Anonymity: what it means here

• —

  No employee identity fields

  Participant pages do not ask for an employee name, email address or employee number. Optional process questions and timing support the observation. Customer account details are separate. Free text can still contain identifying context.

• —

  No accounts, and no HR system

  Nobody signs in to take part, and there is no integration with a payroll, HR or directory system. No employee list is imported, because none is needed: the tool never knows who was invited.

• —

  No tracking

  There is no analytics product on the campaign pages, no device fingerprint, no location, no advertising identifier, and no identifier that could join one campaign to another. Participant identities are separate for each campaign; organisation branding and customer account access can be reused.

• —

  No per-person reporting, ever

  Answers arrive as text and are read as a whole. Customers receive no identified employee histories or productivity reports. Process timing evidence can appear alongside observations, without a participant identity.

• —

  The timer measures the process, not the person

  The optional timer records how long a process took — the form that will not submit, the queue someone is stuck behind. It is never used to measure how long somebody worked, and elapsed duration is never shown to the participant.

• —

  What is kept, and how little of it there is

  An answer is the words somebody wrote, plus anything optional they added: how often it happens, a process timing, a suggestion. Each participant gets a random token so they can add another answer or take one back. The token holds nothing about the person, their device or their network.

An answer is a few lines of text, plus whichever optional extras the person chose to add: how often it happens, a process timing, a suggestion. It arrives in the database with a random token that identifies the browser session, not the person, so the same person can add another answer or take one back.

The token is not an account. It is not derived from anything about the person, their device or their network, it is not shared between campaigns, and it remains on this browser until the campaign’s short follow-up period ends. It is not reused in another campaign. Nothing joins one campaign to another, so an organisation cannot accumulate a history of an individual across years of campaigns.

Answers are read together, as text, after the window closes. Anyone reading the appraisal sees reviewed findings and privacy-conscious paraphrases. They do not see an author, an order of arrival attached to a person, a return visit count or a timing attributed to an individual.

The counting is deliberately about answers rather than people. If someone wrote four things, the appraisal counts four answers and is explicit that answers are not people. What it can say honestly is how many answers came in and how many people wrote at least one of them.

We could tell you that a campaign is a reliable place to raise something you would rather not attach your name to. It is not reliable in that way, and we will not pretend it is.

• Tell your people what it is before the window opens, including the parts that limit it. A campaign that is oversold as a safe channel will get answers written on a false assumption.
• Give people time and a reason to take part. Nobody gives a useful answer in a busy week unless somebody has said it is worth doing.
• Do not use it to ask about individuals, and do not quote an answer back into a room where the person who wrote it is sitting without their agreement.