Fishbowl

Is Fishbowl safe?

Fishbowl is a fair choice for career talk if you understand what "anonymous" means there. Other members do not see your name unless you show it, and there is no known breach or fine. But Fishbowl itself knows exactly who you are and where you work, and it shares that knowledge with Glassdoor and Indeed under one privacy policy. We score it 53/100, a little below Glassdoor (55) and above LinkedIn (48).

The app's selling point is that everyone is verified. To join, you need a LinkedIn account or a work email. That makes bots and fake recruiters harder to run, a real advantage over job boards. It also means every anonymous post sits in a database next to a verified identity.

How anonymous is Fishbowl?

You choose how much to show: fully anonymous, your company, your job title, or your name. Glassdoor's privacy policy, which covers Fishbowl, says your profile "will not publicly include or link to Your Content submitted semi-/anonymously". That protects you from strangers.

It protects you less from colleagues. Company bowls put you in a room with people from your own employer, and a post about a specific project, meeting or manager can give you away in a team of 20 without any name attached. The policy says Fishbowl may verify your job "through various methods, including third-party integrations or services" and may use "signals we may receive from your current or former employer".

The bigger shift came from Glassdoor. Glassdoor bought Fishbowl in 2021 and merged it into Glassdoor in July 2023, and every Glassdoor user got a Fishbowl account. Because Fishbowl verifies identities, Glassdoor began requiring them too. In March 2024 Ars Technica reported that Glassdoor staff had added a user's real name to her profile over her objections. A Glassdoor spokesperson said information "will automatically cross-populate between all Glassdoor services, including our community app Fishbowl". A lawyer for the Electronic Frontier Foundation warned that employers could use names on Fishbowl to "potentially narrow and/or identify" Glassdoor reviewers, and that the combined data could be reached by subpoena.

What Fishbowl collects

Apple's label for the app has no "Data Used to Track You" section. It lists contact info, contacts, your posts, search history, identifiers, usage and diagnostics as linked to you, with email, posts, search history, identifiers and usage data also used for the company's own marketing. Google Play's data safety section goes further: it lists sexual orientation among data collected, for app functions, analytics and personalisation, alongside an optional upload of your contacts.

The privacy policy is the Glassdoor one, revised on 1 July 2026, and it names Indeed, Inc. as the provider of both Glassdoor.com and Fishbowlapp.com. Under it:

• Your activity on the services is recorded, analysed and shared with affiliates, including other Indeed services.
• Personal data may be used to "develop, train, build and use statistical models, including AI".
• Data is treated as "sold" or shared under US state privacy laws, for targeted advertising among other uses. You can opt out through the "Do Not Sell or Share" link in the app listing.
• Optional demographic answers, such as ethnicity, sexual orientation, disability and religion, are classed as sensitive.
• Direct messages are collected as personal data, and nothing in the policy says they are end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary.

Because the label leaves out the sale and sharing that the policy describes, we score privacy on the policy.

Is Fishbowl secure?

Have I Been Pwned lists no Fishbowl breach, and we found no public report of one. Glassdoor runs a public bug bounty on Bugcrowd whose scope names the Fishbowl website, API and Android and iPhone apps, with rewards from $50 to $7,000. The risk is less about what has happened than about what is stored: verified employers, real identities and private messages in the same system as anonymous posts. A breach of that data would hurt more than a leak of email addresses.

Who should be careful

People in small teams, regulated jobs or companies that watch what staff say in public should be most careful. A few habits help:

1. Post anonymously, not with your job title, if fewer than a few dozen people do your job at your employer.
2. Leave out dates, project names and details only your team would know.
3. Skip the optional demographic questions.
4. Do not upload your address book.
5. Treat direct messages as readable by the company, and move sensitive talk elsewhere.
6. Be wary of "referrals" that ask for money or personal documents. Real referrals never cost anything.

How we scored it

Regulatory record (87) is the strongest factor, with no fine or order found. Scams and harmful content (55) gives credit for verified members but counts the risk of being identified by colleagues. Security (60) reflects a clean breach record and a paid bug bounty that covers the app. Privacy (38) is the weakest, because of the shared Glassdoor and Indeed data pool, sale and sharing under state laws, AI training and sensitive data on the Android label.