Anonymous by construction

In a group of four to fifteen, people know each other well. A lowest score, a spread of answers or a result for two members can point to one person, even when no name is shown. So the safeguards have to sit in what is stored and shown, not only in a promise.

• No link between a person and an answer. A set of answers holds its group, its round and the questionnaire version. It holds no person and no time.
• Nobody can read the answers. No member, no leader and no member of staff can select them. Results come only from functions that return nothing below the threshold.
• A threshold of four answers. A group can raise it to eight. It can never be lowered.
• Nothing before close. While a round is open, every page shows a count, never a score. A result is computed once, at close, and never changes.
• No order to follow. At close, the answers are stored again in random order with new identifiers, so the order they arrived in links them to no one.

The free scan uses one link for the whole group, so it cannot check who answers. It accepts no more answers than the group has members. A browser can replace its own answers until the scan closes, and the key that allows it is deleted at close.

The Full diagnostic and the pulses are answered by signed-in members, one answer each.

Only if you share it. Your Leader Profile is readable by you alone. You choose whether your group sees nothing, your broad results, or more detail. When you take it again, sharing starts again from nothing, and you can delete it at any time.

In the EU. The database and the application run in Frankfurt. Nothing about an answer is sent to any other system, including the company's own customer records.