Privacy, in detail
How anonymity actually works.
Not a promise - a description. Here's exactly what happens, mechanically, to a piece of feedback someone writes about you.
Not a promise - a description. Here's exactly what happens, mechanically, to a piece of feedback someone writes about you.
For a feedback request answered by more than one person, a report can only be generated once at least 2 people have responded. Every answer is mixed together before anything is shown to you - there is no view, anywhere in the product, that shows you one person's individual answers.
A single step, running on the server, reads the raw answers all at once - purely to write your combined report, with the help of an AI company (Anthropic). That step runs automatically and is never manually reviewed by anyone at Wuna.
Answers are stored encrypted, not as plain readable text - and every feedback request uses its own separate key, so even in the unlikely event one were ever exposed, it couldn't expose anything beyond that one request. Once your report is written, the raw individual answers behind it - and that specific key - are automatically and permanently destroyed 30 days after the report is made, or after 90 days if no report is made. There's nothing left sitting around to protect.
Even with mixed answers, timing alone can sometimes hint at who responded - if a report unlocks right after you ask one specific person, it's not hard to guess. Setting a release date fixes this: every response waits for the same moment, so when someone answered never reveals who they are.
If everyone you invited responds before that date, the report releases immediately instead of making you wait - at that point there's no one left whose timing could be singled out.
You can send a reminder to everyone you invited, whether or not they've responded yet - and it goes to everyone equally. Individual response status stays hidden, even from you, so a reminder can never be used to single anyone out.
Every response is automatically screened for personal attacks before a report is generated - honest, even harsh, feedback about behavior is never flagged, since that's exactly what the product is for. Only attacks on someone's character or worth get flagged.
If something is flagged, you decide whether to include it - but you only ever see why it was held back, never the words and never who wrote them. Anonymity holds even during that review.
None of the above applies when a request goes to exactly one person - there's nothing to mix, and anonymity was never the mechanism there. Their answer is simply theirs, shared with you directly. Wuna makes this distinction clear before you ever send a request, so it's never a surprise.
This page is a companion to the shorter trust overview on the main page.
