Identity
How visitors are known
Nobody has to create an account to vote on your board. This page explains what happens instead, which matters if somebody is going to ask you about it.
Anonymous voters
The first time somebody votes, comments or suggests something, the board mints an identity for them and your own site keeps it in local storage. Every later vote from that browser carries the same identity, so their votes stay theirs: they can come back a week later, see what they voted for, and change their mind.
No cookie is set. Nothing is derived from a network address. The identity is signed for one project, and the script runs in your own page rather than in a frame, so what it stores is your origin's own storage: two sites embedding the same board cannot see each other's visitors, structurally rather than by policy.
For a public roadmap, that is usually the whole story.
When the browser refuses
A hardened profile and some private windows refuse local storage outright. There the identity lives in memory for the length of the page session instead: the visitor votes, and comes back tomorrow as somebody new.
Nothing has to be done about that, and it is worth knowing before you write a page that offers to remember somebody. VoteFirst.config().persistent is false in that case.
What you see
An anonymous voter appears in your dashboard under a generated name, the same way an anonymous voter on your hosted board does. You can see what they voted for and what they wrote. You cannot see who they are, because nothing about who they are was ever collected.
The name is not stored anywhere. It is derived from the identity itself, an adjective, a noun and a number, so the same voter is the same handle every time you look and on every page that shows them.
Clearing an identity
If your own product has a sign out, and you would rather the next person at the same computer did not inherit the last one's votes, clear the stored identity as part of it.
VoteFirst.client.forget();
This removes the identity from that browser only. The votes already cast stay on the board, under the identity that cast them.
Signing in your own users
If the people using your product are already signed in to it, you can carry that across, and every vote and comment is recorded against the person who left it rather than an anonymous visitor. That takes a token your server signs, and it is the one part of embedding that needs a backend.