Private feedback and anonymity
A retro board has two privacy settings, and they solve different problems. They’re often confused, so it’s worth being exact.
- Private until reveal controls when people see each other’s cards.
- Anonymous controls whether people see who wrote them.
Either can be on without the other. Both live in the facilitator dock’s Settings.
Private until reveal
Section titled “Private until reveal”On by default for new boards.
While a guided board is private and not yet revealed, a participant sees their own cards as normal and everyone else’s as a grey Feedback hidden until reveal placeholder — no text, no author, no vote or comment controls. Comments on other people’s cards are withheld on the same terms.
The facilitator’s Reveal button in the dock opens everything at once. It appears only while the board is private and unrevealed, and once used it’s gone: reveal is one-way for the session.
This setting has no effect on a Live board. Without phases there is no moment to reveal at, so a Live board is always visible.
It’s withheld, not just hidden
Section titled “It’s withheld, not just hidden”The hidden text and author never leave the server. They’re stripped at every boundary that could carry them to a browser — the initial board load, the live updates other people’s changes stream through, the replay a reconnecting client gets, and even the response to the mutation that created the card.
That means there is nothing in the page to inspect, and no version of “open the developer tools and read everyone’s cards”. The placeholder is the whole of what your browser was sent.
Why you’d use it
Section titled “Why you’d use it”Anchoring. When cards are visible as they’re typed, the room converges on whatever appeared first — the second person writes a variation of it, the third responds to the variation, and the loudest theme of the first ninety seconds becomes the theme of the retro.
Why you’d turn it off
Section titled “Why you’d turn it off”A continuous board people top up across a sprint, or a team that’s genuinely comfortable, does better with always-visible feedback: people build on each other’s cards instead of independently writing the same one five times.
Anonymous
Section titled “Anonymous”Off by default.
With anonymity on, every card and comment shows Anonymous in italic with a neutral dot instead of a name, for everyone — including the facilitator’s view of the board and the summary’s top-voted list. Who cast which dot vote is also withheld from other participants; only the totals travel.
The server still knows who wrote what, for moderation. It just never puts it on the wire for anyone else.
Two things are deliberately not anonymised:
- Facilitator actions. The banner announcing a phase change names the facilitator by name. Steering the room is a public act.
- Presence. The avatar row shows who is in the board. Anonymity covers what people wrote, not whether they turned up.
Why you’d use it
Section titled “Why you’d use it”Where attribution changes what gets written: a post-incident review, a retro with a manager in the room, a team where somebody has already been burned for saying the honest thing. Anonymity here is a tool for getting true input, not for avoiding accountability.
What it costs
Section titled “What it costs”You can’t follow up. “Tell me more about the deploy card” has no one to ask, and a card that’s ambiguous stays ambiguous. On a healthy team that cost usually outweighs the benefit — reach for anonymity when you have a specific reason, not as a default posture.
How access mode interacts
Section titled “How access mode interacts”The board’s access mode — set in the dock’s Share panel — can force these settings.
| Access mode | Effect on privacy settings |
|---|---|
| Members only | Free choice of both |
| Guests with a verified email | Free choice of both |
| Anyone with the link, anonymous | Forced anonymous and always visible; both switches locked |
The last row isn’t a policy choice, it’s a consequence. A board anyone can enter without signing in has no stable identity to attribute a card to, and no identity to hold a private reveal against — so the combination is refused rather than half-honoured.
What survives the session
Section titled “What survives the session”Closing a retro freezes the board with its privacy settings as they were. An anonymous board stays anonymous in its summary, in the frozen board, and in the CSV export — the export resolves unattributable authors to Anonymous and never writes a participant identifier.
Team temperature answers are separate again: they’re stored per participant but only ever read back as an average and a count. See Moods and temperature checks.