You can let people reach you at a phone number or an email address. To do that you must first prove the value is yours, because a number nobody proved could be used to collect requests meant for whoever really holds it.
Add the value to your card, then tap Verify. The code is sent the moment you tap, with no second button, and the screen opens ready for the six digits:
The code expires in ten minutes. It can be received on any device that has that number — it does not have to be the phone running CHANNEL — and typed in here.
The screen offers Send it again, and for a phone number Call me instead. Both are there from the start rather than appearing after a failure, and the reason is worth knowing: the app cannot tell that a text failed. A carrier's refusal reaches our server minutes later, long after the screen has said the message went. So waiting for the app to notice would be waiting for something that never happens. If a text has not arrived in a minute, ask for it again, or take the call. For an email address, the app also says so if the address did not accept the message.
A verified value is a claim: this is mine, leave invitations for me here. Some values cannot carry that claim, so CHANNEL refuses them before it sends a code.
The editor says so while you are still typing, and the check is made again on our server before any code is sent.
The list of public numbers is kept on the server rather than inside the app, so a wrong entry can be corrected without a new version of the app. It starts empty, and a number goes in only once it is confirmed to be listed on a public site: locking a real person out of their own number is worse than the thing the list guards against.
A tick means this device proved control of the value, by the route shown (Verified by text, by call, by email). A call and a text are different proofs; the app records which, and never pretends one is the other.
A value you have not verified is inert: it is not published, and nobody can reach you at it. This is deliberate.
Removing a verified number or address asks first and names which one, because once you save it nobody can find you by it any more. Nothing changes until you tap Save; Cancel keeps it exactly as it was.
The app renews the right to collect at a verified number or address by itself, from the proof it already holds. That proof lasts a year, so you are not asked to do anything as long as it is current.
Carriers give an unused number to somebody new, which is why a proof does not last for ever. A number is proved again only once a year, or sooner if the server's signing key changes.
When the proof runs out, the value stops being published. Nobody can reach you at it, no invitation is collected there, and your card says so: Not being published. Prove it again to keep being found this way, with a Verify Again button beside it. Take a fresh code and it is published again. Nothing else is touched: your contacts, your conversations and your keys never depended on it.
A thing that has stopped working should say so rather than sit there looking fine.
With Find me by on for a verified value, anyone who knows that number or address can simply write to you. They do not send a request and then wait to send the message: their first message is the invitation.
You see it as a request with the name they call themselves and the value they used. Accept creates the contact and their message arrives seconds later, sealed. Decline removes the request. Block refuses it and refuses anything else from that sender, and the block outlives the request. They are not told either way.
The words they wrote are not in the invitation. Our server could read an invitation, since there is no key of yours to seal it to yet, so nothing but their name, their key and the value is put in it.
Settings > Privacy has Only Verified Senders, off by default and chosen for each profile. With it on, a request from somebody who is not already your contact is shown only if the sender's profile carries a stamp from our server saying its key completed a code check within the last year. A request without one is not shown and does not notify you, and the sender is told nothing. Your contacts are not affected. The Performance report counts the requests set aside.
Every request you do see says how long ago the sender's profile was made, or that its age is unknown, and whether the sender is verified. The stamps name no number and no address.
It does not prove who a sender is: anyone who can receive a code at some number can be verified.
Our server keeps no list of who is verified, and no list of numbers. A request left at a number is addressed to a slot derived from the number itself; only a phone that has proved the number can collect from that slot. With Find me by on, your device also leaves your public keys at that slot, so a stranger can seal a first message to you. A slot is an ordinary hash of the value, so our server files nothing under it: each record is kept under a second hash of the slot, made with a key the server holds apart from the records. A copy of the records without that key matches no list of numbers. Whoever holds both the records and the key can hash every possible phone number and match, and so recover each published number together with the public key left at it, and each number with a request waiting at it. The server also sees the slot in each request while it answers it. An address or a handle is harder to guess, and a guessed one can be tested the same way.
Only one of your profiles can present a number or an address, which means only one of them has Find me by for it. The app does not offer the tick on another, because two identities answering at one address would reveal that they share a phone.
Another profile of yours can still Verify that number or address. A Mac or an iPad has no phone number of its own, and a person's own number is the only one they have: tap Verify, take the code, and the proof is kept for that profile, to prove a handle with. The row says which profile presents the value. The value is not published on the profile that only verifies it, and nobody can find that profile by it. One thing is shared: the handles of both profiles are held under the same number's proof, which is the one fact our server could use to tell they belong to one person.
A profile nobody can find can still message anyone it has paired with, but nobody can start a conversation with it. Give each profile you want to be reachable at least one value of its own with Find me by on. If you put every number and address you have on one profile, there is nothing left for the others, which is what a handle is for: each profile can hold one, so a profile with no number of its own can still be reached.
A tick says this device proved the value is yours. Find me by says people may reach you at it. They are separate switches on purpose: a verified number can stay private, and it can still vouch for you elsewhere. A handle works on exactly that: it needs a verified phone number behind it as proof that a real person holds it, and that number can stay private on its own Find me by switch while the handle carries its own.
The same mark appears on somebody else's card: each of their numbers and addresses shows whether it can find them on CHANNEL. The rest are simply values you may text or call with.
When you pair, their card brings the numbers, addresses and handle that person has published — the ones they ticked Find me by and proved they control. Those go straight onto your copy of their card. There is nothing to approve.
They are only ever their published values, never yours and never another contact's, and they arrive marked as having come from them. A number or an address you typed stays, and theirs are added beside it. A contact holds one handle. Edit shows one Handle box. The handle their card advertises replaces one you typed. A card that advertises none leaves yours.
If one of them is wrong, delete it from their card. That is remembered, so their next card cannot put it back.
A handle is a name you choose that people can reach you at without knowing your number or your address. It is the one value here meant to be given out freely, and you can change your number without telling anybody.
Claiming one. Open your own card and tap Edit. Type the name and tap Claim this handle. Three to twenty characters, lowercase letters, digits and underscores. Some names are kept aside so that nobody can use one to look like us. No handle may contain the word channel, however it is spelled, and neither may the name on a profile or on your own card. A message whose sender does not carry @channel is not from CHANNEL.
You need a proven phone number first. Until a phone number on your card is verified, the button does nothing and the screen says so. A verified email address can be published, but it cannot claim a handle. That proof is what stops one person taking every name. It is never published, and nobody can work back from your handle to it: what our server keeps for a name is a keyed hash it can only recognise when the owner presents the proof again, not your number. While a number is typed but not yet verified, the handle box says Tap Verify to get a code by text, then choose your handle.
If Claim is refused, the screen says why, right under the button. A proof older than a year shows a Verify again button beside the reason, so proving the number again and claiming are one place rather than two.
Writing to someone at a handle. Put @name on their card the way you would a number, and write. CHANNEL works out where to leave the invitation from the name itself, so there is no directory to ask and no route that answers who is @name. Writing to a name nobody has claimed looks exactly the same as writing to one somebody holds, which is the point.
It travels on your card. Your handle goes to the people you pair with, alongside the numbers and addresses you marked shareable, so they can reach you at it without you dictating it. If a contact's card is named after the handle you reached them by, that is why: the value somebody publishes is the only name you have at that moment, and it is one they chose. Rename them to whatever you like — what you write never changes when their card updates.
One each, ten in all. Each profile can hold its own handle, up to ten across the phone, and nobody else can hold one you hold. It sits at the top of the list of ways to be found, above your numbers and addresses, and carries its own Find me by tick, the same as a number does. Ticked, people can write to you at it; unticked, it stays yours — it still renews on its own schedule — but nobody can reach you there and nothing is collected at it. It starts ticked the moment it is claimed, so nothing changes for a handle you already hold.
If the Claim button will not light. A handle is three to twenty characters, lower case letters, digits and underscores, and an underscore cannot start it, end it or be doubled. When what you have typed breaks one of those, the screen says which in a line under the field rather than leaving you to work it out. A dash is the one people try most: use an underscore instead. The reason is the same one that makes two handles differing only in case a bad idea — a dash shares its shape with a whole family of other dashes, and a phone that helpfully turns one into another would hand somebody a name that reaches nobody.
Giving one up. Give up this handle releases it. It stays yours for thirty days, so a change of heart is not a change of owner. After that it reaches nobody at all, and nothing is forwarded.
Removing the only verified number or address behind your handle releases the handle too, but not the moment you answer the question — only when you tap Save. Until then its row says Released when you save., and Cancel keeps both. If the release cannot reach our server, nothing is saved.
Numbers, addresses and handles do one job: they are how somebody who is not yet a contact finds you the first time. Once you are paired, nothing here is used again. That is why it is worth spending a minute on which profile advertises what — it decides who can reach you out of the blue, and on which face.
When you accept somebody, your card goes to them with every number and address this profile publishes, and those work outside CHANNEL as well: for marketing, for harassment, or to find out who you are. A handle gives none of that away, which is why it is the safer thing to publish on a profile strangers can reach.
Three rules shape every arrangement below:
Say Joe has two numbers — one personal, one for the business — and three addresses.
Friends and family. His personal number, his personal address, and @joe. The number is what people already have in their phones, so it is the one that gets used; the handle is what he gives to someone new without handing over the number.
Work. The business number and the work address. No handle, because colleagues reach him by the number on his email signature and a name would only be another thing to publish.
The hat business. A handle on its own — @joehats — claimed against the business number he already proved for the work profile. Buyers reach him at a name that says what it is, and his number stays out of it. One proof, two profiles, no second SIM.
Private. Nothing advertised. He pairs in person or sends a one-off code, and this profile cannot be found by anybody who has one of his numbers or addresses, because it does not answer to them.
That is four profiles on two numbers, and only two values were ever verified.
Other shapes work just as well. A profile can carry several — two numbers and three addresses on one card is perfectly ordinary if that is your only public face. Or invert Joe's arrangement: publish nothing anywhere except one handle, and give that out instead of a number for the rest of your life. The app does not have a right answer here. What it guarantees is that each value points at exactly one of your profiles, so nothing you publish can deliver a stranger to a face you did not mean them to see.
A value you tick is left with our server so that somebody who knows it can find you. That is what being findable means, and it is worth stating plainly rather than burying: our server can see that somebody is published at that value, though not who they are or who reaches them. A profile that advertises nothing leaves nothing there at all.
A handle is anchored to the value that proved it, and a handle cannot be moved to a different number. If you are changing numbers and want to keep a name, give the handle up from the phone that still holds it — it stays reserved for thirty days — and claim it again once your new number is verified.
Do it in that order and while the old number still works. There is no way to move a name from a number you have already lost.
English is the reference text; any translation is a convenience.
CHANNEL