Every message is sealed on your device to the contact's key and opened on theirs. Nothing in between can read it: not our server, not the Wi-Fi, not a phone carrying it for you.
Each message is sealed under a key used once and then thrown away, and the keys move on with every reply. Somebody who recorded your messages on their way and later got this device's keys could not open the ones already received, and keys copied at one moment stop working after the next exchange. What is saved in your conversations is on the phone itself, and the app lock is what protects that. Between two phones that both do this, it covers photos and videos too; a phone that does not is sent what it can read.
Your own messages are blue when they went out through CHANNEL, sealed to the other phone's key. They are green when they went out as a plain text message, which nothing about CHANNEL protects. The colour says what protected the message, and nothing about who is holding the other phone.
Messages to yourself, on another device of your own, are a colour of their own.
A message an AI wrote is drawn in that AI's own colour with white text, and a screen reader says Written by an AI. On this Mac that includes what your own AI sends through the Local API or Automatic replies.
Lines from CHANNEL itself — the day, a call, somebody joining or leaving a group — sit on a small red label with white writing, so they never read as something either of you wrote and stay legible over any wallpaper.
Long press anywhere in a conversation and choose Info. Near the bottom it counts anything that reached this device and could not be opened.
If that count is zero, nothing arrived at all, so a missing message is a problem with the path — the other phone never got a chance to send it, or it is still waiting. If the count is not zero, bytes did arrive and no key on this device would open them, which is a different problem and needs the two of you to pair again.
A small coloured disc beside a message carries one letter: B, W, L, 6 or I. It says which path actually carried that message. B, W and L mean a radio did it alone and the message never touched the internet. 6 means the two phones reached each other straight over the internet, with no server in between. I means our server carried it. A photo or video goes in pieces, and when the pieces take different paths it shows the least private of them: one piece over the internet makes it an I. The letters are always written in that order, B W L 6 I, which is the order CHANNEL tries the paths in. See Reach.
One other letter can appear on a message: an S, in the app's warning colour, on a message that went out as a text. It is not one of the five, and it is never among the letters under a contact's name.
One disc. When the other phone tells yours which path your message arrived by, the disc shows that path; otherwise it shows the path that took the message from your device. The Messages list shows the same disc as the conversation.
If the app closes or crashes with a message still on its way, it sends it again when it reopens. Each message carries its own private label inside the encryption, so the phone at the other end recognises the second copy as the same message and shows it once.
Opening a conversation leaves the keyboard closed, so the messages are what you see first. Tap the message box and the keyboard rises; it stays up while you send and while new messages arrive, and a tap on the conversation puts it away. A conversation with no messages yet, and a link that asks to compose, open with the cursor in the message box. A broadcast list opens with the cursor in the message box.
The composer's own button is one green circle: a white microphone with a small camera beside it (the AV message button) while the message box is empty, and a white arrow pointing right once there is something to send. Tap the arrow to send text, a photo, a video or a voice message — they all go the same way.
A tick under your own message follows it. Long press an outgoing message and choose Info for the three times: Sent, Delivered and Read.
Sent means the write completed. Not that it was queued, not that a radio was in sight: the other phone took the bytes. By Direct Wi-Fi or the local network the clock stays until their phone confirms the message, usually within a second: on a shared network, the phone that took the bytes cannot be proved to be theirs.
Delivered means their phone has it. For a text in a one-to-one conversation, an iPhone that shows the notification also sends the second tick from it, even when the app itself is not allowed to run in the background. Accepting a message request sends the sender a delivered tick for the first message right away, rather than waiting until you read it.
A read time appears as soon as they see it, including while they already have the thread open in front of them. A thread left open on a locked phone, or behind its conversation PIN, marks nothing read until it is on the screen again. Read receipts are both ways or neither. Switching them off stops you sending them and stops you seeing them. Coming back to CHANNEL checks for new ticks straight away.
A message that went by the Internet waits on our server until the other phone collects it. If nobody has collected it after a week, a line under the bubble says Nobody has picked this up yet; when the server lets it go, at the end of the wait chosen under Undelivered mail waits in Settings, the line says that instead. It only ever repeats what the server said. It never claims the other person ignored you, because CHANNEL cannot know that. The line appears in one-to-one conversations: in a group, each person gets a separate envelope, so there is no single answer to repeat.
In the Messages list, the same tick sits before the last line of a conversation when that line is yours: one tick sent, two delivered, coloured when read, a clock while it waits, a warning when it failed.
A small symbol before the last line of a conversation says what kind of message it is: a photo, video, voice message, location, file or poll. Typed text has none.
While you both have a conversation open, each of you sees "typing…" under the other's name, in the conversation and in the Messages list. In an informal group it says who is typing. It goes only directly between the two devices, by Bluetooth, Direct Wi-Fi, the local network or a direct internet link, never through our relay; when none of those reaches them, they see nothing. Settings › Privacy › Typing Indicators turns it off for a profile, and a contact's page can turn it on or off for one person. Off works both ways: you neither send it nor see it. The other person also learns when you have their conversation open.
A clock beside a message means it is waiting. Nothing could carry it yet, so it sits on this device, sealed, and nothing has been given to anyone.
CHANNEL tries again on its own: every 30 seconds while the app is open, when you bring the app forward, when you tap Check Now, and when you open the conversation. You do not have to resend it. If a contact is set to wait before the internet may carry a message, the clock is also what that wait looks like.
A message sent by a nearby path to somebody who takes nothing over the internet goes back to a clock when no second tick follows: nothing has confirmed it arrived, so CHANNEL sends it again by the nearby paths. For a photo, a video or a file it sends the first slice again, and their phone then asks for whatever else it is missing.
The box at the top of the Messages list searches people and what was said. A name, part of a name, a handle, a phone number or an email address finds the conversation, and a number matches however it is written — 803-960-6701, 8039606701 and +18039606701 are one number. The last few digits are enough.
Below the conversations, Messages lists every message that contains what you typed, newest first, with those words in bold. Tap one to open the conversation at that message. It searches every profile on this device except one with its own PIN, which is searched only from inside that profile, and on a phone marked as shared it searches only the profile on screen. A view-once picture and a message past its timer are never found. The search runs on the phone, and nothing is sent anywhere.
A conversation you renamed is listed under the name you gave it, but anyone who can search this device can find it by its words.
Search, in a conversation's own menu, looks inside that one conversation instead. It opens a search field where the name and letters were; typing shows how many messages match and highlights them in the thread, and the up and down arrows move between matches, newest first. The same rules apply as above: a view-once picture and a message past its timer are never found, and the search runs on the phone.
On iPhone and iPad, a conversation with unread messages opens at the first unread one, and a conversation with nothing unread opens at the newest message.
The row of chips under the search box filters what the Messages list shows: All, Unread, Groups, then any list you have made. Tap + at the end of the row to make one — give it a name and choose which conversations belong to it. A conversation you add to a list also stays in All; a list is a shortcut, not a move. The last chip sets the order: a clock for most recent first, abc for A to Z; tap it to switch.
Long press a list's own chip to rename it, change its conversations, or delete it. Deleting a list leaves every conversation where it was. To add a conversation to a list from the conversation itself, long press it and choose Add to List.
A list with nothing in it yet says so, with a note about where to add a conversation. Removing a conversation from your conversations also removes it from every list that named it. Conversation lists are kept on this device, for this profile, and are never sent anywhere.
Text you have typed in a conversation and not sent stays in that conversation, also after you leave it, switch profile or restart, and the Messages list shows it in place of the last message, after a red “Draft:”, until you send it or clear it. A photo, video, file or voice take you have staged and not sent also stays with its profile when you switch profile, and a video that is being prepared for sending carries on and is sent from the profile it was started in.
Tap … at the top of the Messages list and choose Select Conversations. Tap conversations to tick them; the number ticked shows at the top. Along the bottom, Archive, Mark as Read and Delete act on the ticked conversations and nothing else. Mark as Read sends read receipts, as opening each conversation would. Delete asks first, and removes the messages from this device only. Done leaves without changing anything.
When the window is wide enough, the sections — Messages, Calls, Contacts and Updates — run down a garnet sidebar at the left edge instead of along the bottom, the name beside each icon and a count at the end of a row that has one; the section you are in is highlighted, and your profile sits at the foot of the sidebar. The list and the open conversation sit side by side. Drag the line between them to make the list wider or narrower; this device remembers the width. With nothing open, the right side shows CHANNEL Messenger, the version you are running, and Your messages are end-to-end encrypted with a lock, which is true of every conversation, groups included. On a phone, the same line sits under the Messages list.
Media, Pinned Messages and a broadcast list, all at the top of the Messages list, open on the right side the same way a conversation does, and a conversation's own Media, Files and Links opens in that conversation's side with a Back arrow to it.
The chips under the search box wrap onto a second line when the list is narrow, so none is hidden.
You do not need a contact first. The large + at the top of the Messages list opens New Message, which takes a phone number, an email address or an @handle in its search box, for somebody who is not in your contacts at all. If they published that value in CHANNEL, your message reaches them straight away and the app says They are on CHANNEL. If nobody has published it, the app says Invitation left: nothing is published there, and your message waits. After the first message to somebody new, their conversation opens, with what you sent in view.
If the number, address or handle you typed turns out to belong to somebody already in your contacts, your message goes to the conversation you already have with them, and that value is added to their card: @x is Mary, already in your contacts. The message went to your existing conversation. Asking such a person to call sends nothing, with the same notice, and tells you to call them from that conversation instead.
Under its search box are Create Group, New Broadcast List and Link to Someone, then Frequently contacted — the five people you have exchanged the most messages with over the last three months — and then everyone, A to Z.
You can also write to anyone already on a card with a number, address or handle, paired or not. Type the message and send it.
When nothing was published, the message files with a clock, and CHANNEL leaves an invitation at that number or address. One line above the composer says where it stands: Sends when Mary accepts, then Waiting for Mary to accept. The moment they accept, the keys are exchanged and your message goes out sealed, with no further tap from you.
The other side sees a request with your name and the value you used, and chooses Accept, Decline or Block. Your words are not in the invitation, because the invitation is the one thing our server could read. See Pairing.
CHANNEL is always the default and always the quickest thing to do. Picking somebody you are already paired with opens the conversation straight away, with nothing to choose.
When you write to somebody who is not paired, the compose box that opens has a second part under it, Or send it another way, listing the other apps on their card that this device actually has — the phone's own messaging app, WhatsApp, Signal or Telegram. The same list is on their contact card, under Message another way, for when you want it later.
Tapping one of those leaves CHANNEL. The phone's messaging app and WhatsApp open with what you have typed already in the box; Signal and Telegram open on a conversation with that person, and you type it there. In every case you are the one who taps send, and it goes from your own number.
A message sent that way is not a CHANNEL message and nothing about it is protected by CHANNEL. It travels however that app or the phone network carries it.
An app only appears if it is ticked on that person's number on their card, and if it is installed on this device. If the list is empty, there is nothing there this device could hand the message to.
Somebody who is not yet a contact can ask you at most three times a day at each handle, number or address you publish. Further requests that day wait, without a notification, and come in on a later day. Once you accept one of their requests, theirs have no daily limit.
Decline five of their requests in a row at the same handle, number or address and they are blocked, exactly as if you had tapped Block. Accepting one starts the count again. They are listed under Blocked in Settings, where you can unblock them.
Group invitations work the same way: one a day for each group, and five declined in a row from one person blocks that person. Accepting one starts the count again, and their contact page unblocks them.
Your phone does the counting, and the counts stay on it. A sender's phone knows only what it sent: after three requests in one day at one address it says Asked enough for today and sends nothing.
Select a word or a phrase in the message box, and the menu that opens (a long press, or a right click with a mouse or trackpad) has Format: Bold, Italic, Underline, Strikethrough and Monospace. The words change as you choose, and they arrive the same way. Choose the same one again to take it off.
Typing works too: bold, _italic_, ~struck through~, a backtick on each side for fixed-width, three on each side for a fixed-width block over several lines. The message box shows the formatting, never the marks. A mark counts only against a word, so 234 and file_name stay exactly as written, and a mark inside a web address or a handle is never read as formatting. Underline is offered when everyone in the conversation has a version of CHANNEL that shows it.
Formatted text keeps its formatting when you paste it into the message box or share it into CHANNEL from Notes, Pages, Word, Mail or a browser: bold, italic, underline, strikethrough and fixed-width stay, and fonts, colours and pictures do not. Copy on a message puts both the plain words and the formatted version on the clipboard, so a plain field gets the words and Mail or Notes get the formatting.
A long text shows its first ten lines, with Show more under it; Show less folds it back.
Long press a message and six emoji appear at the top of the menu: 👍 ❤️ 😂 😮 😢 🙏. Tap one and it attaches to that message on both phones. Tap the same one again to take it off. You get one per message; choosing another replaces yours, and it never touches theirs.
A + beside the six opens the emoji keyboard, for any one emoji; a reaction is one emoji and nothing else. On a phone the menu line More Reactions does the same, on every message, yours included.
A reaction is deliberately quiet. It does not move the conversation up your list, does not count as unread, does not change the line under the name, and does not notify anybody. If it names a message that has since disappeared or expired, it is simply not shown.
Tap + beside the six for any other emoji, from your keyboard. It works the same way: one per message, and choosing it again takes it off.
The same menu for everything. A text message, a picture and a video all give you this one long press. What is in it changes with what you pressed — there is no Copy for a video — but you are not learning three different menus. A voice message and a file take reactions, Reply, Pin and (on your own) Info the same way; a voice message's long press also offers Transcribe, which writes out what was said underneath it.
Long press a message and choose Pin. A small pin appears on it, and the conversation's ⋯ menu gains Pinned Messages — the pins in that conversation, oldest first. Tapping one takes you back to it in the thread.
Every pin in one place. When anything is pinned, the top of your Messages list shows Pinned Messages with every pin from every conversation, newest first. Tapping one opens that conversation at the message. A pin goes when its message goes, so a disappearing message leaves this list when it disappears.
Everything shared, in one place. A conversation's ⋯ menu has Media, Files and Links: its pictures and clips, its files and voice messages, and its links. Media, at the top of your Messages list, is the same for every conversation of the profile you are using, grouped by week, with who sent each one. It never shows another profile's conversations, and a view-once picture appears in neither.
Two different things share the word. Pin to Top in that same menu pins the whole conversation to the top of your list; Pin on a message keeps that one message. The two sit next to each other so the difference is visible. Pinned conversations lead your list. The rest follow by their newest message, as the word Recent under the search box says; tap it for A–Z, which lists them by name. A pinned conversation shows a pin beside its time, and its contact page has Pin to the Top of Messages, which pins or unpins it. In the Messages list, a long press on a conversation offers Pin, or Unpin when it is already pinned.
On a Mac or an iPad, that long press also offers Open in New Window, which opens the conversation in a window of its own beside the list.
A pin is yours alone. Nothing is sent, and the other person is never told you pinned something — which is deliberately unlike WhatsApp, where a pin is shared with the conversation.
Every message somebody sends you has a small speaker beside its time. Tap it and the phone reads the message; tap it again to stop. That is the whole feature for most people, and it is one tap because the moment you want it is usually the moment you cannot look at the screen.
Long-press the speaker to read that one message in a particular language, without changing anything.
Read arrivals aloud is in the ⋯ menu at the top of a conversation. Turn it on and each message that arrives while you are in that thread is read as it lands. It is per conversation and off until you ask for it — a phone that suddenly starts speaking every thread out loud in a room is worse than one that speaks none. While it is on, a speaker appears at the top of the conversation; tapping that turns it off.
Voice language, on a contact's card, sets the language of the voice that reads that person's messages aloud. Leave it on Detect automatically unless somebody writes the same language every time. Detection is right most of the time and wrong on exactly the messages a conversation is made of — "Ok" and "Si" look alike in every language.
All of it happens on the phone. Nothing is sent anywhere to be spoken, which is the only reason this feature belongs in CHANNEL at all.
It is for hands, not for eyes. One tap while driving or cooking. If you need your device to read things to you because of your sight, turn on the phone's own feature instead — Settings ▸ Accessibility ▸ Spoken Content on an iPhone, Settings ▸ Accessibility ▸ Select to Speak on Android. Both work everywhere, not only here, and use the voice and speed you have set.
A tap opens it full screen. Pinch to zoom, drag to move around, double tap to go in and out, and the × in the corner closes it. At normal size a single tap closes it too; zoomed in it does not, because a tap while you are zoomed in is usually somebody steadying the picture.
A picture also carries the same letter as a message does, under it, saying which way it reached you.
A tap plays it full screen, with the player's own controls for pausing and moving through it. Pinch to zoom while it plays, and drag to move around once you are zoomed in. Pinching back to normal size recentres it.
A Live Photo on iPhone, and a motion photo on Android, is a picture with a moment of movement and sound around it. One arrives as a picture with LIVE in the top corner: tap it and it plays where it is, with its sound, and settles back to the still. An iPhone and an Android phone send and read each other's.
Sending one says what goes with it. The preview before you send carries a switch, Send as Live Photo, and a sentence under it: a Live Photo holds about a second and a half of video and sound from either side of the moment you took it, and that includes sound recorded before you pressed the shutter. Turn the switch off and only the still picture goes. The same switch is in Settings under Send Live Photos, and it decides what happens when you send several pictures at once.
The still you see in the bubble is the frame from the middle of that second and a half, which is the photograph you took rather than the moment before it.
None of these appear on a view-once picture. That one is shown and then gone. None of them appear on a thread with Enhanced Conversation Privacy on, either — see below.
A picture you have staged in the composer but not sent yet has the same menu. There, the answer from Ask AI About Photo lands in the caption field, ready to send, and nothing is sent until you send it.
Set a timer on a conversation and every message you send after that carries it: the message is removed from both phones once it has been seen and the time has run. Your timer covers the messages you send, and their timer covers the messages they send; both phones remove each message when its sender's timer runs out, and only messages sent after a timer is set are affected. A thin banner under the top of the conversation names each timer that is on, yours as one line and theirs as another, and tapping a banner opens the timer choices. When either of you turns the timer on, changes it or turns it off, the conversation shows a line saying so, such as You turned on disappearing messages: 30 days. A group works the same way, and so do pictures and videos.
The green circle at the end of the composer, with a microphone and a small camera, records an audio or video message (AV message). Tap it; it turns into the send arrow the moment you start typing. Speak, then send it or tap the bin. A voice message records up to 4 minutes; at the limit the recording stops and waits for you to send it or delete it. On iPhone, if the microphone is refused, the notice says CHANNEL needs it and offers Open Settings; if the recorder does not start in time, it says so and you try again.
Auto Send is the switch in the recorder panel that opens when you tap the microphone. With it on, the microphone keeps listening: when you pause for about a second, what you said is sent as a voice message and recording carries on, and when you pause for about three seconds, the microphone turns off. The cut falls in the middle of the pause, so no word is clipped, and a steady noise such as a fan or an engine does not count as talking. Each part is sent in the background, so recording never stops while one goes. Stop ends the session and sends what you were saying; a session lasts at most five minutes, and a notice tells you when the limit ends it. A phone call, locking the screen or leaving CHANNEL also ends the session and sends what you were saying. Each part is an ordinary voice message, and nothing plays while you are recording. The green Send arrow beside Stop sends what you have said so far at once, and recording carries on. The Auto Send switch works for the whole recording: in the first three seconds a flip starts the take again, and after that what was recorded is sent first. While a plain recording runs, the switch sits above the recording bar.
The Video switch records a video message instead: with Auto Send on, the camera stays on and each part is a video of that stretch of speech, taken from the camera that faces you. The Auto Send and Video switches work for the whole recording: in the first three seconds a flip starts the take again, and after that what was recorded is sent first. On iPhone, with Auto Send off the Video switch opens the ordinary camera, Switch camera turns it to the back camera, and both switches sit in a strip along the bottom of the camera. On Android, the Video switch sits with the Auto Send switch above a plain recording, and turning it on starts Auto Send with video.
On iPhone, a voice message cuts the sound around you and keeps your voice, for the plain recorder and for Auto Send. Turn Reduce Noise in Voice Messages off in Settings › Messages to record exactly what the microphone hears. A video message's sound is not changed.
A voice message becomes text under the message, made on this device, while Transcribe Voice Messages Automatically is on in Settings › Messages. It is on by default, and each profile keeps its own choice. The text appears for voice messages that arrive and for ones you record, when the phone can recognise that language without the network and has speech recognition allowed. It does not start during a call, and a play-once voice message is never turned into text. With the switch off, Transcribe on a voice message still writes it out. When the recogniser is unsure, or recognised a language other than the phone's, a small line under the words reads Transcribed as with the language; tap it to pick another language, and the voice message is written out in that language on this device.
A voice message travels exactly as a photo does. That matters when you have no signal: it waits on your device, sealed, and goes the moment Bluetooth, Wi-Fi or the internet can carry it — you do not have to be in the app when that happens.
Tap play to listen. One voice message plays at a time. While it plays, the button beside it sets the speed: 1×, 1.5×, 2× or 0.75×, and CHANNEL remembers it for that person, so someone who talks slowly can always play faster.
When a voice message finishes by itself, the next message plays on its own if it is a voice message from the same person, directly after it with nothing else between. It carries on down the run and stops at anything else. A play-once voice message never starts by itself, and nothing plays while you are recording. The run only follows a message you started with a tap, and the conversation scrolls to keep the playing message in view if you were watching it. On iPhone, a video message that finishes in the full-screen player hands over to the next message when that is also a video, directly after it with nothing else between and not play-once. Any other message ends the run, and a voice message does not follow a video or the other way round.
On iPhone, if the audio system does not answer, CHANNEL says it could not start recording and nothing is recorded. Try again in a moment.
A photo sent view once is shown one time and then removed. The recipient's phone shields it from screenshots while it is on screen.
A voice message can be sent the same way, and there it means played once: it plays through one time and is then gone. There is no screenshot shield on a voice message, because there is nothing on the screen to photograph — and it would not help if there were. Anyone can hold up a second phone and record sound far more easily than they can photograph a screen. Play once removes the copy on their phone; it cannot stop a person in a quiet room with a recorder.
A video message recorded with Auto Send can be sent the same way: with the play-once button on (on Android, the Each part plays once switch), each part is its own play-once video.
A text or a shared location can be sent view once too, to somebody whose own CHANNEL is new enough to receive it — the button offers it only then, and says so otherwise. The bubble on both phones shows only that a view-once message or a view-once location arrived, never the words or the place, until the recipient taps to open it. A text is read in the bubble itself: a tap shows the words there, and a second tap, leaving the conversation, switching profile, or opening another view-once text removes them from the phone for good and marks the message Opened. While the screen is being recorded or shared the bubble stays covered. A location opens full screen and closing it removes the place for good. Both are shielded from screenshots the same way a view-once photo is while they are open.
A group conversation does not offer View once. The switch is not shown there, and a picture, a clip or a voice message sent to a group is an ordinary one that every member keeps. Send it to each person in their own one-to-one conversation to send it view once.
A camera pointed at the screen can still record any of these. The shield stops a screenshot and a screen recording; it cannot stop a second phone held up in front of the first one.
If they never open it, it does not wait for ever. A view once that is still unopened after two weeks disappears from both phones, theirs and yours. A view once is never included in a backup, opened or not, and it is removed from our server the moment it is delivered — so there is nowhere it ends up except, briefly, on their screen.
On a profile shared to several devices, a view-once item is seen once across all of them. The device that opens it first tells your other devices with a small sealed note that carries only ids and goes only to your own devices, and they remove their copies. Two devices that open it within moments of each other can both show it, and a device that is offline when the other one reads can still show it until the note reaches it. Like any message, the note travels through the relay or nearby radios, so the network can see that something was sent at that moment.
A switch on a contact's page. Turn it on and, for both phones, nothing from that conversation can be saved, shared or forwarded, no AI feature reads it, notifications show no preview, and an Android phone blocks screenshots of it. Either person can turn it on, and it stays on until both turn it off — the card says when it is the other person's switch that is holding it.
It is a real restriction on the two phones and nothing more. Another camera can still photograph the screen.
You can put a picture behind one thread, so two conversations do not look alike. Open the contact and, under Wallpaper, tap Use a Photo. Once one is set the button reads Change Photo, and Remove Wallpaper appears under it.
After you pick a photograph, drag it to choose which part shows behind the conversation, then tap Set. Nothing is cut from the picture; the part you chose is the part that stays in view.
CHANNEL dims the picture as much as it needs to so the writing stays readable. A bright photograph is dimmed more than a dark one, and even a middling one is dimmed a little, because the dates, the marks and the time under a photo sit on the picture rather than in a bubble. Messages keep their own solid bubbles, so the words are exactly as legible as they were before. No picture is ever refused for being too bright or too dark: it is dimmed instead.
A wallpaper is a decoration for your own screen. It is never sent, never received, set for one contact at a time, and it goes when the profile it belongs to goes.
A conversation's page shows Storage: the room its pictures, videos, files and voice messages take on this device. Tap it to see them largest first. Select, pick the ones to go, or Select All, then Delete from This Device. They are removed from this device only; the other person keeps theirs, and so do your other devices. Swipe left on an entry, or press and hold it (right-click on a Mac), for Save to Photos on a picture or video, Save to Files on a file or voice message, and Delete from This Device. Save is not offered in a conversation with enhanced privacy, and in Secure Mode it asks for your PIN first.
The smiling face inside the message box opens the stickers: Recent first, then smileys, people, animals, food, activities, travel, objects, symbols and flags. A tap sends one at once, and the panel stays open for the next. A sticker is drawn large and without a bubble.
The stickers are part of the app, and nothing is fetched to show them. They are Microsoft's Fluent Emoji, used under the MIT License; see Third-Party Notices.
A GIF arrives moving. Long press one in a conversation and choose Save GIF to keep it in this profile's Saved GIFs, on this device only. The Saved GIFs tab in the stickers sends one with a tap; Import there adds GIFs and short MP4 clips from Files. To bring GIFs over from WhatsApp, share them from WhatsApp to CHANNEL, or save them to Files and import them. There is no GIF search.
Tap +, then Poll, in a group conversation, write a question, add two to twelve options, and choose whether people may pick several answers and whether the poll closes at a set time. A poll is for groups; a one-to-one conversation does not offer one. The poll goes to every member whose app reads polls, and the sheet says how many members cannot see polls. Tap an option to vote, tap it again to take the vote back, and tap another to change it. Before you vote, a poll shows the question, the options and how many people have voted. Once you have voted, or when the poll is closed, each option shows how many chose it, the percentage, and by name who chose it, and every member sees each other's answers. The person who made the poll sees results the same way as everyone else. Close poll under your own poll ends it, and a poll with a closing time ends by itself; when a poll ends, a Final results message with the counts is added to the conversation. Polls in the conversation menu lists every poll in the conversation. A poll sits in the same bubble as any other message: blue when you sent it, grey when it came to you.
Under it: Photos and Videos (the phone's own picker, running outside the app), Camera, Location, File, Poll and Send Later. One entry for both, and you can pick up to 24 at a time. Photographs and clips can be mixed in one selection. CHANNEL asks for a caption once, for the whole batch, and puts it under the last item so it reads as a title for the set rather than being repeated under each one. Leave it empty and nothing is written.
Every item you pick appears in the thread straight away, each with its own progress, so you can see which ones are on their way and how far each has got. A dozen clips take a while to compress and seal, and you can read and answer messages the whole time: the conversation stays yours while the batch goes out.
The screen that shows a photo or video before you send it names who it is going to — the person, or the group. One line, above the picture, so a clip meant for one person is not sent to a room by a mis-tap.
The camera is in this menu and also has its own place on the composer's upper row, beside Paste, so it is one tap away without typing anything. The camera opens with PHOTO and VIDEO under the picture; one shutter takes whichever is selected, and nothing is sent until you have seen it and tapped the send arrow. Pinch the picture to zoom, for a photo and while a video records; a small readout such as 2.0x shows the zoom, and it returns to 1x each time the camera opens or switches. On iPhone, a line on the camera screen, Tap for a photo, hold for a video, shows until you have taken a picture or a clip once. A photo and a video come out the way up you hold the phone.
Tap +, then Send Later, write the message and choose a day and time. It waits on this device and goes at that time, or as soon after it as CHANNEL is running, and appears in the conversation when it goes. A line above the message box says how many are waiting; tap it to send one now or delete it. Text only. Nothing reaches our server before the time comes. Long press the send button and choose Send as Urgent to mark a text urgent: a small exclamation mark shows on it for both of you, and it gets a banner and sound through the other person's quiet hours when their Let Urgent Messages Through switch is on.
Tap + and choose File. The phone's own file picker opens outside the app; pick anything. CHANNEL shows the name and size and asks once before sending. The file travels sealed like any message, and the other person sees a name, a size and an icon: nothing inside it is drawn. Tapping it hands the file to their phone's own Share sheet, where Open in and Save to Files live. CHANNEL itself never opens it.
On a Mac or an iPad, drag a file from Finder or Files onto the open conversation. It is staged exactly as File stages it, with the name and size and the same question before anything is sent; a picture or video goes the way one from Photos and Videos does. Words dragged from a page or a document go into the message box as words, and a file dropped on the message box is staged as a file, never read into it as text. Programs are refused and the size limit is the same.
CHANNEL does not send programs (.exe, .apk, .bat, .cmd, .scr, .msi, .com). That stops an accident, not a determined sender: a zip goes through. Whatever arrives, nothing runs until you open it in another app, and that app applies its own checks. The size limit is whatever that contact's phone can receive; if the file is bigger, CHANNEL says so before anything is sent.
Opening a file hands it to another app on your device, which handles it under that app's own rules rather than CHANNEL's.
While a file is sending, its row offers Cancel, at any size. CHANNEL asks Stop this transfer? first. If you confirm, it stops sending, forgets the sealed copies it made for that file, and marks the message Cancelled. A cancelled file offers neither Resend nor Cancel. When the other person cancels a file that is arriving, the part that has reached you is removed from the conversation. Deleting a file whose sending has not finished also withdraws it from the other person's phone.
Forwarding, sharing from another app, starting a group, adding people, a Messages list and a broadcast list all choose on the same screen. Where groups can be chosen as well, it lists Recent Conversations first, then Contacts, then Groups. Tap each one, then the button, which says how many. A forward or a share goes to up to 256 at once.
The button at the top switches between two ways of showing it: chips, with a search field and everyone chosen along the top, each with a cross to take them off, or a plain list with a tick beside each. The phone keeps whichever you chose.
On Android, CHANNEL is in the Share menu of Photos, Files, a browser and any other app that shares pictures, videos, files, links or text. Choose CHANNEL, then the people and groups it is for. With one conversation chosen, that conversation opens with the item ready, and nothing goes until you press Send; several photos or videos at once go as one batch, up to 24, with one caption. With several conversations chosen, Send sends it to each of them: its own copy to each person, one message in each group.
On iPhone and iPad, CHANNEL is in the Share menu as well. Choose CHANNEL, then open CHANNEL, which asks who it is for on the same screen. One share carries up to 10 photos, videos or files. With one conversation chosen, each opens there in turn, to send or skip; with several, Send sends it to each of them. A person the Share menu suggests goes straight to their conversation.
Tap Location under +:
CHANNEL never reads your location at any other time.
While a live share is running, CHANNEL asks our server to wake your device every few minutes so it can keep sending your position after you close the app. Without that, your position would freeze the moment the phone put CHANNEL to sleep, and the person watching would have no way to tell the difference between a stopped share and a stale one.
These wake-ups raise nothing on your screen and make no sound. They carry no message and say nothing about you: our server is told only that this device wants waking until roughly a certain time, rounded up to the hour, and nothing about who you are sharing with or where you are.
They stop when the share does. If your device is switched off or out of signal when the share runs out, they stop anyway — our server was given a time, not a switch, so it does not need to hear from you to stop.
A live share does not send at one fixed rate. It sends about once a minute while somebody is actually looking, and about every fifteen minutes when nobody is.
Three things can put it on the fast rate:
With nobody looking at either end, fifteen minutes is the rate. That is deliberate rather than a limitation: a position nobody is reading is battery spent on nothing, and a share left running overnight costs four wake-ups an hour instead of sixty.
Asking does not tell them you looked. Your device asks theirs the same way it sends a message, and their app answers with a position exactly as its own timer would have. There is nothing on their screen to see.
And a phone that is not sharing with you says nothing at all. If you ask somebody whose share has ended, or who never shared, you get silence — not an error, not a refusal, nothing. That is on purpose: any other answer would turn the question into a way of checking whether somebody's phone is on.
A location arrives as one card per share, reading Location, Live Location or Live Location Ended, with the time it runs until and when it was last updated. The card moves in place as fixes come in; the thread does not fill up with a line per update.
While a share is running in a thread, a small arrow sits at the top beside the lights with the time left on it, so you do not have to scroll back for it. The arrow leaves a wall (|->) when you are the one sharing and arrives at one (->|) when somebody is sharing with you; when both are running there are two, each with its own time. It goes when the share ends: the map is still in the conversation, where the share is.
In the thread where you are sharing, the |-> chip beside the lights carries the time left: 12m, 1h 05m, 7h. Long press it for Extend 15 Minutes, Extend 1 Hour and Stop Sharing.
Once your share has ended, its long press offers Share Again for 15 Minutes, 1 Hour or 12 Hours. A share you restart or change moves its card to the end of the conversation at the next update.
A location in a conversation carries a small square map, about two thirds of the screen wide. Tap it and the full map opens, with both phones on it. Under the map: the distance and direction, such as 0.4 mi NE, and an arrow that points at the other phone from the way yours is facing. The arrow is garnet within about a mile and grey beyond that. A live share moves on the map as updates arrive.
The full map opens inside the conversation, in the place the messages were, so the header and the message box stay where they are. Close returns you to the messages.
Navigate hands the place to a map app as a route, with directions already asked for. It uses the app named in Settings › Navigation, and says which one on the button. The menu beside it offers every map app on your device by name, as Open in that app. Somebody else's position opens there as a route from where you are to them; in the full map, a position within about 150 metres of you opens as a plain pin instead, and your own position opens as a plain pin. The other app is not CHANNEL: it sees the place it is given and, to draw a route, where you are. Long press a location card to do the same without opening the map, and to Copy Coordinates.
The map inside CHANNEL is drawn from CHANNEL's own map service with OpenStreetMap data, and every map shows (c) OpenStreetMap contributors. It keeps the pieces it has already fetched, so a place you have looked at once draws immediately the next time. The service sees which pieces of map you ask for and your network address, and only that: each request carries one app key and nothing that names you or your device. A live share follows each new position until you move the map yourself, and the Recentre button then brings it back. A one-time location stays where it was sent.
Opening a location somebody sent you does not ask for yours. On iPhone, Show Me Too on the map adds your own position, and CHANNEL asks for your location then.
On Android, a one-line row above the composer shows what is on the clipboard now: the text, or Photo for a copied picture. Tap it and the text goes into your draft, or the picture is staged as if you had picked it.
On iPhone that row is off until you turn on Settings › Privacy › Clipboard Preview, because reading what another app copied makes iOS ask Allow Paste? every time. To stop it asking, set the phone's own Settings › CHANNEL › Paste from Other Apps to Allow.
With the row off, the paste button beside the composer stays. It lights when the clipboard holds text or a picture, and your tap is the consent, so nothing is read until you ask. Either way, a copied picture pastes as a photo, not as a filename.
Stickers. On Android, any keyboard's sticker or GIF key works here and the sticker goes as a picture. On an iPhone the keyboard puts the sticker on the clipboard, and the paste row offers it like any copied picture. An animated sticker arrives on an iPhone as a single frame.
Where the AI runs depends on the phone. On an iPhone that supports Apple Intelligence, it runs on the phone itself: no account, no key, no cost, and nothing leaves. Everywhere else, and as the fallback on an iPhone, you set up an account of your own under Settings › AI Features: OpenAI, Anthropic, xAI, or a server you run yourself. A key stays on this device and our server never sees it. AI puts everything CHANNEL does with AI on one page.
Nothing is ever sent to a provider on its own. Every use shows you exactly what will leave, and the send button is the consent.
Apple Intelligence answers first where it can. Your own account is the fallback: it answers when Apple Intelligence is busy or a message is too long for it. If Apple Intelligence declines a message outright, nothing goes to your account either. See Settings.
The ✦ in the composer opens a menu:
Summarize with AI is in the thread menu. It sends the last thirty messages and shows bullet points. The summary is not stored.
Translate with AI and Ask AI About Photo are on the long press menus above.
A result is a suggestion. It goes into your draft only when you choose it.
Answered by, in the ⋯ menu at the top of a conversation, chooses which of your AI accounts — or the phone itself, where it can — answers in that one thread. It starts on the app's default, and the sheet that asks before anything leaves names whichever one it is.
If you tick Chat as a Contact on an AI account, a contact named after the provider appears in every profile, and you can talk to it like anyone else. It has no lights and no call buttons, because nothing carries the message anywhere but to your own provider account.
That contact sees only the thread you are in. It has no memory of your other conversations, no access to your contacts, your location or the rest of your device, and it cannot send a message to anyone. Nobody else can write to it.
Photos are sent as sealed attachments. With Photos: Nearby Only on, they never go by the internet: they wait until the two phones are near each other.
The send sheet says how fast it will go. A profile set to send slowly — Settings, Send Slowly Over — spreads the slices of a large picture or clip over the time chosen, so a big transfer looks like ordinary use of the phone rather than a burst. The sheet says so before you press send, with a small tortoise and the time it will take; it is never hidden. Advanced on that row opens a picker with the profile's setting already chosen, and what you pick there applies to this one transfer only. Send right away is always among the choices, and when you take it the sheet says it sends right away just this once. Some times are not offered for some pictures, and the sheet says why: that many pieces in so little time would stand out from what your phone normally sends. Simple folds the picker away again.
The sheet that appears when you pick a video offers 1080p or 720p. On iPhone each one says what it will cost in megabytes, because that is the number the choice actually turns on. What you pick is remembered, so the next clip starts where this one did.
720p is the smaller file and the faster send, and on a phone screen the two are hard to tell apart.
A video can be up to 5 GB. If the other person's CHANNEL takes less, CHANNEL says so before anything is sent. A long one is sent a piece at a time from the phone's storage, and if the connection drops, or the other phone goes out of reach, it carries on from where it stopped.
Large files go to one person a few at a time. The rest wait their turn, in the order you sent them, and start as earlier ones finish. Limits has the number.
When the other person's phone is short of space, their conversation says there is not enough space on their phone for the file from you, and the transfer continues once they free up space. CHANNEL keeps part of every phone's storage free for the phone itself, so a file is not accepted if it would use that part up.
Your conversation with them then says their phone is out of space, and the file continues once they free some.
Three different things can stop a video, and the app names which one rather than giving them all the same words:
A message that has not gone yet is waiting for one of these, and the conversation says which above the composer:
Translation is done on this device, by the phone's own translator. The text never leaves it to be translated. Turn it off, or choose which languages, under Settings › Notifications. Translate with AI on a long press is the other route, and that one does send the message to your provider. On Android, the first translation from each language downloads that language's pack, about 30 MB, from Google; the text itself never leaves the phone.
Translate Automatically, in a conversation's menu, shows every message that arrives there in another language already translated, on this device, with Show Original under it to see what was sent. It is set for each conversation, and the other person turns it on for their side. On an iPhone it needs iOS 18.
On a contact's card, Translation holds the same switch, Translate Automatically, and when it is on, two choices: Translate From, which is Detect Automatically or one language, and Translate To, which is the first language of the phone unless you pick another. You choose them; the keyboard you type with does not decide which language you read, so someone who writes English one day and Spanish the next is covered. A message already in the language you translate to is left as it is.
CHANNEL does not send texts. For somebody who does not use it, the app opens one of your own messaging apps with their number filled in, and when you write from the Write to sheet, with your words in it. You press send there, so it leaves from your own number, and their replies arrive in that app, not in CHANNEL. Nothing of it passes through our server.
The routes are on the contact's page, under Message another way, and under Or send it another way when you write to a number: Messages, and WhatsApp, Signal or Telegram where the card ticks them for that number and they are on this phone. WhatsApp and Messages carry the words you typed; Signal and Telegram open the conversation and you write there.
On a device that cannot send texts, such as an iPad on Wi-Fi, a Mac without Text Message Forwarding, or a tablet with no phone radio, Messages is not offered and one line says This device cannot send text messages. The other apps still are.
This leaves CHANNEL, and what goes by text is not end-to-end encrypted. The phone network can read a text. WhatsApp and Signal protect a message their own way, which is theirs to describe.
Export Conversation writes the conversation out — More on iPhone, the long-press menu on Android. Encrypted is chosen at the start: it seals the conversation and the contact it is with under a passphrase, to restore later (Backups). Plain Text writes a text file anyone can read, and three things are worth knowing about that one before you use it, the first being the one people get wrong.
It is not the whole conversation. A view-once picture is named and left out, and so is its caption. A location is named and left out, and never its coordinates. The file says so at each of those points, so nobody reads an export believing they have everything.
Report… makes a different file, the evidence file, which carries the photos, videos and files as well; see Reporting.
Attachments are described, not attached. The file says <photo> or <voice message>, with any caption. It is a text file and stays one — it cannot quietly carry a gigabyte into somebody's Files app.
It contains the other person's words. Once the file leaves the app it is an ordinary file on an ordinary phone, with none of this app's protections on it. That is the honest sentence, and it is the one this feature exists under: once a message has been delivered, it belongs to the person who received it.
When you type or paste a web address, a small card appears above the box with the page's picture, title and site. Send carries it with the message, inside the same bubble, and tapping the card opens the link just as tapping the address does. The × on the card sends the message without it. A YouTube link shows the video's title, its channel and a thumbnail. A site that is not on the list of approved sites shows a card with just its address, such as example.com, and your device does not contact it.
For an approved site, your device fetches the page while you type, so the site sees your internet address, even if you do not send the message. Link previews are on to begin with. Settings › Privacy › Link Previews in Messages turns them off, for all profiles or for one, with the choice at the top of the page. A preview you receive was fetched by the person who sent it: your device contacts the site only when you tap the link. The site is asked the way an ordinary phone browser asks, not as CHANNEL.
Previews appear for many well-known sites. Other links show the address only. Tapping a link opens the site; the preview is a snapshot and may not match the page.
The ⋯ menu at the top of a conversation has Media, Files and Links, which opens what was shared in that thread in three tabs. The first is a grid of the photos and clips, newest first; tapping one opens the same zoomable viewer a bubble does. The second lists the voice messages and files with their dates; a voice message plays in place and a file opens. The third lists every web address anyone typed in the thread, newest first, and tapping one opens it exactly as tapping it in a bubble would.
Two things are deliberate. A view once — photo, video or voice message — is in none of the three tabs, not as a grey square and not as a dated row, because a list of what was sent once would be a record of the very thing the sender was promised leaves no record. And the third tab lists every occurrence rather than every distinct address: the same link sent twice is two rows with two dates.
In a group, a picture that this phone's own check for nude pictures flags is covered in its bubble with This picture may be sensitive. and View, and a picture shared in a public group is covered the same way; either one stays covered in the grid here too.
Create Group starts one, from the Messages list or from the ⋯ menu of any conversation. It asks first which kind: an informal group, where everyone in it is equal, or a formal group, with admins (below). For an informal group, pick the people and, if you like, a name.
A group is always a conversation of its own. It appears in your Messages list the moment you tap Create, with you as its first member, and your one-to-one conversations carry on beside it exactly as they were. In the Messages list a group has its own line, with a Group label and the names of the people in it. A short note, Invitations sent, confirms it.
Everybody is asked before joining. Each person you pick is sent an invitation that names the group and who is asking, and nothing about the other members. They see it at the top of their Messages list with Accept, Decline and Learn More, and they join only if they accept. Once they accept, the group opens in their Messages list with its name, and they can write in it straight away; its other members appear as soon as the group tells their phone who they are. Learn More says what joining shares, and suggests joining from another of your profiles if you would rather keep this one apart. Each invitation also shows when it arrived and a short group code, so two invitations from one person can be told apart, and says which people you have added are in the group when that is known. When a newer invitation from the same person looks like the same group, the older one is marked as replaced; it can still be accepted or declined.
Who is in it, at a glance. The top of a group shows a chip for each person: you first, then the members, each with a green dot, and the people invited who have not answered yet with a yellow one. A yellow dot turns green when that person accepts. Removing someone from a group takes their chip away with it, and no invitation to them stays waiting.
Group Info. Tap the group's name at the top for Group Info, the one place for everything about the group: rename it, see the members and invite more, turn private messages from members on or off, and leave. Tap a member for Message Privately; swipe a member for Remove, which asks first and names them, or an invitation for Withdraw.
People you have never linked with. Everyone in a group sees everyone else in it by name, including people they have never linked with, and messages go between them as they do between any two people in the group. Those people are not added to your contacts and are not offered anywhere you choose somebody: they are in the group's list, under the name they give themselves, for as long as you share a group. What they get from you is your name and what the app needs to deliver to you, and nothing from your card: no number, no address, no picture.
Message Privately. Long press somebody's message in a group, or tap them in Group Info, to open your one-to-one conversation with them. Whether somebody you know only from a group can message you privately is yours to decide: Settings › Privacy › Private Messages From Group Members sets it for this profile, and Private Messages From Members in a group's Group Info sets it for that group. It is on unless you turn it off, and your contacts can always write to you.
A name, if you want one. Rename the group in Group Info, or with the pencil at the end of the row of names. The name replaces the first person's at the top of the conversation and in your Messages list, the thread says You renamed this …, and everyone else in the group sees the new name. Anyone in the group can rename it.
Leaving. Leave Group, in Group Info, tells every member you left, takes the group out of your Messages list, and stops it reaching this device. Delete on a group in the Messages list does the same, and asks first: in a group, deleting is leaving, so nobody stays in a group without knowing it. A group ends when its last member leaves.
Removing somebody stops what comes next, and nothing else. Every member's phone is told, the person removed included, and nothing sent after that goes to them. It does not reach backwards: whatever they already received is on their phone and stays there. Any member can remove any other; the thread says who did.
The thread says what happened to it. You added Bob. Ana added Dev. Ana removed Dev. Ana renamed this Morning report. When somebody leaves, the line reads is no longer in this thread. These sit among the messages, small and centred, and are not from anybody: nobody wrote them.
Who got it, and how. Long press your own message and choose Info: in a group it lists each person separately and says which way the message reached them, Ana: Bluetooth, Dev: Internet. Somebody missing from that list has had no copy leave yet, and the sheet says so rather than leaving a gap. The ticks under a group message follow whoever is furthest behind: two ticks once everyone has it, and they change colour only once everyone has read it. An informal group holds up to 8 people, you included. Anybody in it can add or remove somebody. Every message in a group carries the sender's name above it — a picture and a voice message as well as a sentence — and that name comes from the key that opened the message, not from anything the sender typed, which is the part worth trusting. There is no shared group list anywhere: each phone keeps its own, and when two phones disagree about who is in the group the banner says so and this device asks the other for its list, rather than pretending its own copy is the truth. A message sent before this device holds that list waits, shown as not sent, while this device asks for it; once the list arrives, the message goes to everyone, never to one person by mistake.
A group needs at least two other people. Add stays off until two are ticked, and you are never in the list.
In an informal group, type @ at the start of a word and the members appear above the keyboard; tap one to put their name in the message. You can mention up to 8 people in one message. If two members have the same name, each row adds something from their card (a handle, or the last digits of a number) so you can tell them apart. The mentioned person sees their own name for you, as saved in their contacts, after the @, and the mention is highlighted. A member whose app does not read mentions sees plain text, the name you typed.
A muted group stays silent, with one exception: a message that mentions you still notifies. To turn that off for one group, open the ⋯ menu and switch off Mentions Notify When Muted; it is on by default and appears in informal groups only. Switched off, a muted group is silent even when you are mentioned.
New Broadcast List, beside Create Group in the Messages list's ⋯ menu, sends the same message to several people at once without making a group. Pick up to 256 paired contacts and give the list a name; Create opens the new list, ready for the first message.
Each message you send to a broadcast list — text, a photo or a video — goes to every person on it as an ordinary one-to-one message, sealed and delivered exactly the way a message you typed to them alone would be. Nobody on the list sees the list or sees anybody else on it. A reply lands in your one-to-one conversation with that person, not in the broadcast list. A blocked contact can stay on a list without receiving anything you send through it.
The broadcast list's own row in your Messages list carries a megaphone and shows what you last sent. Open it to see every message you have sent through it and, under each one, how many people it reached and how many have read it. Info renames the list, changes who is on it, or deletes it.
A formal group has admins, and the person who starts it is its main admin. Start one from the New Message screen with New Formal Group: choose a Group handle, such as @vallettachoir, and CHANNEL checks with the server that it is free before Create turns on. Give the group a name too, or leave the name blank and the handle becomes it. Choose Who can post and pick people to invite. Each person is asked, and joins only if they tap Join. When an invitation's name matches a group you are already in, it says so on your device, since a typed name is not what makes a group unique — its handle is.
In an informal group, Make a Formal Group in the conversation menu starts one with that group's name and people already chosen; a handle is still needed before Create turns on. The informal group stays as it is.
Each post is sealed once on the phone that sends it and kept on our server, encrypted so that only the group's members can read it. The server deletes each post 30 days after it arrives. It sees when posts arrive and how large they are, and never what they say. Members post text, and photos once every member's app can show them. A member's phone collects new posts when the app checks.
Report Group, in Group Info, makes the evidence file for the group: its whole history on your phone, with every photo and video, as one file for you to give to the police through your phone's share menu. It is made on your phone, nothing is sent to CHANNEL, and the group is not told. An admin can also remove a member, or remove and ban them, from Group Info. Never save, screenshot, export or forward sexual material involving a child: having or sharing it is a crime even to report it. Report it at report.cybertip.org or to the police, and say what you saw and when.
Wake This Device for New Posts, in Group Info, makes a new post wake this device the way a message does. While it is on, our server knows this device follows the group.
Group Info is where an admin manages the group: the whole member list, searchable in a large group, so somebody who has never posted can still be found. Members see how many people are in the group, and every post shows who wrote it; Message Privately on a post opens a one-to-one conversation with its writer. Admins rename the group, change who can post, invite people and remove members; swipe a member for Remove, which asks first and names them — on Android the same actions are also in a menu on each member row. The main admin also swipes a member for Make Admin or Remove Admin, each asking first and naming them, and only the main admin removes another admin. The main admin can also choose Remove and Ban, which asks first too: that person leaves the group at once and cannot join it again until the main admin lifts the ban with Unban, under Banned in Group Info. Lifting a ban does not add the person back. A member leaves with Leave Group. The main admin hands the group to another admin first, with Hand Over to … and Leave under Leave Group; with no other admin, they make someone an admin, and the choice appears once that person's phone has confirmed.
Your Name in This Group, in Group Info, with Share Name, sets the name the other members see for you instead of a code. It is shared with this group only.
What each member's phone holds. To seal a post to everyone, every member's phone holds a key for each member and the name each member chose for the group. A group created in CHANNEL gives each member a key made for that group alone, which carries nobody's number, address or CHANNEL identity. Showing the whole member list only to admins is a choice of what the screens show, not a limit on what a member's phone holds.
A group with no posts for three months shows a warning, and our server deletes it after four months without a message.
A handle and a link. Every formal group has a Group handle, chosen when it was created; a group with none yet can still claim one in Group Info, where an admin also creates an Invitation link. Writing to the handle, or opening the link, is a request to join. It reaches the admin in Requests, marked Asks to join with the group's name, and the admin decides each one. The handle appears beside the name there too, so the admin recognises the group at a glance. Accepting sends the person the group's invitation, which they answer with Join. A group handle is claimed with the admin's verified phone number, in the same list as personal handles, so no person or group can take a name another holds. Reset Link makes a new link and the old one stops reaching the group; Turn Off Link removes it.
Updates is a tab of its own. An update is a line of text on a coloured background, a photo, a video of up to a minute or a voice note of up to half a minute, with an optional caption, and your contacts see it for 24 hours. After that it is gone from their phones and from yours.
Report… is in a conversation's ⋯ menu. With the switch to block them left on, the person is blocked at once, on this device, and is not told; the conversation stays. Export for the Police… then makes one file, the evidence file, and opens your phone's share menu, where you choose where it goes. Abuse is reported to the police, not to CHANNEL: CHANNEL cannot read messages, identify people or act against anyone, and nothing is sent to us. A message to support about another person creates no obligation, and CHANNEL does not step into anyone's conversations.
The evidence file is a single zip made on your phone. It holds transcript.html, which opens in any browser without a network and shows every message in order with the sender's name, the sender's key fingerprint, the time in UTC and in your time zone, the message's own id, and each photo, video and voice message in place; transcript.txt, the same in plain text; a media folder with every photo, video, voice message and file exactly as it was sent, never re-encoded; and manifest.json, which lists every file with its size and SHA-256 and names who made the export and on which device. When the export is done the sheet shows the Evidence file fingerprint, the SHA-256 of manifest.json: anyone who is given the file can recompute it, so a changed file shows. signature.txt holds your profile key's signature over manifest.json, so the file also shows who made it; a pseudonymous group's file is not signed, because the signature would tie the group name you use there to your profile. Choose Text only to leave the media out; the sheet shows the size first and says so when it is over 1 GB. A view-once item is named and left out, a location is named without its coordinates, and a message deleted for everyone is no longer on your phone to be exported. The file names you, the other people in the conversation and their key fingerprints, so give it only to the police or your lawyer. A group's file also holds the group's identifiers, so the police can ask CHANNEL to preserve what its relay still holds for the group (encrypted, for up to 30 days). Copy Fingerprint copies that fingerprint.
Never save, screenshot, export or forward sexual material involving a child: having or sharing it is a crime even to report it. Report it at report.cybertip.org or to the police, and say what you saw and when. Choose Text only if you still want a record of the conversation.
English is the reference text; any translation is a convenience.
CHANNEL