Aggregate privacy: k-anonymity + differential privacy

Pick a mood below. The raw card moves at once; the protected one stays put until three distinct people have submitted this round, then publishes with noise added.

How the two aggregates differ

One "team mood" source topic, two live.aggregate exports with identical reducers. The raw one publishes exact values on every submission. The protected one declares privacy: { k: 3, epsilon: 1.0, noise: 'laplace', strategy: 'hybrid' }: below 3 distinct contributors in the current one-minute round it simply does not move - the last published value is held, never replaced with a null or a marker, because the drop below k is itself the signal k-anonymity hides. At k it publishes with calibrated Laplace noise.

Submitting as Fizzy Biscuit

How is your day? (each submission feeds both aggregates)

Alone? These are two clearly-marked stand-ins that submit like anyone else, so this round can reach k = 3 and the protected card can publish.

Raw (this round)

exact, every event

No submissions this round yet.

Protected (this round)

k = 3, Laplace noise

Held. Nothing has been published yet: no round has reached 3 distinct contributors.