How anonymity works here
Most tools promise anonymity in the interface while the data underneath still knows who you are. This one is built the other way around: the guarantee lives in the data model, where no setting, admin, or bug can undo it.
Your invite is single-use
Your link works once and dies the moment you submit. The access code from your email is checked against a slow cryptographic hash — the server never stores the code or the link in readable form, and a leaked link alone is useless without the code.
Anonymity is your choice, made at the end
Before submitting you choose: stay anonymous, or attach your name. The form tells you exactly who would see your identity before you decide. Being signed in changes nothing — identity is only ever attached when you explicitly choose it.
Anonymous means the link doesn’t exist — not that it’s hidden
The database table that stores reviews has no column for who wrote them. An anonymous review keeps no connection to your invite, your email, or your account — there is nothing for an administrator to look up, nothing to leak, nothing to subpoena. It is unlinkable even to you.
Even timing can’t give you away
Submissions rest in a delayed queue before appearing, and the stored time is rounded to the hour. Someone comparing “when did this invite get used” with “when did this review appear” finds nothing to line up.
The requester sees delivery, never behavior
Whoever requested the feedback can see whether your invite email was delivered — and nothing else. “Opened” and “submitted” are never shown per person, because that would quietly re-create the link this system exists to prevent.
Nothing changes after the fact
Privacy settings freeze when a campaign is created, and submitted reviews can never be edited or deleted — by anyone. The conditions you submitted under cannot be retroactively changed.
The honest limit: very small groups
If only two or three people are invited, a reader may guess who wrote what by elimination — no system can prevent that. With a single reviewer the choice isn’t offered at all rather than making a promise it can’t keep: you can still submit without signing in, and no name is stored — the form simply tells you the requester will know it came from you. Anonymity grows stronger as more reviewers are added, and reviewers are only ever added, never removed.
Want the technical version? The data model, timing design, and the tests that enforce all of the above live in the project’s design docs. Back to home