The ballot is secret - and let's talk about the "worst player".
This is the question that stops a committee, and it is a fair one. Here is what the app never shows, what it cannot guarantee, and what the player voted worst sees. None of it is an intention: all of it can be checked in the product.
We say secret, not anonymous
The difference is not wordplay. Secret means nobody in your team sees who wrote which ballot - not the players, not the staff, not us. Anonymous would mean the link exists nowhere, and that would be false: it is in the database. Below is why, and what follows from it. Better said here than discovered later.
What the app never shows
Six things, and none of them is a setting that could be switched off by mistake.
Who wrote which ballot
No screen shows it and no API endpoint returns it. A match retrospective returns the player named and the justification, never the voter. The old application showed the voter's initials to the administrator; that exception went with it.
The order in which ballots were submitted
The reading position is drawn at random the moment the ballot leaves the phone, once and for all. Whoever voted first is not read first, and editing a ballot does not move it in the pile. Without this, the first ballot read would point to the fastest player in the changing room. And in « What was said », the two lists are shuffled separately: the third piece of praise and the third criticism do not come from the same ballot.
Your own name in your list
You do not appear in your own picker, and the server refuses the ballot if your name arrives anyway. Same for naming one person both best and worst: refused, because it would distort both rankings.
A "flop of the match" card
The card you share on WhatsApp can only be the MVP's. This is not an unticked box: the endpoint takes no player name as a parameter and never queries the worst-player ranking. Making a card at someone's expense is impossible, not discouraged.
A season ranking of worst players
It does not exist. Season rankings count scorers, assists and "best player" votes. The negative vote lasts one match and adds up nowhere.
The content of a ballot, for us
Our admin console counts ballots, it does not open them. It shows neither justifications nor voters - that is in its code, not in a policy statement.
What we do not promise you
A product that swears the secret is total is lying to you. Here are the limits, said before you find them.
In a group of twelve, people work it out
A turn of phrase gets recognised, an absence stands out, a language gives someone away. If one player writes in Dutch in a French-speaking team, their ballot is recognised on the first line read out. And when very few ballots are counted, deduction becomes easy: at two or three, the praise and the criticism from the same ballot almost always go back together. No technique fixes that: it is the price of a justification written in your own words, and it is exactly what makes the reading in the clubhouse worth doing.
The link between a ballot and its author exists in the database
Every ballot carries the identifier of its voter. That is what guarantees one vote per player and the right to correct your ballot until the count begins - without the link, both rules collapse. It is exposed by no screen and no API, but it is there: someone with database access could read it, and a court could require it. That is why we write secret, and never anonymous.
The count happens out loud
The app does not show who wrote what; the person who wrote it can say so himself, and anyone in the room can repeat it elsewhere. What happens in the clubhouse is outside what code can reach.
Today, nothing erases itself
A counted match stays readable by the team's members, with no end date. No automatic job erases ballots or justifications. No retention period is set today, and we will not announce one we do not apply.
The player voted worst
This is the player's question, and his parents', and it gets asked less often than the voter's. The full answer.
That same evening
His name is read out loud in the clubhouse, with the justification of whoever named him - 500 characters at most, written by a teammate. Then the match ranking appears: best players on one side, worst on the other, with the number of votes. If the club-house has a screen, the names and the votes appear there too, never the reasons: those are spoken, they are not posted on the wall.
Afterwards
The match stays open in the app. Any member of the team can go back to it and reread the ranking and the justifications, under the heading "What was said". There is no expiry date.
What never leaves the team
Being named goes onto no shared card, enters no season ranking, is visible to no other team in the club, appears on no public page and triggers no notification. Nobody receives "you were voted worst" on their phone.
What he can do, and what he cannot do yet
There is no button in the app to report a justification: the route runs through the team's staff, then through us. The staff can archive a player, which removes them from the votable squad, but does not close the history already written. A player named in a ballot cannot be erased from the database without erasing the match with them - a structural constraint, not a convenience. On request, we anonymise by hand.
The safeguards are in your hands
The app sets the technical frame. The rest is yours to hold, and that is deliberate: nobody at a desk knows your changing room.
Closing the votes
Only the team's staff can do it, and it is irreversible. A match goes from "voting open" to "counting" to "closed", never backwards. The confirmation tells you how many ballots have arrived: read that number. If you close while three players are still on the road, their ballots will not get in, and nobody can reopen.
Leading the reading
You move ballot by ballot and you can go back to reread, but a ballot already read stays counted: the interim ranking never goes backwards. You set the pace and decide when it ends.
The squad
Archiving a player removes them from the votable squad: they receive no vote in the next match. Be clear about the limit: it does not close matches already counted, what they have received stays in the season rankings, and an archived player keeps access to the app as long as they are in the team.
The changing-room rule, said before the first match
This is the safeguard that matters most, and it is not in the code. "We play the match, not the person" fits in one sentence and gets said once, at the start of the season. The terms of use forbid degrading, discriminatory or privacy-invading remarks in justifications - but a text nobody has read has never held anyone back.
What even you cannot do
Knowing who wrote what: no screen gives it to you, and your staff status changes nothing. Deleting a justification already read out. Reopening a closed vote. These are refusals built into the product, not options switched off.
What another team sees of yours
Nothing.
Team by team
A ballot, a squad, a ranking belong to one team. The app never fetches a record and then checks whether you are entitled to it: it loads the record through your membership of the team. If you are not a member, there is nothing to load - and the answer is "it does not exist", not "it is forbidden", so as not to confirm even that the match exists. This holds between two teams of the same club too: the men's third team sees nothing of the women's second.
And the club?
Creating a team gives no rights over the club - otherwise a club's name would be there for the taking by whoever types it first. A club gets its space by claiming it, and the request is checked by hand. Even once open, that space reads no ballot: it has no access to the votes. It sees your players' names only if you delegate the filling in of your match sheets to it, and you can take that back.
How we know
Because it is tested, not because it is written down. A test suite replays the isolation against a real database, and an automated run checks that an account from another club sees nothing of yours. We replay them before every release. This answers a flaw in the old application, where changing a number in the address was enough.
If you sit on the committee and have to decide
Three questions are worth putting to the staff before you start, and none of them is technical: is the changing-room rule said before the first match; who closes the votes and who leads the reading; what happens if a justification goes too far. The product answers the rest.
Also worth reading
A question that is not answered here?
Put it in the form: we answer before we create anything.
The after-match ritual of Belgian hockey clubs.