To prevent duplicate voting and abuse while you have an open mechanic like a Poll, Scoring, Votes, or Story, Flowics uses two independent protection mechanisms to reduce fraudulent voting and automated abuse.
How Flowics prevents voting abuse
Mechanism | What it protects against |
Local Storage | The same browser session voting repeatedly. |
IP Blocking | Abusive traffic and excessive automated requests. |
Both mechanisms work together to reduce repeated voting while keeping mechanics anonymous (no login required).
Why anonymous voting relies on these mechanisms
Flowics mechanics are designed to support anonymous participation. Since users are not required to authenticate before voting, abuse prevention relies on browser sessions and network-level protections instead of user accounts. This is the reason both mechanisms below exist.
1. Local Storage
As votes in mechanics are anonymous, the registration of votes happens at the browser session level through web local storage (a mechanism similar to cookies). If the mechanic is configured for voting Only once or Once a day, users generally won't be able to vote again unless a new browser session is created (for example, by clearing browser storage or using private browsing).
Be aware
When reviewing metrics and looking at the unique users count, keep in mind these values actually refer to unique browser sessions, not unique people.
What happens in incognito / private browsing?
Local storage and cookies are automatically deleted every time an incognito tab is opened (Safari) or a new incognito window is opened (Chrome). This creates a new browser session, allowing the user to vote again.
Known limitation on iOS
On iOS devices, users may sometimes be able to vote more than once even when the mechanic is set to Only once or Once a day — even outside of incognito/private mode.
Why can this happen?
Apple requires all browsers on iOS to use the WebKit rendering engine ↓ WebKit includes Apple's privacy protections (such as Intelligent Tracking Prevention) ↓ These privacy protections may clear browser storage earlier than expected, under certain conditions ↓ A new browser session is effectively created ↓ The user may be able to vote again
This is a platform-level privacy behavior controlled by Apple, not a Flowics bug — and not something Flowics or the mechanic's configuration can override. It affects all browsers on iOS (Chrome included), since Apple requires all browsers on iOS to use the WebKit rendering engine.
In practice, this means the "unique browser session" behind Only once / Once a day is not always as durable on iOS as it is on Android or desktop.
IP Blocking, described below, remains active as an additional layer of protection regardless of platform.
2. IP Blocking
In addition to local storage restrictions, Flowics has another mechanism to prevent abuse. If a user submits more than 30 requests in a 10-minute time window, requests from that IP address are ignored for 1 hour.
Many requests from same IP ↓ IP detection ↓ Threshold reached (30 requests / 10 min) ↓ Requests from that IP ignored for 1 hour ↓ Further votes from that IP are not counted
Once the threshold is reached, additional requests from that IP address are silently ignored for one hour. From the user's perspective, interactions continue normally, but those additional votes are not counted.
To continuously improve abuse prevention, Flowics may adjust the thresholds used by its abuse detection mechanisms over time. For that reason, the specific request limits described here may change without prior notice.
Frequently Asked Questions
Can users vote again after clearing browser storage?
Yes. Clearing browser storage creates a new browser session.
Does incognito/private mode bypass "Only once"?
Yes. Private browsing starts a new browser session every time it's opened.
Why can iOS users sometimes vote again?
Because Apple's privacy protections (built into WebKit) may clear browser storage automatically, even outside of private browsing.
Can Flowics disable this behavior on iOS?
No. This behavior is controlled by Apple's browser engine and applies system-wide, not just to Flowics mechanics.
Does IP blocking still work on iOS?
Yes. IP blocking is independent of browser storage and applies the same way across all platforms.
Can users bypass both protection mechanisms?
No. Even if a new browser session is created, abusive request patterns are still subject to IP-based protection.
Related Articles