PRIVATE MUTUAL MATCHING
Secret Match
A browser tool where participants in the same place anonymously choose one person and only mutually matched pairs receive a result. No account or installation is required.
- InputNickname and participant group
- ResultOnly on that participant's device
- VotesNot directly readable from the browser
How it works
The host sets the number in each of the two participant groups and shares an eight-character room ID and six-digit passphrase. Up to 20 people can join and groups cannot change afterward. When everyone is present, choose one person from the other group or “No selection this time.”
Privacy design
Only the Cloudflare Worker accesses the D1 database. Passphrases and participant tokens are stored as SHA-256 hashes, votes are omitted from public responses, and each result requires that participant's credentials.
Using it safely
- Obtain consent from everyone and respect the choice not to participate.
- Use a nickname for the event, not a real name, contact details, or social-media ID.
- Share the room ID and passphrase only with participants, not publicly.
- Do not capture or share result screens without permission or pressure anyone to reveal a result.
Examples and facilitation tips
Use it at a small gathering
Count participants before creating the room and share credentials verbally or through a limited channel at the venue. A mismatch between configured and actual attendance prevents voting from starting, so wait until attendance is settled. A mistaken group size requires a new room.
Have everyone operate it together
Keep the waiting screen open after joining. Once the host confirms everyone is present, allow time to vote. Votes cannot be redone, so check the candidate and selection before confirming. Choosing nobody is always valid.
Treat each result as personal
After all votes, a successful match shows the other nickname only on the participant's screen. An unsuccessful result does not reveal who voted for whom. Private individual review suits this design better than publicly displaying every screen.
Saving and deleting data
Rooms, participants, and votes are held in Cloudflare D1 and become unavailable 24 hours after creation. Expired data is removed when a new room is created. Because the server holds nicknames and matching data, never enter personal information you would not want stored.
On the device side, the room ID, participant ID, and token issued when you join are stored as an httpOnly cookie (named secret_match_room). JavaScript cannot read it, so scripts on other pages of the same domain cannot reach the participant token. The cookie's expiry matches the room's remaining lifetime, and “Clear participation data and finish” invalidates it. To be sure it is removed, use the finish button or delete Secret Match's site data from your browser settings; deleting it from the browser alone does not individually remove server data before its 24-hour expiry.
Closing the tab or browser does not end participation: the same browser restores it from the cookie. Credentials do not sync to an account, so they cannot transfer to another browser or device. If you switch device or browser mid-vote, you cannot return as the same participant, so use the same device and browser from joining through result review.
Frequently asked questions
Is payment or registration required?
No. Hosts and participants both use a browser without an account or app installation.
Can I use it on a phone?
Yes. Keep the page open until voting completes and use a stable connection.
Does it work offline?
No. Room creation, attendance, voting, and matching all communicate with the Cloudflare Worker API.
Can the host see individual votes?
Normal screens and public API responses omit votes, and there is no host vote list. The operating infrastructure still stores matching data, so this is not a tool for confidential secrets.
What happens if I close the page?
Participation credentials are stored in an httpOnly cookie, so the same browser restores your participation state even after closing a tab or window. It cannot be restored on a different browser or device. There is no nickname-based recovery, so use the same device and browser until the result appears.
Can a room be deleted immediately?
The creator cannot immediately delete the whole room. Local participation data can be cleared by invalidating the cookie through the finish action, while the room and votes become unavailable after 24 hours.