I spell it out in the white paper. TLDR; The userid and ballotid are only known to the voter. They're decoupled when the data is at rest. There's no way anyone can know which voter submitted which ballot.