Candoor
Anonymous interviews with anonymity you can verify, not take on faith.
A short spoken conversation becomes a theme, and never a person. Nothing is stored until you have read exactly what would be stored and approved it.
You see the exact words before anyone else does.
Everything hangs on one moment. Up to that point nothing has been kept; after it, nothing can point back to you.
You talk
Ten minutes or so. What went well, what went wrong, what you would change.
It is rewritten
Names, teams and dates are generalized, so the words cannot be traced back.
It joins the others
Held with everyone else's, with nothing tying it to you or your key.
Themes come out
Only what enough separate people raised is ever shown. Problems, not people.
Walking away costs nothing. If you close the tab, or read the draft and decide against it, there is no record that the conversation happened at all.
Every round states its own rules, and cannot change them later.
You are shown them before you decide whether to speak, along with a fingerprint that changes if anything changes — which is how you know nothing did.
Nothing is kept without your say-so
The conversation itself is never stored. Only the text you approve is.
No one can tell whether you took part
There is no attendance list, and no reminder can single you out.
Small groups are told they are small
Where a group is too small to be anonymous, the round says so rather than pretending.
One theme needs several voices
Nothing reaches a report on one person's say-so, and what is held back is held back invisibly.