How anonymity works

We built the site so that we cannot tell your employer about you, because we never learn who your employer is. This page lists what is built and running today. If it ever disagrees with what the site does, the site is wrong and we will fix the site or this page.

Ghost reports (submit.hypescraper.io)

A separate address with no cookies, no third-party code, a strict content policy and no access log. Like any web server, ours sees the connecting IP address while the request is in flight; it is never logged and never passed to the Ghost app, which therefore never sees it.
No account and no email. You get a burn key instead, shown once. We store only a one-way fingerprint of it. With it you can check your report, answer the 90-day check, or delete it. Lose it and nobody can recover it, us included.
A small puzzle your browser solves (proof of work) replaces IP-based rate limits.
Check for names suggests edits for emails, links, numbers, dates, names and company names before you submit. It runs on fixed rules, not on an AI model.
An accepted Ghost report goes live 1–3 days later at a random time, so nobody can match the timing of a post to you.
Ghost reports earn no points and no badges, and get no emails, because there is no account to give them to.

Account reports

Posted from your account, shown either as your handle or as "an operator". The link between your account and the report is kept in a separate identity database, as an encrypted reference, apart from the report text. You can delete a report on Me at any time; it disappears from the next release and its Tower block goes dark.

Two databases

Content (reports, questions, answers, votes) and identity (accounts, handles, ranks) live in two separate databases with separate access roles. Votes, daily answers and game plays are stored under keyed fingerprints, never under an account id. The Ghost service cannot reach the identity database at all. Your email address and password are held only by our login provider, never in our databases.

Research questions

Companies can pay to ask practitioners a structured question. They get totals and, at most, a few short quotes that a person has checked and stripped of anything identifying. They never get your handle, your email, your account or a list of who answered. Answers are stored with your profile bands (role, team size, providers), not your account. Results are only reported for groups of 10 or more.

Numbers

Public numbers need at least 30 reports behind them; Pro and report cells at least 10. A count from 1 to 9 is shown as "<10". This makes it hard to work backwards from a number to a person.

Every public file is checked

Before any release goes live, a scanner rejects any public file that contains account ids, tokens, emails, IP addresses, burn key fingerprints, private answers, or a small count that is not written as "<10". A failed check stops the release.

What is deleted, and when

Individual daily-question answers and Hype-or-real plays: the link to your browser is deleted after 7 days. Only totals remain.
Logged-in activity used for streak badges: deleted after 30 days.
Sent-email records: deleted after 30 days.
Pro briefs (PDFs): deleted after 30 days.
Deleting your account on Me deletes your login, your handle, your rank and every link from your account to your reports, questions and answers at once. Published text stays, shown as "an operator", with nothing linking it to you.

Who can see what

Cloudflare sits in front of hypescraper.io (the static pages) and so sees visitors' IP addresses for page loads. The write API, the Ghost address, the ad counter and the video host are not behind Cloudflare; they go straight to our server, which does not write client IP addresses to disk.
Oracle Cloud (Frankfurt, EU) hosts our servers, databases, encrypted backups and sends our emails.
Supabase (EU region) holds your login email and password fingerprint.

If a report could identify you

Delete it with your burn key (Ghost) or on Me (account). It disappears from the next release. We hold nothing that links a Ghost report to a person, so we cannot hand over what we do not have. If we are ever ordered to try, we will say so publicly as far as the law allows.