Anonymous is really pseudonymous

True to the defining features of the Delphi method, Delphi Pronoia is anonymous: participants recognise one another only by a pseudonym. The pseudonym is also what sets Pronoia apart from earlier Delphi platforms. It lets relationships form between panelists over the rounds. In that sense, Pronoia can also be called a pseudonymous method. The pseudonyms are borrowed from ancient Delphi: they are taken from the names of people connected with the oracle through the ages.

Panelists see each other only by pseudonym. The facilitator sees names for communication purposes, except when blind mode has been chosen for the panel.

The panelist's response is safe

A panelist reaches their own home page through a personal link, without a password. That is why the link is protected like a password.

• Unguessable. The link's token is a random 128-bit number. In addition, the server slows down repeated requests from the same address, so guessing links is not possible in practice.
• Time-limited. A link is valid for at most 365 days. The facilitator can revoke it and send a new one if the link has ended up in the wrong hands.
• Stored only as a hash. The database and backups do not hold the link in readable form, only a hash computed from it. Even if the database or a backup fell into someone's hands, the links could not be read from it. The application reconstructs a link only with the server key, which is kept neither in the database nor in the backups.
• Sent only in the invitation. Studies created from 20 October 2026 onwards use closed link mode by default. The server then does not show panelists' links to the facilitator at all; the link travels only in the invitation sent to the panelist. If the facilitator needs a link in an exceptional case, for example when a panelist cannot find their invitation, the link can be shown once. Showing it once requires a reason and is recorded in the log. Blind mode always enforces closed link mode.

Only the panelist can change their own response. The study team cannot write a response on a human panelist's behalf: the server refuses it.

Invitations travel by email, and they contain the panelist's address and personal link. The mail service sends the messages from the EU but stores them in the United States. This cannot be avoided as long as invitations are sent by email.

Three identity modes

The study team includes everyone with a role in the study: the owner, the facilitators and the viewers. The owner is the person who created the study or to whom it has been transferred. The owner chooses the identity mode, can reset responses and anonymise the study once it has ended, and sees the study's full log. The facilitator runs the study: they invite the panelists, open and close rounds and send reminders. In the log they see events without the entries concerning rights. A viewer can follow the study but sees panelists only by pseudonym and does not see the log.

The study's owner chooses the identity mode for the whole study. The mode determines what the study team sees and how panelists' data is handled.

1. Pseudonymous (default)

Every panelist receives a pseudonym drawn from the names of ancient Delphi. Other panelists and viewers see responses and reasoning under the pseudonym. The owner and the facilitator also see panelists' real names and email addresses. These are needed for reminders, for following coverage and for quality control.

The default mode suits most expert panels and matches the practice of other platforms. Panelists can argue and give their reasoning freely, because nobody else in the panel knows who is speaking. This is the classic starting point of the Delphi method. The mode is pseudonymous. It is not fully anonymous in the sense that the facilitator and the study team can know who answered what. This is no different from an ordinary research setting, in which the researcher collects the data and knows whom it came from.

What you can promise panelists: *"Other panelists see your pseudonym and your responses. The study's facilitator sees your name for communication purposes, but nobody other than you can change or delete your responses."*

2. Pseudonymous with blind mode

Blind mode (*Blind facilitator*) is an extra protection switched on top of the pseudonymous mode. When it is on, the whole study team sees only pseudonyms: the owner, the facilitator and the viewer. Invitations and reminders work, but nobody in the team can see who is who. The facilitator does not see panelists' links either.

This mode suits sensitive topics and panels in which panelists' positions make them vulnerable to one another, to the commissioner or to the researchers. Examples include an internal panel in a workplace where a manager is on the study team, and topics where a response could affect the respondent's position.

Blind mode must be switched on before the invitations go out. Once the first human panelist has been invited, blind mode locks and can no longer be lifted.

What you can promise panelists: *"Nobody in the research team can see who answered what. This setting cannot be lifted during the study."*

3. Anonymous one-shot poll

A fully anonymous response is possible only in the anonymous one-shot poll, for example a QR poll at a seminar or another event. The respondent receives neither a personal link nor a pseudonym, and no identifier is attached to the response. Nobody can see anything identifying, because there is nothing identifying to see.

A one-shot poll has no rounds and no revision, and the argumentation does not continue beyond the same browser session. It suits quick opinion gathering at a meeting or event, and it can be combined with an actual Delphi process.

What you can promise panelists: *"Your response is completely anonymous: no identifier is attached to it."*

4. In every mode

• Exports for analysis, reports and the archive never contain names or email addresses.
• Group-level figures are hidden if a group has fewer than three people.
• AI panelists are always marked, and no names or addresses are sent to the AI service.
• Once the study has ended, the owner can anonymise the entire study: names and addresses are deleted permanently and the links are invalidated.
• Free text can reveal its writer. That is why it is worth telling panelists something like this: *"What you write can reveal who you are through its content, so avoid identifying details if you want to remain unidentified."*

The administrator is committed in writing

All service administrators have accepted a ten-point commitment, published on Pronoia's Logging policy page. An administrator can reach a study's content only through support mode. Every direct use of the database is recorded in the maintenance log on the same day it happens. Under the commitment, responses are not altered and panelists' identities are not investigated. Without accepting the commitment, an administrator cannot open support mode.

The Logging policy page also explains what is and is not recorded in the log, who sees the log and what the log does not prove.

New article in the method library

The method library has a new article, *Pseudonymous, blinded or anonymous: what you can promise your panelists*. It contains ready-made wording for the invitation for each mode, along with plainly stated limits that are worth sharing with the commissioner as well. The most important limit applies to every mode: free text can reveal its writer. Anonymity covers the identifier, not the content.

The words in brief

Pseudonym means an alias or assumed name (Greek *pseudōnymos*, 'falsely named'). Under the General Data Protection Regulation, pseudonymised data is still personal data: it cannot be linked to a person without additional information, but that information exists and is kept separately and protected. In Pronoia, the pseudonym is visible, and the information about who is behind it is kept separate and protected.

Anonymous means nameless. Anonymous data cannot be linked to anyone by any means, and the General Data Protection Regulation no longer applies to it. In Pronoia, genuinely anonymous data consists of the responses to a one-shot poll and a study that its owner has anonymised after it ended.

More information: Security · Logging policy