I have been challenged on the level of anonimity of responses using LimeSurvey and the one area that reduces this anonimity is the knowledge of who has responded to a survey and who has not when using tokens. The knowledge of who has responded and who has not, could be powerful information in its own right.

Could an option be included such that the detailed data about the Token usage could be hidden from the Survey Administrator (and I do not mean necessarily a backend solution)?

So for instance, currently I can see who has used the token to complete the survey. If that was hidden so that I did not know who has responded, that would increase the anonimity of the survey. Reminders could still be sent out but who these had gone to should be hidden.

Of course, a back en admin/sysroot would still be able to identify this information (mail server logs), but it adds an additional layer to the obsfucation for the survey user.

The other area that identifies token users is linked to the above and that is the fact that a response has a sequential id number. Could an option be added that uses a random key for the response id (differnt to the token of course) so the sequence is unknown to the survey admin at least?

1. I don't think it makes much sense to hide the information who has completed a survey. Every superadmin usually has the knowledge to look this up at the database if necessary and most users prefer to track how their surveys are progessing.

2. Using a random number might be useful, but compared to the amount of changes that would need to be done to the core survey engine, the actual benefit is of little account.

Feel free to open tickets at our idea tracker for this, but from my experience there won't be many users voting for it.

In general the current system architecture is safe when it comes to anonymity, because there is no connection between answer data and token data at anonymous surveys.