diff --git a/app/lib/differential_privacy.rb b/app/lib/differential_privacy.rb
new file mode 100644
index 000000000..beeedc2ae
--- /dev/null
+++ b/app/lib/differential_privacy.rb
@@ -0,0 +1,6 @@
+module DifferentialPrivacy
+  def self.flip(value, substitute)
+    return value if rand(2) == 0 # first flip
+    rand(2) == 0 ? value : substitute # second flip
+  end
+end
diff --git a/test/lib/differential_privacy_test.rb b/test/lib/differential_privacy_test.rb
new file mode 100644
index 000000000..08ad439c2
--- /dev/null
+++ b/test/lib/differential_privacy_test.rb
@@ -0,0 +1,18 @@
+require "test_helper"
+
+class DifferentialPrivacyTest < ActiveSupport::TestCase
+  test "basic flip" do
+    value = 1
+    substitutes = (1..10).to_a
+    results = 1000.times.each_with_object({}) { |_, memo|
+      result = DifferentialPrivacy.flip(value, substitutes.sample)
+      memo[result] ||= 0
+      memo[result] += 1
+    }
+    hit_percentage = results[value] / 1000.to_f
+    puts results.inspect
+    puts "True Value: #{hit_percentage * 100}%"
+    puts "Fake Value: #{(1 - hit_percentage) * 100}%"
+    assert hit_percentage.between?(0.65, 0.85)
+  end
+end