Honesty through plausibly deniable answers.
hiddlo introduces systematic random changes into survey responses so that a sensitive response can appear because someone chose it, or because of chance.
Star the sensitive responses.
Choose which responses might be hard for someone to give openly. You can star one, several, or all responses. A star marks a response that other answers can randomly become.
Do you privately disagree with the group's decision?
In this example, Yes is sensitive. The default random-change rate is 20%.
The respondent picks an answer.
Their browser applies the survey’s randomization rule before sending the resulting reported answer to our server.
Star the sensitive response.
A Yes stays Yes. A No has a 20% chance of becoming Yes and a 80% chance of staying No.
The original selection is not saved or sent as a separate value. Only the resulting, possibly changed answer is saved.
Respondents can inspect the exact probabilities before answering.
A sensitive recorded answer has two possible origins.
A recorded Yes could mean “I chose Yes.”
Or it could mean “I chose No, and chance changed it.”
The recorded sensitive response alone does not establish which original choice produced it.
Interpret the data.
Because hiddlo introduces noise in a systematic way, it can correct for this mechanical distortion and draw inferences about intended answers across the group.
44%recorded Yes
30%estimated intended Yes
In a large survey sample, these proportions would be consistent with about 30% of respondents intending Yes.
Why? If 30% intend Yes and 70% intend No, all of the first group and, on average, 20% of the second group are recorded as Yes: 30% + 14% = 44%.
For small samples, hiddlo provides Bayesian posterior estimates. In this Yes/No example, we start with a flat prior: every intended Yes share from 0% to 100% is equally plausible before seeing the data. We update that prior using the recorded responses and the known randomization process, then report the posterior mean and a 95% credible interval to show the remaining uncertainty.
Know the limits.
- Protection depends on the actual rule. Unstarred responses can reveal the original choice. No stars, or a zero random-change rate, means no randomization.
-
Plausible deniability has its limits. Someone watching your screen, or a compromised device may reveal private responses. People may still be unwilling to report sensitive information, even when plausible deniability protects their answers.
Poorly designed surveys may also invite false or malicious responses if reporting a sensitive answer helps respondents gain benefits or achieve personal goals. Care is needed in both survey design and the follow-up actions taken in response. Plan your follow-up actions →
- Better information, not necessarily perfect information. Estimates describe intended answers from the people who responded. They do not establish what really happened or what a larger population thinks.
- Uncertain inference by design. Survey creators are left with uncertainty about individual answers. That is the point. Group estimates also have sampling uncertainty.
Keep your surveys together and access them on any device with a hiddlo account. Respondents do not need an account. Creators choose the response period and can change the closing date later; results remain available.
Create space for honesty.