Anonymity and privacy-safe visibility.

Designed not to ask for identity in check-ins

No sign-up, no name field, no email, no phone number, and no GPS prompt. Scanning the crew's QR code sets up an anonymous session on the phone; it is tied to no person.

Leader surfaces are built around thresholded aggregate outputs, suppressed slices, and access controls.

What employers can and cannot see

Employers can see aggregate signal trends, participation patterns above thresholds, and privacy-gated driver themes.

Employers cannot see raw private Vault records, individual worker check-ins, identity-linked signal rows, sub-threshold slices, or raw worker-private browsing access.

Where the protection stops

Your answers are stored with no column for who you are. A separate one-day ticket, holding no answers and no account, stops double check-ins and is wiped overnight.

The app cannot stop anyone saying on site how you answered. A crew too small to pass the floor sees nothing that day. Someone holding both the full database and the secret key could, before the overnight wipe, test whether a person checked in that day: whether, never what. MYSAE complies with lawful Australian orders.

Compact trust boundary

Public demo only. No raw check-ins, private Vault records, tokens, customer records, or sub-threshold slices exposed.