Anonymity guaranteed by design
Why you cannot be identified
This is not a promise that we "won't look" — the system is built so that we technically cannot. This page discloses exactly how it works.
What is stored in the database — and what is not
Airline, position, annual salary band, years of service, age band
The substance of the review. Used for aggregation. Annual salary is stored only as a range in 100万円 increments (an exact figure such as 1,697万円 is never stored).
Review text (optional)
Stored only if you write it. Our team reviews it. If it contains routes, specific operational details, or incidents that could identify an individual, we keep it unpublished.
Proof hash (proof_hash)
An encrypted string used solely to prevent duplicate submissions. It cannot be reversed back to your ID (see below).
Name and email address
Never stored. These columns do not exist in the submissions table.
User ID
Review records in the database have no user_id column. Submissions are not linked to member accounts.
IP address and device information
We do not collect or store the IP address or browser information used when you submit.
Exact annual salary, date of birth, routes
The form has no input fields for these in the first place. Selection menus only — 100万円 increments, 5-year age bands and 5-year tenure bands.
How the proof hash (proof_hash) works
A login is required for one reason only: to block spam submissions. Your user ID is not included in the submitted data. Instead, the following calculation runs inside your own browser.
1
Combine your user ID with the airline
We build a string that combines your ID (UUID) with the airline you are reviewing. This step is completed entirely inside your browser.
userId + "::pv_anon::" + airline + "::2026"
2
Hash it with SHA-256
The string above is converted with SHA-256 (industry-standard cryptography). Reversing it back to the original value is computationally impossible.
crypto.subtle.digest('SHA-256', data)
→ "a3f8c2d1e4b7..." (a 64-character string)
3
Only the hash is stored in the database
The only thing sent to the server is this hash string. Your user ID and email address are never transmitted. Even when our team inspects the database, we cannot tell who submitted a review.
4
Used for duplicate checks only
It is used solely to stop the same person from submitting twice for the same airline. It has no other purpose.
The actual database structure (reviews_v2 table)
Only the following eight columns are stored. There is no "user_id", "email" or "name" column.
CREATE TABLE reviews_v2 (
id uuid PRIMARY KEY, -- Unique submission ID
proof_hash text NOT NULL, -- SHA-256 hash (cannot identify anyone)
airline text NOT NULL, -- Airline code
position text NOT NULL, -- Captain / First Officer / Trainee
salary_bucket text NOT NULL, -- e.g. "1600-1700" (100万円 increments)
tenure_bucket text NOT NULL, -- e.g. "5-10" (years of service, 5-year steps)
age_bucket text NOT NULL, -- e.g. "30-34" (age, 5-year bands)
comment text, -- Review text (optional)
created_at timestamptz -- Submission timestamp
);
-- * No user_id, email or name column exists
Display rule — only aggregates with n≥3 are published
3 or more
Aggregates are published only when there are 3 or more entries for the same combination (airline × position)
2 or fewer
Shown as "Collecting data". If there is any risk of pointing to a specific individual, it stays unpublished
Why a login is required
Without a login requirement, spam and false data would be submitted in bulk. We use account authentication to protect the reliability of the data. That said:
- ✓ The JWT token used at login only authenticates communication with the Supabase server.
- ✓ Your user ID is never written to the submissions table.
- ✓ The email address you provide at sign-up exists only in the member management table and is completely separated from the reviews table.
Now that you know how it works, submit with confidence.
Submit a review anonymously →