts and percentages.
Result visibility follows the poll's configured policy. live results are available while the poll is open, after_vote becomes visible after that participant has a valid accepted vote, and after_close remains hidden until the poll closes. owner_only and hidden do not expose public aggregates. Invalidated votes remain in the immutable audit/history domain but are excluded from result aggregation.
Votech resolves participation identity on the server. A poll can require one or more supported identity properties without trusting identity claims supplied by browser code.
Supported participation requirements include:
A linked Google, Facebook or vBulletin identity is used as an account property. Votech does not expose upstream OAuth access tokens, refresh tokens, passwords or provider credentials to Votech clients, and Votech does not copy those credentials into its voter identity records. Stored Votech identity references use stable privacy-conscious fingerprints instead of exposing raw provider subject identifiers.
Poll access decisions are enforced by the backend. Hiding or changing a control in the GUI does not grant participation or administration rights.
The owner workspace requires a Tools account. Poll ownership is checked independently for owner operations. Votech administration supports granular management permissions for polls, votes, security, moderation, legacy handling and platform settings in addition to the global Votech management permission. Global Tools administrators continue to pass these checks.
External/client API endpoints enforce their own authentication, ownership and scope requirements as functionality is added. Web permissions and API token scopes are separate controls.
Historical BBVote material remains available separately through the BBVote archive. The archive is read-only and is not the storage or runtime used by new Votech polls.