Anonymous surveys
An anonymous survey has no participant list. Instead of sending each recipient their own link, you publish the survey once and share a single public link with whoever should answer it. Anyone who opens that link can answer, identifying themselves only by an e-mail address they type in themselves.
Use it when you want answers from a group you cannot (or do not want to) enumerate in advance — a customer base, event attendees, or everyone who sees a notice board.
Turning it on
Anonymous survey is a switch on the survey's general information step.
When you turn it on:
- The Distribution section disappears. There are no internal or external recipients to pick, no tasks are created, and no invitation or reminder e-mail is sent.
- Private turns on and becomes read-only. An anonymous survey is always private, so no respondent identity is ever shown on any screen.
Once the survey has at least one answer the anonymous switch is locked, in both directions. The flag decides how a respondent is recorded, so changing it afterwards would leave one survey holding two different kinds of answer.
Publishing
An anonymous survey is published like any other, but with fewer preconditions: since it has no recipients, the "distribution list cannot be empty" and "at least one new recipient" rules do not apply. What still applies:
- The questionnaire design must not be empty.
- The end date must not already be in the past.
- A closed survey cannot be published again.
Publishing creates the survey's public link. Republishing does not change it, so links you have already shared keep working.
Getting the link
On the survey list, a published anonymous survey has a Copy link row action. It copies the public answer address to the clipboard. The same address is also shown, read-only, on the survey's own detail page.
The action appears only while the survey is published: a draft has no link yet, and a closed survey's link no longer accepts answers.
Answering
The link opens without signing in. The answering page asks for an e-mail address at the top and shows the questions underneath, once the address is filled in.
The address and the answers are submitted together, in one step. Two things can stop a submission:
| The respondent sees | Why |
|---|---|
| This survey has already been answered with this e-mail address | The same address has answered this survey before. |
| This survey is closed for answering | The survey was closed, or its end date has passed. |
What is stored, and what is not
The e-mail address is never stored. What is kept is a one-way, keyed fingerprint of it, computed per survey.
Two consequences follow:
- The same address cannot answer the same survey twice, because the fingerprints match.
- Nobody — including someone reading the database directly — can work out which address produced which answer, because the key needed to compute a fingerprint lives outside the database.
Because the fingerprint also includes the survey, the same person answering two different surveys produces two unrelated values: their answers cannot be joined into a history.
The address is not verified. A respondent could type someone else's address, or a made-up one. The one-answer-per-address rule reliably prevents accidental double submissions; it is not a defence against somebody determined to answer repeatedly.
Reading the results
Anonymous answers appear in the survey's Results list alongside any other answers, with only the answer date shown — there is no respondent name or contact column, and never will be. Opening a row shows the submitted answers as usual. The answer count on the survey list includes them.
Rate limiting
The public link is protected by a per-address request limit, because it is open to anyone. By default a single IP address may make 20 requests every 15 minutes.
If your respondents share one internet connection — everyone answering from the same office, for instance — this limit can lock out legitimate people. You can raise it under Survey Management → Definitions → Settings.