Why three is the right privacy floor — and why a floor is not enough

Anonymous feedback makes a promise that is easy to break by accident. The answers are not stored with names, but a result for a group of two is two people’s answers, and each of them knows one of the two.

What the floor does

A privacy floor is the smallest number of people a result can describe. Below it, a score, a heatmap cell or a comment count becomes a dash, and the group is left out of reports and exports. It counts people, not answers: someone who answers ten times is one person. In Polzy the floor is three unless you choose another number, and it works the same way for a team, a customer segment, an event session or a class.

Why three

Take a group of two. Each of them knows their own answer, so the group’s average gives away the other one’s exactly. That is not a guess. It is arithmetic.

At three, the same subtraction leaves two people. Someone who takes their own answer away from the group’s result learns what the other two said together, not what either of them said. Three is the smallest group in which no single member can work out another person’s answer from the result alone, which is why the floor never goes lower.

Why not five

Until November 2026 the default was five, and this blog argued for it. Five hides more: it also hides every group of three or four. That was a lot of groups — a small team, a seminar group, a session with a handful of attendees, a customer segment that is still growing — and the people in them answered into a result nobody saw. People stop answering when nothing they say seems to reach anyone.

Five also does not buy the protection it seems to. A higher number does nothing about the ways a result can be narrowed after the fact, and that is where anonymity is usually lost. So the default is now three, and the work went into the protections below. New workspaces start at three. A workspace that already existed keeps the number it had: the one an Admin chose, or five where nobody chose one — so a group hidden yesterday is not shown today unless an Admin lowers the floor.

Why a floor is not enough

A floor checks one result at a time. Anonymity also depends on when and to whom results are shown. Someone who saw a colleague finish the survey a minute ago, and then sees a new comment arrive, does not need a name.

What Polzy adds on top

• One rule, enforced on the server. Every chart, filter, heatmap, report, export, API call and Ask Polzy answer goes through the same check, so no screen or tool can work around it.
• A selection has to clear the floor on both sides. When someone who reads a reporting line picks part of it, figures appear only if both the people picked and the people left out reach the floor. A narrowing that would single out one other person is always withheld.
• Your own answers are shown only to you. A member sees their own answers theme by theme, because the only person they describe is the reader. That view is decided on the server, and it never lifts the floor off anyone else’s answers.
• A comment carries a day, not a time, and it is labelled with its group only when that group reaches the floor.

What has shipped since

The three protections this post first listed as coming are in the product now:

• Comments the morning after. In a campaign that keeps answers anonymous, comments appear the next morning at 07:00 on your workspace’s clock, together with that day’s others, so the moment a comment appears says nothing about who just answered. On Team and up.
• A group’s name only where it covers enough people. A comment carries its group’s name only when the group reaches the floor and so do the people of it who commented in what you are reading, and never when its writer belongs to several groups of that field. Otherwise it reads Group anonymized.
• Onboarding and exit results in batches. An anonymous campaign sent on each person’s own date holds its results until as many people as the floor have answered, then releases them together under one date, so one person’s exit survey is never read on its own. On Team and up.

When to raise it

Three is the lowest the floor can safely go, not the right number for every topic. When groups are small and the subject is sensitive — a works council survey, questions about one manager, a complaints process — raise it. Any number from 3 to 50 works, and every view uses the new one at once.

What it cannot do

A floor protects results, not the words inside a comment. If someone writes their name, or a detail only they could know, the comment still reads as written. That is why Polzy offers anonymous follow-ups: you can ask the person behind an anonymous comment a question, Polzy passes it on, and you never learn who they are.