Tupyo: Secret Group Voting

A group sits in one room and has to decide something together: a new chairperson, a rule, how to spend shared money. Raising hands means everyone sees your choice, and the strong pressure the weak. Paper boxes can be stuffed. An online poll lets the organizer change the answers, and nobody can check.

Tupyo is for that moment. Each person votes on their own phone. Nobody can see how anyone else voted, not even the person who runs the vote, and nobody can quietly change the count. When the vote is over, every person can check on their own phone that the total is honest.

How a vote works
The organizer writes the question and the choices (2 to 12) and opens the room.
Members join by scanning the room's QR code or typing its code. Their names appear on a list everyone can see.
A few members (3, 5 or 7) are chosen to help count. Their phones build one shared counting key between them, so no single person ever holds it.
Each member taps one choice and confirms. The phone seals the choice before it leaves, and gives the voter a receipt that does not show the choice.
The organizer closes the vote. Every voter's phone checks that its own ballot is in the count. The counting members' phones open only the total, never a single ballot.
Every phone then checks the whole count and shows "Checked on this phone". An audit file can be saved and rechecked later by anyone.

What it supports
Pick one choice, yes / no / abstain, or approve several choices.
A quorum and a decision rule, declared before the vote and applied only when the result is shown.
Groups from 3 up to 500 people, in one room, over the same Wi-Fi network or a phone hotspot.
Optional app lock with a PIN or fingerprint, and a read-aloud button for each choice.

It is for any group that must choose together: a cooperative, a union, a village or mosque committee, a residents' association.

Limits, stated plainly
Tupyo is for decisions inside private groups. It is not for government elections and it is not a legal record on its own.
The group checks names by eye. The app does not prove who a person is.
It cannot protect against someone watching your screen, someone forcing you to vote in front of them, a phone with malware, or a vote where the wrong people are in the room. If the required number of counting members work together, they can break ballot privacy.
An organizer can add a fake name before the list is frozen. It shows on the list, but the app cannot stop it.
It was tested with 200 voters on two phones and a computer. A real group that large has not tried it yet.
A phone hotspot often takes only about ten devices, so larger groups need a router, and some routers stop phones from reaching each other. This has not yet been proved in a real group.
This design has not been reviewed by an independent expert yet.

Not in this version: voting over the internet, ranked ballots, changing a vote after casting, voting without a phone.

Names, questions and lists are shared only with the phones in the room. There is no account and no server. Send feedback is in the app's About screen.