Said once here rather than on every feature, because it is true of all of them.
Everything you put into a conversation — words, pictures, a location, a reaction, the fact that you read something — goes to the person you are talking to. That is the feature, not a leak. It is only a risk if you are not sure who they are, which is what pairing is for: Pairing shows how to check, and the card says Linked once the two phones hold each other's keys.
So the rest of these pages do not repeat it. What they do say, in a sentence, is where a feature exposes something beyond that — to the network you are on, to our server, to Apple or Google, or to a company that is not us. Those sentences are short on purpose and are there so nothing surprises you later, not to talk you out of anything.
Before a photo or video leaves your device, CHANNEL redraws it. The copy that is sent carries the picture and nothing else: no location, no date and time it was taken, no name or model of the phone or camera. This holds for photos and videos taken in CHANNEL and for those you pick from your library. A file you send with + > File goes exactly as it is, and keeps whatever details its maker put in it.
CHANNEL never uploads contacts. A contact exists in CHANNEL because you typed it, imported it, or paired with it. Contacts › Phone can show your device's own address book so you can find somebody without retyping them: it is read only while that tab is open, is never saved and never sent anywhere, and only the person you choose to import is kept.
Settings › Privacy › Show My Reachability, and Show My Reachability to on a contact's page, decide whether that person's CHANNEL draws route letters and route marks for you: hiding changes only what their app displays, messages still go the fastest way, and a modified copy of their app could still show it.
Settings › Privacy › Let Contacts' Phones Recognize Mine Nearby is on by default. Your contacts' phones can tell when yours is nearby over Bluetooth while CHANNEL is open, and nothing about it goes to a server. What your phone advertises is a short value that changes every 15 minutes and means nothing to anybody who is not your contact; anyone nearby can see that a CHANNEL phone is there, not whose. Turned off, your contacts have no way to tell until a message or call connects.
Settings › Privacy › Suggest People When Sharing puts the people you message at the top of your device's share sheet, and tapping one opens CHANNEL with that person already chosen. It is off until you turn it on. To do it, your device's system is told who you message and how often. It does nothing while App Lock or an app PIN is on, and turning it off clears that record.
Nothing stops the other person from screenshotting, recording, or photographing what you send them, and CHANNEL would not know. There is no setting for this, because a setting here would protect nobody from anybody.
What is shielded on this device, always: a view-once picture while it is on screen, the pairing QR code, and every screen where a secret is typed, which is the PIN pad, the distress code, the backup passphrase and an AI key. A capture of one of those is blank, and the blank page says why.
What is not shielded: your conversations and your contacts. Screenshotting your own conversation is ordinary, and the privacy of this app rests on what leaves the phone, not on stopping its owner photographing it. The one exception is a thread with Enhanced Conversation Privacy turned on, which an Android phone does shield — see Messages.
Nothing, unless you say so. With nothing turned on, a notification says CHANNEL and that a message or call arrived, and no more: no name, no words, no group name. Settings › Notifications › Lock screen has a switch each for messages, calls and groups, and a contact's page can Show or Hide that one person whatever those switches say. A profile behind its own lock, and a thread with Enhanced Conversation Privacy on, show nothing whatever the switches say. A blocked contact's messages never show there either, whatever the switches say. What a notification shows is the same whether the phone is locked or unlocked.
Read Aloud on a message's long-press menu uses the phone's own voice, offline. The words are not sent anywhere to be spoken.
Settings › Privacy › Hide the app when you leave it makes the card in the app switcher a blank garnet page rather than your conversations. It is on unless you turn it off. On an Android phone the same switch also refuses screenshots inside CHANNEL, because there it is one setting and not two. A camera pointed at the screen still sees everything.
The app lock is your app PIN, below. It is asked when CHANNEL opens, and again after it has been in the background for a while.
Settings › App Lock › App PIN sets a code of your own: at least six characters, letters, digits and punctuation, and capitals count. It works even on a phone with no lock at all, and it is asked before anything else. CHANNEL uses no face, no fingerprint and no phone passcode to open: the PIN is the lock. Use letters and numbers switches the field from the number pad to the full keyboard.
This is deliberate. Someone can hold a phone up to your face or press your finger onto it; nobody can make you say a PIN you keep to yourself. So CHANNEL never offers Face ID, Touch ID or a fingerprint anywhere, and the app does not ask for permission to use them.
Every PIN field has an eye. Tap it to see what you have typed, and tap it again to hide it; a PIN with letters and punctuation is hard to type blind.
The PIN is never stored. When you set it, CHANNEL makes a key for it inside this device's security chip (the Secure Enclave on an iPhone, the Keystore's secure hardware on Android) and tests on the spot that the chip really does the checking. When the test passes, the chip checks every PIN you type, so a copy of the phone's storage cannot be used to try guesses anywhere else. When the phone has no such chip or the test fails, CHANNEL keeps a slow one-way calculation of the PIN instead (PBKDF2-SHA256, 210,000 rounds) and checks against that.
Two wrong tries cost nothing. From the third, each wrong try starts a wait of 5 seconds that doubles each time, up to 5 minutes, and closing the app does not end it.
Nobody can recover this PIN. Not you, not us. We never hold it, and the chip that checks it cannot produce it. There is no account, no email on file and nobody to appeal to. Forget it and the messages on this device are gone.
So choose one you will still know in six months, and make a backup before you set it (Settings › Backup), kept somewhere you can reach without this app.
Three kinds of code are refused, each with one sentence saying why:
The reason for a refusal shows under the field as you type, before you press Save.
A PIN shorter than six characters opens CHANNEL, which then asks once for a new one.
The time to try every possible code, worked out from the delay above and from the number of codes. It assumes a code chosen at random: a date, a word or a pattern is found much sooner. Four digits is here for comparison: CHANNEL refuses a new PIN shorter than six characters.
| The PIN | Possible codes | Guessing through the app | Guessing offline, one graphics card (estimate) |
|---|---|---|---|
| 4 digits | 10,000 | about 5 weeks | under a second |
| 6 digits | 1,000,000 | 9 to 10 years | about 25 seconds |
| 6 letters and digits, capitals count (62 symbols) | about 57 billion | about 520,000 years | about 16 days |
| 6 of any keyboard character (94 symbols) | about 690 billion | about 6.4 million years | about 7 months |
| 8 of any keyboard character (94 symbols) | about 6 million billion | about 56 billion years | about 4,800 years |
Through the app is somebody typing guesses into CHANNEL on your device. Once the wait reaches 5 minutes, that is about 300 guesses a day. Someone who can also unlock the phone itself, restart it and change its clock can shorten the waits, so this column is the best case.
Offline is somebody who has copied the PIN check off the phone and tries guesses on their own computer, with no wait. It applies only on a phone where the slow calculation checks the PIN. The speed, about 40,000 guesses a second on one modern graphics card, is an estimate from published benchmarks for that calculation, not a measurement of ours, and ten cards go ten times as fast. Where the security chip checks the PIN, this column does not apply: the key that checks the PIN never leaves the chip, so a copy of the phone's storage cannot test a single guess.
These are the times to try everything. A code can be found sooner, on average halfway, and a code people commonly choose is found far sooner, because it is tried first.
A guesser does not go through the codes in order. A program tries the likely ones first: words, names, dates and years, keyboard runs such as qwerty and 123456, repeats such as aaaaaa, a capital only at the start, a digit or ! only at the end, and letters swapped for look-alike digits. So the strength of a code is how far it is from what people usually choose, not how many characters it has.
The PIN is not copied to a linked device. Each one gets its own, so unlocking here never unlocks there, and a device you lose does not hand over the others.
Both are off until you turn them on, under Settings › App Lock, and both are for a device somebody else might be holding.
Ask for PIN to change profile. The profile picker is a list of identities you keep apart on purpose, and without this it opens any of them with one tap. Turn it on and switching asks for the app PIN first — even into a profile that has no lock of its own, because what is being protected is the switch, not the destination.
This is the borrowed-tablet case. Under one login the phone or tablet gives CHANNEL no way to tell two people apart, so the PIN is the only separation there is.
Ask for PIN before deletes. Deleting a contact, a conversation or a profile asks for the app PIN first, and then still asks whether you meant that one. Two different questions: whether you are allowed to, and whether you meant it.
There is no grace period on either. The app lock waits a minute before asking again, so that stepping out to copy a code does not cost you an unlock; that reasoning does not apply to something nothing can undo. A delete here is real — the record goes, not a flag — so being asked is the whole protection.
Neither uses your face or fingerprint. On a shared device those are often available to whoever is holding it; the PIN is the part that is not.
A profile can hold a code of its own, separate from the app's. Under Settings › Privacy, with This profile on, tap Set a Profile PIN. Once set the row reads Change Profile PIN, and Remove Profile PIN appears under it.
It is genuinely a second code: its own salt, its own count of wrong tries, its own delay. Guessing at one profile's door does not lock the app, and knowing the app's PIN does not open the profile. The point of having several profiles is that they are separate, and one code for all of them would make that separation only look real to anybody who has watched you type once.
The order follows the app's. Opening the app asks for the app PIN. Opening a protected profile asks for the profile PIN.
One difference from the app's lock is deliberate: the profile's entry screen names the profile, which the app's own lock screen never does.
A profile with its own PIN is asked for wherever another profile can reach it, not only in the profile picker:
The profile you are in has already been opened, so none of this applies to it.
A profile with its own PIN can have a distress code of its own: Profile Distress Code, under Remove Profile PIN. Like every code in CHANNEL it is optional, and nothing asks you to set one. Once it is set, the row reads Change Profile Distress Code.
Typed where that profile asks for its PIN, it opens the profile exactly as the PIN does. By the time it opens, that profile's conversations and contacts are gone: every message, every card except the profile's own, their pictures, the attachments and any pending invitations. A call to it is hung up. The profile stays, with its name, its PIN and its own card, and every other profile on the phone is untouched. Nothing on screen says what happened, and nothing is sent to anybody.
The app's Distress Code is the one that empties the whole phone.
Deleting a profile takes its PIN and its distress code with it.
Lock Conversation in a conversation's menu puts that one conversation behind its own PIN, separate from the app PIN and every profile PIN. A locked conversation shows only its name in the Messages list, never appears in a search across conversations, and its notifications say only New message. It asks for the PIN each time you open it after leaving it or the app. There is no Face ID or fingerprint for it. If you forget the PIN, the lock can still be removed, but that deletes the conversation's messages from this device. On the locked conversation, Forgot PIN? asks first, and Delete Messages and Remove Lock takes the lock off and deletes the conversation's messages from this device. Remove Conversation Lock in the conversation's menu takes the lock off.
A card belongs to the profile it was made in. Somebody who writes to you on one profile is added there and nowhere else, and a contact you type in by hand is the same — two profiles on one phone share nothing unless you say so.
The card itself says which it is, under Show in, and you can change it there without opening the editor. It asks first, because the setting decides who can see that person's card and a mis-tap should not widen it quietly. Either way their messages stay in the profile they arrived in; a conversation is never shared between profiles, only the card.
With three or more profiles, the card's Edit screen also offers Choose profiles, to pick exactly which ones show it. The profile you are in always keeps it. When an app PIN is set, the list asks for the PIN before it names your other profiles, because naming them says they exist.
A card lives in one profile. If you want to write to that person from a different profile, open their card there and choose Message From This Profile.
It copies what is written on the card — the name, the numbers, the addresses — and nothing else. Keys are never copied, and neither is how sure the app is of their identity, because both are facts about the pairing that profile made and not about the person. So the new profile starts an ordinary first contact: they are asked, as a stranger would be, and they are told nothing about it being you again.
That cost is the feature working correctly. A profile that inherited the other one's pairing would be telling the other person that two profiles are one person, which is the single thing profiles exist to avoid.
Change the name at the top of their card to anything you like. This profile shows that name, a card they send never replaces a name you chose, and every other profile is unaffected.
It changes a name on a list and nothing more. A notification can still quote the message, a screenshot still shows the thread, and anyone who opens this profile reads all of it. It protects a glance at a list of conversations, which is a real thing to want, and it is not a lock.
If the glance is what you are worried about, set Lock Screen to Hide on their card as well, because a different name on a lock screen that shows names is the trap this would otherwise be.
Everything CHANNEL holds on a device sits behind that device's own lock first, so how the device is set up matters as much as anything in the app. Before a profile that matters goes on a device:
When a device is gone, from another device of yours:
What a lost device showed before it was erased cannot be taken back, which is why the passcode comes first.
Under one login, the operating system does not separate two people. Everything CHANNEL holds is reachable by whoever is holding the device. The PIN is not a convenience here; it is the entire isolation.
Turn on Other people use this device under Settings › App Lock. That one switch does what three settings would otherwise have to: the app locks the moment it leaves the screen with no grace period, and every profile switch asks for the PIN. It is one switch on purpose — handing a tablet round should not require working out which settings add up to the protection you want.
Then give each person's profile its own PIN, under Settings › Privacy with This profile selected. That one setting does three things:
Turn on Ask for PIN before deletes on the same page. Deleting is real here — the record goes, and nothing restores it — so being asked is the whole protection.
Your contacts and conversations are separate between profiles already, whether or not you set a PIN — each profile keeps its own. The PIN is about who can open a profile, not about keeping the lists apart.
The honest limit. None of this makes a shared device private. Anyone holding it can still see that CHANNEL is installed, that profiles exist, and that messages arrive. A profile that genuinely matters does not belong on a device other people use, and no setting on this page changes that.
The app's distress code belongs here too: it destroys everything CHANNEL holds on the device, so on a shared one it destroys everybody's. A profile's own distress code reaches only that profile.
Distress Code, under the same heading, is a second code, and it appears only once a PIN is set. Entered instead of your PIN, it does on screen exactly what your PIN does: the app opens. What has changed by the time it opens is that everything CHANNEL held on this device is gone -- the key that seals the stores first, then the identities, then every file -- and the app you are looking at is empty. Outside Secure Mode, the profile that was open keeps its name. Afterwards CHANNEL locks the way it did before: the code you typed is its PIN from then on, the lock settings stay as they were, and the distress code itself is gone. Nothing says a wipe happened, and there is nothing further to tap. There is no confirmation step, and that is the point: a second tap is something a person standing over you can see and interrupt, and it would make the distress code look different from your real one. The trade is that entering it is immediate and cannot be taken back. A copy kept elsewhere, such as a backup or another phone, is untouched. Once it is set, the row reads Change Distress Code.
The distress code is for someone with no legal authority to demand your PIN. Where the law requires you to unlock, using it can itself be an offence.
Secure Mode belongs to one profile: the profile you use for confidential work can be in Secure Mode while the one you use with family is not. Turn on Settings › Previews › Secure Mode (Preview), and each profile offers Settings › Privacy › This profile › Secure Mode. It needs a PIN for that profile that this device's security chip checks (Set a Profile PIN, on the same page). On a Mac a profile cannot turn it on while that profile has the Local API on, because an AI with access can read everything Secure Mode protects. Before anything changes it offers Back Up Messages, which you can skip, and then asks for the profile's PIN. The choice is stored on this device only.
With it on, that profile's notifications say only New message, CHANNEL is hidden in the app switcher while the profile is on screen, and link previews are off in it, whatever those switches say on their own. Your other profiles are not affected.
While the profile is locked, its key exists only inside this device's security chip and opens only with its PIN. Nothing on the device can read its conversations then, and messages that arrive for it wait, still sealed, until you open it; a notification says only New message. A call that arrives for it while it is locked appears afterwards as a missed call. Your other profiles go on working as usual. The profile locks when you tap Lock Now, when the device locks, and shortly after you leave CHANNEL; opening it asks for its PIN. A locked profile's cover offers Use Another Profile to move to a different profile.
Its options: Badge Only raises the count on the icon with no banner and no sound. Clear Copied Text After a Minute removes what you copy in that profile from the clipboard. Ask for PIN Before Saving Media asks for the profile's PIN before a picture, video or file leaves it.
Pictures, videos and files in the profile's conversations are sealed with the same key, and so are its contact pictures, conversation wallpapers, Updates, and voice messages from people who are not your contacts, so a locked profile holds none that can be read. Locking also removes the copies opened to play, view or share them, and anything picked or recorded in the message field but not sent.
A profile can open with the app PIN instead of a PIN of its own, and its Secure Mode page says so; giving it a PIN of its own moves it to that PIN. A profile in Secure Mode that you share to another of your devices arrives in Secure Mode there too, and opens with the same profile PIN; each device keeps its own key, made by its own security chip, and the key never leaves it. When its PIN is changed on another of your devices, the first time you open it here with the new PIN it also asks, once, for the PIN it had on this device, and its key then moves to the new PIN.
A profile in Secure Mode cannot also give an AI access to it, because an AI that can read the profile can read everything Secure Mode protects. While a profile is in Secure Mode its PIN cannot be removed, and a backup asks you to open it first.
Turning Secure Mode off, with the profile's PIN, ends it and erase after inactivity for that profile and puts its options back. What it sealed stays sealed and opens as usual, and CHANNEL keeps the profile's key protected by the security chip in this device. Secure Mode (Preview) can be turned off once no profile is in Secure Mode.
The profile's name appears in your list of profiles to whoever holds the unlocked device; what the profile holds does not.
The risk, in one sentence: Secure Mode is a preview, and a fault in it, a forgotten PIN or a lost device can cost what that profile holds on this device, so keep a backup somewhere else.
Inside a profile's Secure Mode, Erase After Inactivity destroys that profile's key, and with it everything the profile holds on this device, if the profile is not opened with its PIN for the time you choose: 7, 14, 30, 60 or 90 days. Only opening the profile with its PIN counts; a message arriving does not. The profile is then removed from this device; when it is the only profile, everything CHANNEL holds on the device goes.
Nothing on the phone warns you first, and nobody can stop or undo it once the time has passed -- not you, and not us. The one warning is this page and the confirmation when you turn it on. You can turn it off at any time from the open profile, with its PIN. The distress code is for someone with no legal authority to demand your PIN. Where the law requires you to unlock, using it can itself be an offence.
The time is measured so that changing the date does not shorten it: moving the phone's date back by more than two hours counts as the time running out. Time the phone spends switched off is counted when the phone can tell.
If you have been told to keep information, or expect a dispute, or your work is regulated, do not turn this on, and turn it off while you can still unlock. That responsibility is yours.
The risk, in one sentence: when the time passes, everything that profile holds on this device is gone for good.
With Secure Mode, and with erase after inactivity especially, CHANNEL is not where your only copy lives. Near-absolute security and keeping your only copy on the phone pull against each other. Keep the encrypted backups you want somewhere you choose, ideally one copy away from home. See Settings › Backup.
The risk, in one sentence: a backup is readable by anyone who has both the file and its passphrase, so keep the two apart.
On Android, the files that hold your conversations and contacts, and every picture, video and file CHANNEL keeps, are sealed (AES-256-GCM) with a key held in the phone's Keystore, which never leaves it.
On iPhone, the files that hold your conversations and contacts are sealed (AES-256-GCM) with a key kept in the iPhone's Keychain, for this device only. Pictures, videos and files are protected by the iPhone's own file encryption.
On both, CHANNEL's data opens only on this device, after it has been unlocked once since it started, and is left out of the phone's own backups.
Nothing else. No analytics, no crash reports, no usage beacons beyond that one daily count, and Help contacts nobody unless you press Get It.
Every permission CHANNEL holds is asked for at the moment a feature first needs it, except the radios and notifications, which CHANNEL asks for when it first starts because every message travels through them. Nothing in CHANNEL can see your whole photo library, your location in the background, or anything on the phone you have not picked. The last column is the name the phone's own settings and the app's code use, for anyone who wants to check. A wake-up sent to this device passes through Apple's or Google's push service and carries no message and no sender.
On iPhone:
| What | When CHANNEL asks | Afterwards | System name |
|---|---|---|---|
| Bluetooth | When CHANNEL first starts | Held, so messages arrive from nearby phones with the app closed | NSBluetoothAlwaysUsageDescription, bluetooth-central, bluetooth-peripheral |
| Local network | When CHANNEL first looks for contacts on the same Wi-Fi | Held; only other CHANNEL phones are looked for | NSLocalNetworkUsageDescription |
| Notifications | After you name your profile in setup | Held; a wake-up carries no content | remote-notification, aps-environment |
| Incoming calls | Never asked: the phone rings a call through its own call screen | Used only for a call | voip |
| Microphone | Your first call or voice message | Used only during a call or a recording; a call keeps its sound with the screen off | NSMicrophoneUsageDescription, audio |
| Camera | Your first video call, code scan or photo taken in the app | Used only while the camera is on screen | NSCameraUsageDescription |
| Choosing photos and videos | Never asked: the system picker shows CHANNEL only what you choose | Nothing is held | none |
| Saving to Photos | The first time you save a picture, or keep copies of what you take | Add only: CHANNEL cannot read the library | NSPhotoLibraryAddUsageDescription |
| Location | When you send your location, start a live share or open a map | While in use only, never Always; reading stops when the share or the map ends | NSLocationWhenInUseUsageDescription, location |
| Contacts | When you open the phone's contacts inside CHANNEL and tap Continue | Read while that list is open, never saved, never sent | NSContactsUsageDescription |
| Face ID | Never asked: CHANNEL does not use it | Nothing is held | NSFaceIDUsageDescription |
| Speech recognition | When you ask for a voice message as text | On this device only | NSSpeechRecognitionUsageDescription |
| Shared storage between CHANNEL and its notification and share extensions | Never asked | The share extension reaches only the key for what you share, never your messages or your identity | com.apple.security.application-groups, keychain-access-groups |
| A check for nude pictures, on this device | Never asked: it follows the phone's own Sensitive Content Warning setting | Nothing leaves the phone | com.apple.developer.sensitivecontentanalysis.client |
On Android:
| What | When CHANNEL asks | Afterwards | System name |
|---|---|---|---|
| Nearby devices (Bluetooth) | When CHANNEL first starts; on Android 11 and older, granted at install | Held; marked as never used for location | BLUETOOTH_SCAN, BLUETOOTH_ADVERTISE, BLUETOOTH_CONNECT, BLUETOOTH, BLUETOOTH_ADMIN |
| Nearby Wi-Fi devices | When CHANNEL first starts, on a phone with Wi-Fi Aware | Held; marked as never used for location | NEARBY_WIFI_DEVICES |
| Location | When you send your location or start a live share; also when CHANNEL first starts, on Android 11 and older because finding nearby phones over Bluetooth needs it there, and up to Android 12 on a phone with Wi-Fi Aware, which needs it too | No background location; reading stops when the share or the map ends | ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION |
| Notifications | When CHANNEL first starts | Held; a wake-up carries no content | POST_NOTIFICATIONS, com.google.android.c2dm.permission.RECEIVE |
| Staying connected in the background | Never asked: granted when CHANNEL is installed | A notification shows while it runs | FOREGROUND_SERVICE, FOREGROUND_SERVICE_CONNECTED_DEVICE, WAKE_LOCK |
| Running a check when the phone starts | Never asked: granted when CHANNEL is installed | Reads nothing; runs CHANNEL's own checks before anything is opened | RECEIVE_BOOT_COMPLETED |
| Network | Never asked: granted when CHANNEL is installed | Used to deliver messages | INTERNET, ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE, CHANGE_NETWORK_STATE |
| Microphone | Your first call or voice message | Used only during a call or a recording | RECORD_AUDIO, MODIFY_AUDIO_SETTINGS |
| Camera | Your first video call, code scan or photo taken in the app | Used only while the camera is on screen | CAMERA |
| Choosing photos and videos | Never asked: the Android photo picker shows CHANNEL only what you choose | Nothing is held | none |
| Contacts | When you open the phone's contacts inside CHANNEL and tap Continue | Read while that list is open, never saved, never sent | READ_CONTACTS |
| Saving to the gallery | Android 8 and 9 only, the first time you save a picture or keep a copy of what you take; Android 10 and up never ask | Used only to add the file you chose to save or the copy of what you took | WRITE_EXTERNAL_STORAGE |
| Fingerprint or face | Never asked: CHANNEL does not use them; a library CHANNEL includes declares them | Nothing is held | USE_BIOMETRIC, USE_FINGERPRINT |
| Purchases | When you buy something in the app | Handled by Google Play | com.android.vending.BILLING |
| On-device AI (Gemini Nano) | Never asked: Android's own AI service, used only when you turn on on-device AI | Runs on the phone; nothing leaves it | com.google.android.apps.aicore.service.BIND_SERVICE |
A readable copy of a picture, a clip or a file that CHANNEL makes to show it, play it or hand it to another app, and that is left on the phone, is deleted the next time CHANNEL starts.
CHANNEL's servers store no IP addresses, no messages they can read, and no contact lists. When your device looks up someone's published key, a rate limiter keeps a keyed fingerprint of your network block (not your address) for up to two hours, so nobody can probe numbers by the thousand. Some records exist outside any app's control:
What you can do:
CHANNEL does not check whether an Android phone runs the system it was sold with, whether it is rooted, or whether Google's services are on it, and it refuses no phone for any of these. Nothing in it is there to stop it running on a system such as GrapheneOS. Purchases through Google Play need Google's services on the phone. Wake-ups for calls and messages come through Google's push service when those services are there; without them, they come through a UnifiedPush app installed on the phone, whose server sees that a wake was sent and never a message, a name or a sender.
What is done to find mistakes before they reach you.
No independent human security audit of CHANNEL has been done. The reviews above are not an audit.
The whole of Help is inside the app and works with nothing connected, for ever. When newer pages exist, a line at the top of Help says Updated help is available and offers Get It.
Knowing that costs nothing: the app learns it from a poll it already makes for your mail, so there is no extra connection and no new pattern for anybody to watch. Help does not check on launch or on a timer, because a request on a schedule would report when you open the app whether or not anyone was counting.
Nothing is downloaded until you press the button, and the sheet says plainly what pressing it does. It contacts our public website, channelmessenger.net, and that server sees your address. Nothing else is sent, and Help works without it. If that matters where you are, do it on a network that is not your own.
Our server never says where the pages are, only that there are newer ones, and the app writes them only once every page is in hand, so a download that stops halfway leaves the Help you have as it was.
Settings › AI Features takes My own server as a provider: a machine you run, usually reached over a private network of your own. Nothing about it reaches us. We are never told the address, the request never touches our server, and the words go to your machine and stop there. See Settings.
If you turn on Chat as a Contact for an AI account, that contact is a thread with your own provider account and nothing else. It is told, in its instructions, that it can see only this conversation, that it has no memory of your other sessions, no access to your contacts, your location or your device, that it cannot send a message or take any action, and that it must never ask you for a password, a key or a code. Nothing else on this device is ever sent to it. Only you can write to it, and it can reach nobody.
Requests are counted per account, so you can see what an account has been used for.
Settings › Privacy › Messages Written by an AI chooses who can file a message that the sending app marked as written by an AI. Everyone files every such message. Contacts Only drops a text, a view-once text, or a group post when the sender is not a contact. It is not filed and it raises no notification. Messages from contacts stay, and so does a message with no such mark. The mark is a statement by the sending app.
When a feature sends somebody else's words to an AI (Summarize, Suggest Replies, Translate, or asking about a picture they sent), CHANNEL first removes characters a person cannot see but a model can read, and marks their words as quoted, with an instruction that quoted text is never to be obeyed. That makes it much harder for a message to steer what the AI tells you, though not impossible. The answer to those is always shown to you first and is never sent by itself. Automatic replies, which you switch on for a profile by choosing an AI, is the exception: it sends its answers without showing them first.
English is the reference text; any translation is a convenience.
CHANNEL