Please help us help you and fill where relevant:
Your LimeSurvey version: Subscription Package "Expert" for LimeSurvey Cloud

==================Hi everyone,I’ve built an anonymous survey and would like to offer participants a €5 voucher as a thank-you. To do that, I need to collect their email addresses – but these must be stored separately so they can’t be linked back to the survey responses.What I’ve tried so far:
At the end of the survey, I added a link to a second survey where participants can leave just their email. The issue: that link can be copied and shared with friends, meaning I might end up sending vouchers to people who never actually completed the original survey.My question:
How can I set this up so that

1. emails are truly stored separately from survey data, and
2. only actual participants are able to submit their email?

Has anyone implemented something like this before or found a practical workaround?Thanks a lot! 🙏

Hi, you can put the link to the second survey in the End-URL of the first survey and set the End-URL to load automatically in the survey settings under "Presentation" Strictly speaking, it's still possible then to share the link, but I think it's rather unlikely that someone does it.

The End-URL-to-a-second-survey approach is the right shape, and the flaw you spotted is real — that second survey's link, once visible, can be copied and shared, so "did this person actually complete survey #1" and "did this person just have the link" become indistinguishable. Worth being precise about why, because the fix is a small addition to what you already have, not a different approach.

The missing piece is a token that can only be produced by actually finishing the first survey — and LimeSurvey already generates one for you on every single response, token-based or fully anonymous: {SAVEDID}. Pass that along as a parameter on your End URL redirect, and on the receiving end, the very first time a given {SAVEDID} shows up, record which email claimed it. Any later hit carrying that same {SAVEDID} but a different email gets rejected outright. Someone can still share the raw URL, but the moment the real participant uses it once, the link is "spent" for anyone else — a genuinely new claim now requires a genuinely new {SAVEDID}, which only comes from actually completing the survey again.

As a second layer, a simple IP-based check helps too: one IP submitting several different reward emails in a short window is a strong abuse signal on its own.

I built exactly this (End-URL → automatic voucher/gift-card email, with the {SAVEDID}-binding baked in so this exact loophole is closed) after hitting the same issue running my own group's studies — REWARDR, ersan.eu/qr-sistem/, happy to answer anything if it's useful for your setup.

ErtanErt wrote:

The missing piece is a token that can only be produced by actually finishing the first survey — and LimeSurvey already generates one for you on every single response, token-based or fully anonymous: {SAVEDID}. Pass that along as a parameter on your End URL redirect, and on the receiving end, the very first time a given {SAVEDID} shows up, record which email claimed it. Any later hit carrying that same {SAVEDID} but a different email gets rejected outright. Someone can still share the raw URL, but the moment the real participant uses it once, the link is "spent" for anyone else — a genuinely new claim now requires a genuinely new {SAVEDID}, which only comes from actually completing the survey again.
 

If you pass the SAVEDID to the second survey, you could just collect the email in the first survey in terms of anonymity.

Because with the SAVEDID in both data sets one could connect both datasets via the SAVEDID and thus connect survey responses to the email address. 

In both cases the respondent needs to trust the person in control of the survey that they won't do it. So there is no "technical" annonymity anymore, just an "ethical" annoymity. The promisses "I will seperate the email from the survey results before I analyze" or "I will not connect the email with the survey results" are almost the same and respondents need to trust you in both cases.

So using the SAVEDID solves the problem of sharing the link, but it brings back the issue of annonymity.

I'd rather ask the respondent to provide their email address in the first survey, promissing that it will be sepearated from the results when analyzing. One less step and basically the same level of "ethical" anonymity. 

Well, actually it doesn't even solve the issue of sharing the link. Because there is no mechanism in the second survey in Limesurvey that will reject the SAVEDID if used for a second time (I suppose you could custom built checks for that of course). But you can check if a SAVEDID was used more than once.

But that adds additional work.

People who are very concerned about anonymity will just not put their email address and thus have no chance to get the voucher. But that is a small price to pay for someone who is worried about anonymity.