They double ROT-13 the email address that each side collected so they can correlate, but not identify, individual consumers -- or something, TFA didn't specify the actual encryption algorithm.