What the bucket gathers
The bucket of Anonymous X-DOCs is not a folder of things you wanted to hide. It gathers both: the documents you registered anonymously and the ones other people forwarded to you, together, with no visible separation and no label saying which is which. That mix is not disorder — it is the first half of the protection.
The bucket's line says how many documents exist and how many are left to resolve — and the red light blinks only for what arrived. A document you registered yourself is not pending anything: the bucket does not ask you for a decision about your own act. An open anonymous draft goes on the same line, set apart, because it is transitory on purpose.
What you registered and what you received sit in the same bucket, in the same order. There is no tab, filter or mark dividing the two — and that is precisely what keeps anyone from pointing at yours.
The bucket is ordered by the hash of the document, not by the time it came in. Arrival order would be a clue: the oldest one in the bucket tends to be yours.
The bucket does not keep who sent it — not even for the documents that arrived. It is not that the origin is hidden in the record: it is not written down anywhere.
The protection is proportional to what arrives. In a bucket with a single document, it is obviously yours. The more anonymous ones arrive from outside, the less possible it becomes to point at which one left from you. That is why the screen does not promise that "your documents are protected here" — it shows the mechanism, and the mechanism depends on movement.
The ambiguity is the protection
This is the most important part of the page. When an anonymous X-DOC reaches someone, that person sees who forwarded — the name is right there, in the conversation, as in any memo. What that person not see, and has no way to find out, is who wrote it. And the two roles arrive looking exactly the same on screen.
- Who forwarded. The name of whoever pressed Forward, in their conversation, as in any memo.
- The full text, with the seal, the date and the stamp — verifiable line by line.
- That the document is anonymous: the page says "Registered anonymously", and the list shows "Unknown author".
- Who wrote it. The authorship field does not exist in the seal — it is not hidden, it was never written.
- Whether the forwarder is the author or is just passing it on. The two are indistinguishable.
- How many hands it passed through. The document accumulates no trail of its route.
That is what makes the layer work in practice. Whoever wrote an anonymous X-DOC can forward it themselves, and talk about the matter like someone commenting on a paper that landed in their hands — "look what showed up here". On the other side, there is no test, no metadata, no interface detail that separates the author from the bearer. The author hides inside the role of bearer, and the legitimate bearer carries the same doubt at no cost.
The consequence that matters to the receiver is the reverse: receiving from someone is not knowing who wrote it. If an anonymous X-DOC arrives and the matter is serious, the right question is not "who sent me this?" — it is what the text itself proves, with its seal. The document stands on what is written and on the integrity of the hash; never on its provenance.
And that is why the bucket keeps no sender. If it did, the ambiguity would fall apart inside your own device: opening the record would be enough to see who it came from, and the chain would be rebuilt backwards. The origin is not hidden from the screen — it is not written down.
Where the anonymous one is born
Authorship is chosen before registering, in the composer's header. It is not a corner menu: it is a whole page, because the choice does not change after the seal. Who signs as author can be you, one of your brands — or nobody.
When registering anonymously, the dialog warns what is lost — and it is honest: with no authorship field in the seal, there is no way to prove later that the document is yours. There is no selective disclosure tucked away somewhere, no key you can show a judge later. Anonymity here is final in both directions.
Registering anonymously deletes the draft that gave rise to the document, and the deletion is irreversible. The draft lives on your device identified as yours — leaving it behind would keep a traceable copy of the same text next to the anonymous record.
An anonymous X-DOC opens no chain: no revision 2, no seed for someone else to continue, no successor named. A link between two revisions would be exactly the clue tying the second to the author of the first.
Found a mistake? Register another anonymous document, with the right text. The two have no connection to each other — and that is how it has to be: a connection is a trail.
How it travels
Keeping an anonymous one is worth nothing — the value is in circulating. And circulating here is from device to device, end-to-end encrypted: there is no board, no public list, and nobody browses someone else's document. The only way out is the bucket itself: you locate the document and forward it to a conversation. The anonymous X-DOC has no door in the conversation's attach button, and will not have one: its operation is forwarding.
Open the Anonymous X-DOCs bucket and locate the document. It is the shelf where it lives, whether yours or received.
Tap Forward and mark the connections. The dialog says what will happen: it arrives with no sender.
Send it. The receiver sees your name as who forwarded — never as author — and can pass it on the same way.
Forwarding also clears it. If the document had reached you and was still pending, forwarding turns off its light in the bucket: forwarding is already a decision taken about the text. You do not have to open and read it first just to put the bucket at ease.
How it stops being pending
An anonymous X-DOC that reached you stays pending — the bucket's red light blinks for it. And clearing it is simple: scroll the page to the end. The complete reading is the decision. There is no button to press, no acknowledgement to give.
Why there is no acknowledgement: the acknowledgement is the sealed X-DOC's notice — it travels back and tells whoever sent it that the person read it. In an anonymous document there is no author to notify. If the acknowledgement went back, it would go back to whoever forwarded, and that would be a thread of propagation: the forwarder would know exactly who read it, and when. The page says so plainly, at the foot of the reading: "you read it — and nothing was reported to whoever forwarded it".
All three doors clear it the same way. You can open the document from the tape, when its frame comes up in the day's business; from the conversation, on the button of the bubble it arrived in; or from the bucket, by tapping the document. In any of them, scrolling to the end settles it — and the tape's frame drops with it, without charging twice for the same reading.
Closing without reading does not clear it. The button to close the reading only lights up when the page has reached the end — before that it stays locked. It is the same lock as the sealed one's acknowledgement: the product does not record a reading that did not happen.
What it does not promise
A product that deals with anonymity has to be exact about what it does not do — because whoever trusts what does not exist runs a real risk. Three limits, stated plainly.
Anonymity here is against the other users: nobody can know who wrote it. And the network knows less — the communication is end-to-end encrypted, and it knows only the hash, never the text: it cannot tell anonymous from signed. But it sees the address of whoever sends — yours, and that of whoever forwards it later.
The seal of an anonymous X-DOC proves that the exact text existed on that date and was not altered afterwards. It never promised to prove that what is written is true. A sealed anonymous one is a document of unforgeable text and unknown authorship — both things at once.
With no authorship field in the seal, you cannot prove later that you wrote that document. There is no stored key, no selective disclosure, no hidden receipt. If at some point you will need to say "this is mine", register it identified.
When to use it
The deciding question is: does the text need to circulate, and would your name next to it create a problem? If so, it is anonymous. If you will need to prove authorship later — or demand someone's signature — it is an identified document.
Do not use anonymous to ask something of someone. A commitment calls for a signature, and a signature calls for both parties named. Confirmed notice calls for the sealed one and its acknowledgement. The anonymous one exists to make a text circulate — not to demand an act from the receiver.