can my manager see my survey answer?

if your company uses jollygig and you're wondering whether your manager can tell which response is yours — no. they can't. this page is the why behind that answer.

you don't have to take our word for it. the structural reasons matter more than the promise, and they're easy enough to walk through.

your answer is not stored with your name on it

when you submit a response, the database row that stores it doesn't contain your user id, your email, or any other field that identifies you. the row contains the answer, the team it belongs to, and a timestamp at daily granularity. that's it.

this is the most important fact about how jollygig works. it's not a setting your admin can turn off. it's the shape of the data. there is no version of the product where your manager can see which response is yours, because that information was never written down in the first place.

your manager sees patterns, not people

what your manager sees is what we call a persona — a named pattern of feeling across the team. things like growth-blocked when several people are feeling stuck on growth, or in their element when several people are feeling well-matched to their work.

a persona only shows up when several people share it. one person feeling a particular way is not enough to surface a result. the language is deliberately about the team's shape, not about individuals.

nothing shows up until at least 5 people have answered

if fewer than 5 people on your team have responded, the dashboard does not show a result at all. it shows a tile that says, plainly, that there isn't enough data yet.

this matters because a result from a small group can be reverse-engineered. with 3 responses, even an aggregate is close enough to the individual answers that a careful reader could sometimes work backwards. with 5 or more, that becomes much harder, and the floor is enforced in the database, not in the ui.

we wrote more about why 5 specifically, and how the floor is enforced, in a separate post if you want to go deeper.

timestamps are blunt on purpose

a precise timestamp can leak identity. if a manager knows you usually answer surveys late at night and they see an answer with a 11:42pm timestamp, that's a hint.

so we store timestamps at daily granularity only. you answered "on tuesday" — that's all the database knows. nobody can sort responses by exact time and infer who was first.

there is no free-text field

open-ended responses are the most common way anonymity gets lost in practice. people have writing styles. people refer to things only they know. once a single response is attributable, every response in the same batch becomes suspect.

jollygig asks three multiple-choice questions: a domain, an emotion, an intensity. there is no text box. there is no place for you to accidentally identify yourself, even if you wanted to.

action plans are about conditions, not people

when a persona is active on your team and your manager decides to act on it, the suggestions they see from the product are addressed to conditions — the structure of the work, the cadence of growth conversations, how recognition flows — not to individuals.

"talk to alex about feeling stuck" would never come out of jollygig, because the product never knows who alex is.

what about the data we do collect

to make the product work, we do know who you are as a member of a team. that's how we know when to send you a survey, when not to (we honor pause requests), and how to make sure you don't accidentally see another team's signals.

what's separated is the connection between your identity and your responses. those are stored in different places, with no shared key. one part of the product knows who you are. another part of the product knows what was answered. neither part can ask the other to combine them, because the connection was never written.

can you delete your data

yes. you can request a full export and deletion of any data that identifies you. your past responses, since they aren't stored with your identity attached, are part of the aggregate and can't be picked out and removed individually — but nothing identifying you would remain after a deletion request.

if you want to do this, you can do it from the your data page when you're signed in.

what if you still don't believe us

a reasonable response. you don't know us. there's no way for a vendor to prove a negative — we can't show you the absence of a column in the database, and even if we did, we could change it later.

what we can do is build the product so that even if someone wanted to break the model, they couldn't do it without leaving evidence. structural anonymity is harder to reverse than a policy. policies are easy to change quietly; data shapes are hard to change without breaking things.

that's the strongest thing we can offer. if you have a specific concern, you're welcome to email us at the address on the help page — your manager doesn't have to know.

answer the survey, or don't. if you do, you can be honest. that's the deal.