Open the settings on most survey tools and you'll find IP logging turned on by default, buried a few menus deep, framed as a "security" or "fraud prevention" feature. It usually is useful for that. It also means every person who fills out your customer feedback form, your anonymous workplace survey, or your event sign-up sheet has their IP address — a piece of personal data under GDPR — sitting in a database somewhere, often for as long as the account exists.
We built Surveyee the other way around: anonymous by default, with IP tracking as something you turn on, not something you turn off.
What "anonymous by default" actually means here
When a survey is set to anonymous mode (the default for new surveys):
- The respondent's IP address is hashed, not stored. We use it for a few seconds to check for duplicate submissions and spam, then it's gone — only a one-way hash remains, and that hash can't be reversed back into an IP.
- No IP-derived location data is attached to the response beyond a coarse, GDPR-safe country code (resolved locally, not via a third-party lookup service that would otherwise see your respondents' IPs).
- If you explicitly turn anonymous mode off for a survey — some legitimate use cases need it, like requiring one response per employee — the raw IP is stored, and that's a deliberate, visible choice you made, not a silent default.
This isn't a policy promise sitting in a privacy policy that the product doesn't actually enforce. It's wired into the submission path itself: every response that comes in gets processed through the same anonymization logic before it's written to the database, regardless of which part of the app the request came from.
Why this matters even if you don't think you're collecting "sensitive" data
It's easy to assume IP addresses only matter for surveys about sensitive topics. In practice, the risk is more mundane and more common:
- Anonymous feedback isn't actually anonymous if the IP is stored. An "anonymous" employee satisfaction survey where the raw IP sits next to every response isn't anonymous in any legal or practical sense — it's pseudonymous at best, and trivially de-anonymizable by whoever runs the survey.
- You inherit the liability. Under GDPR, an IP address is personal data. If you're collecting it — even by default, even without meaning to — you're a data controller with obligations: a lawful basis, a retention policy, the ability to honor a deletion request. Most people building a quick feedback form never intended to take on any of that.
- It rarely adds real value. For the overwhelming majority of surveys, IP tracking exists to catch obvious spam (the same bot submitting a form 200 times) — which a hash-based duplicate check handles just as well, without ever having a raw, reversible IP address to lose, leak, or subpoena.
What we do instead
A few concrete things, all live today, not roadmap items:
- Hash-based duplicate detection. We salt and one-way-hash the IP per survey, use that hash to catch repeat submissions, then discard the raw value.
- Real data export and delete. If you want to see or remove everything tied to your account, that's a real, working self-service flow — not a support ticket that goes into a queue.
- EU hosting. Data lives in Germany, which matters if GDPR data-residency is part of your own compliance story.
- No third-party analytics on the respondent-facing page. The survey you send out doesn't quietly load a tracking pixel from an ad network in the background — only your own account gets first-party product analytics, and only on the pages you actually manage.
None of this is a claim we can't back up with the code. If you want the deeper technical version — hashing algorithm, retention rules, exactly what's stored and for how long — it's all in our Security and Privacy Policy pages.
If you're building a survey right now and want to see the anonymous-by-default setting for yourself, start one for free — no account needed until you're ready to publish.