Candor lets former colleagues give each other honest, anonymous feedback. Here's exactly what happens on both sides of the link - and what we do (and don't do) with the data.
1.Create a request and share one link
Set a name or team name, and you get a single link. Post it in your old group chat - anyone with the link can respond, no sign-in needed.
2.Responses stay sealed
Feedback is hidden until 7 responses arrive. That threshold is what keeps every individual answer anonymous: no one voice stands out on its own.
3.48 hours to read, then gone
Once unlocked, you have 48 hours to read your feedback. You'll get an email the moment that happens - the feedback itself lives only in the app. When the window closes, every response is permanently deleted. No archive, no copy, no trace.
4.Quiet links expire on their own
If a week passes without enough responses, the link switches off and any partial responses are permanently deleted. You'll get an email letting you know there weren't enough responses and that the link was closed.
1.No sign-in, no name, no account
You open a link and mark statements that feel true - up to 3 per section - with an optional line in your own words. That's it.
2.Nothing about you is collected
No name, no email, no IP, no device ID. The only record that you responded is a small note stored in your own browser, just so this link doesn't accept a second response from the same device.
3.Answers are shown grouped, never linked
The person only sees answers grouped by theme. With multiple responses mixed together, there's no way to tie any answer back to you.
Zero identifying data
A response stores only its category, the marked statements, and your words. Nothing that could identify you is ever written down.
Sealed until the threshold
Results stay locked until 7 people respond, so no single answer can be traced to its author.
Ephemeral by design
Feedback lives in the app only as long as it's useful, then it's permanently deleted - not hidden, deleted.
You can wipe it anytime
The requester can delete a request and all its responses at any moment, without waiting for an expiry window.
Links stop accepting responses after 7 days without enough responses. Everything else about a request lives only as long as its reading window does.