Ask a room of employees to fill in an "anonymous" survey and watch what happens. Half of them soften every answer anyway. They're not paranoid. They're right.
Most anonymous forms are anonymous the way a hotel minibar is free. The survey tool logs the network address with every response. It sets a cookie. If you were emailed a personal link, the link itself identifies you, and "we removed the name column from the export" is doing all the work in that promise. Anyone with admin access and a timestamp can usually narrow a "who wrote this" question down to two or three people.
People know this, or at least suspect it, and it poisons the data. The whole reason to run an anonymous form is to hear the thing nobody will say with their name attached. If respondents don't believe the promise, you get the same polite fiction you'd have gotten with names on it, minus the ability to follow up. Worst of both worlds.
I've been building a small business-app platform, and when I added public forms to it last week I wanted the anonymous mode to be the real thing. Writing down what "the real thing" means took longer than building it:
The tricky one is the network address, because servers have a legitimate reason to look at it: rate limiting. If you never look at who's submitting, one bored script can fill your form with ten thousand entries overnight. Most tools resolve this tension by quietly keeping the address and hoping you don't ask.
There's a better answer, and it's not even hard: hash it. Our rate limiter keys on a one-way hash of the caller's address, counts submissions against the hash for an hour, and throws it away. The server can still say "slow down, you've sent twenty entries this hour" without ever being able to answer "who sent entry fourteen". We do the same in link mode too, because once you've built the honest version there's no reason to keep a raw address for anything.
The test I use: if someone subpoenaed the database tomorrow, could they connect an anonymous answer to a person? If the answer is yes, the form isn't anonymous, whatever the marketing page says.
A form is a door. What's behind ours is a small database app: entries arrive as ordinary records with the same full history as anything typed in by a team member, permanently marked as "came from the public form" rather than from a person. So the audit trail says what happened without saying who, which is exactly the split you want.
The same door works three ways. Share the link directly. Print it as a QR code and tape it to a wall (the page is plain HTML, no JavaScript required, so it works on whatever dusty phone scans it). Or put the form on your own website with one script tag, where it sits in the page, or behind a button, or on a side tab.
Since I was on a roll: you can now make a whole database app out of a Google
Sheet by pasting its link. Columns become typed fields, rows become records. The
importer shows you every guess it made and why ("this column became a dropdown
because the same four values repeat") before it builds anything, and it refuses to
guess where a wrong guess would be silent. A date like 03/04 gets a
question, not a coin flip, because the 3rd of April and March 4th look identical
in a cell and only one of them is true.
Full disclosure, since I write these in public: Bionic Forms has 12 users and zero paying customers. It's early. The product is a local-first replacement for the FileMaker and Lotus Notes way of working, where a database is the app, and the honest anonymous form is one door into it. If the promise-keeping approach resonates, try it and tell me where it falls short. That kind of answer I do want a name on.