The last item in the bottom bar is your profile, and it carries your picture and the profile's name. Tap it and Settings opens. When another profile has messages waiting, the button shows their total, and a tap opens Settings at the top with the profile picker open, each profile showing its own count: choose one to switch to it, or tap Done to leave them for later. The count stays until that profile is opened and its messages are read.
Help and Documentation is at the very top. Below it, under Profiles, your own card sits first: your picture, your name, and under it the first thing you publish — your handle, or a number or address — or Your card when you publish nothing. Tap your card to edit your contact information, as the line under it says. The chevron beside it opens the profile picker and takes you straight to whichever profile you choose. About comes next, then Shared Profiles. Then the settings in groups: Messages and calls, How messages travel and Privacy and safety, with Subscription on its own. Navigation, Return sends the message and Transfer progress are set right on this page. Next is Diagnostics, folded, with Performance, Transfers, Storage and Store Diagnostics, and Guided Setup is last.
The upper right holds a pen, which opens your own card. The upper left holds a magnifier beside Settings, which opens the search.
The search opens with every setting in one list, A to Z, each name with its page under it (Settings > Privacy), and the field filters as you type. It matches both halves of a row: typing notifications finds the page and the things on it, and typing the name of a setting finds it wherever it lives. Every setting has its own name, so two settings that share a label on different pages read differently here. Tapping a result opens the page it is on, on the tab that holds the setting, scrolled to it and lit for a moment. The list shows only what the page itself shows on this phone right now: a setting that appears only with a second profile, with Automatic Backup on, with an AI account, or with a PIN or distress code set is not offered until then. A typed word lists the setting with exactly that name first, then names that begin with it, then the rest, and a page's own row comes first among equals.
Manage profiles is the last item in the profile picker, in red — the chevron beside your card at the top of Settings opens it. It asks before it opens, because renaming a profile is harmless and deleting one is not: deleting removes that profile's messages, its contacts and its identity from this device, and nothing brings them back.
Most settings belong to the phone. A few can differ for each profile: the routes on Reach, quiet hours, what the lock screen shows, the read receipts and photo settings on Privacy, and the Calls page.
Once you have a second profile, the pages that hold those settings open with All profiles and This profile at the top. Choose This profile to change only the profile you are using; a profile with no setting of its own follows the phone. The choice belongs to that page alone: choosing This profile on Calls changes nothing on Reach or anywhere else, and the line under the choice says which profiles a change reaches. Reach opens on This profile every time, and All profiles there lasts until you leave the page. On Settings itself, a small person mark beside a row says the profile you are using differs from the phone there.
Settings rows are named after what they do, and nothing more. The explanations are here.
Shared Profiles is on your own card, apart from adding a contact. It puts a profile of yours on a second device. On the device that should receive it, open your own card, Shared Profiles, Receive a Profile: it makes a new profile on this device to hold the shared one and shows a code; if this device already holds as many profiles as it can, it says so instead of a code. On the device that has the profile, open your own card, Shared Profiles, Send This Profile, and scan that code — the received profile takes the sending profile's name. If you have more than one profile, choose which at the top of the screen before you send — a device carries one profile, and the devices listed below the picker are that profile's. Each device names itself by its model and the profile it mainly uses, so telling them apart is easy. The camera reads the code: both devices are in your hands, so there is no question of who is holding them, and a linking code is long enough that nobody wants to type it. From then on a message sent from any device of the profile appears on its other devices too — a disappearing message or a view-once one does not — each sealed to that device's own keys, so nothing is copied between them and nothing about the link is on our server.
Your contacts follow: every card on the phone appears on the other device, and an edit or a deletion on the phone reaches it within a minute. Notes stay on the phone. Messages follow too: when a device links, this device sends it every conversation, newest first, and waits while a call is going on; the photos and videos of the period chosen on the Shared Profiles screen follow the same way — the last 7 days, 30 days, 60 days or a year (the default), and never less than the last 7 days. Older photos and videos show as a placeholder that brings them over when you tap it. So does a single video larger than 500 MB, and older photos and videos beyond the first 4 GB. A photo, video, file or voice note sent or received after the link appears on every device by itself, as it does on the phone. A transfer interrupted by closing the app carries on when it is next opened. Up to 10 devices in all. The code on Receive a Profile works for 10 minutes and for the first device that scans it; for a later share, open Receive a Profile again for a new code. A device shares at most 9 of its profiles with other devices at once, so a tenth can only arrive by Transfer. When a share would pass that limit, or put the profile on more than 10 devices, both screens say so and nothing is sent. Removing one takes effect at once — your contacts stop writing to it the next time they check. When a device and the phone stop reaching each other and the app cannot mend the link by itself, the row on each says so and what to do: Revoke the device on the phone, then share the profile with it again. Blocking a contact reaches every device the profile is shared to, whichever device you block it from. A message to a contact this device holds no keys for yet is sent through the phone, and nothing on screen says so; if the phone has not sent it after a minute, the conversation says Waiting for your iPhone to send this (the phone's name, or your other device), and opening CHANNEL on the phone sends it. Once the phone has sent it, the message shows the same ticks and route letter here as on the phone.
A device that is missing older messages gets them from the phone. On the device, open Shared Profiles and choose Get Older Messages from Your Phone. The phone compares every conversation with what the device holds and sends again any conversation that is short; the device then fetches by itself every photo and video from the last 7 days that it lacks, and older ones are a tap away; a message the device already has never appears twice. A device also asks once by itself, an hour or more after it is linked. The line under the button says what is happening, and reads Your phone has sent everything it has. when nothing is short. If it says it is waiting, open CHANNEL on the phone; the phone answers only with the newest version of CHANNEL.
Groups show there too. A device is not a member of your groups, so a reply typed there is posted by the phone, and waits while the phone is off. A reply from a device is text; a group whose messages disappear is answered from the phone. A group's photos and videos stay on the phone and show by name and size.
A conversation read on one device is read on the others. If read receipts are on, the person who wrote is told once, by the device you read it on.
A request is answered once, on every device. A message request left at a handle, number or address this profile publishes appears on every device the profile is shared to, and answering it on one device answers it on all of them. A request whose words are sealed to one device is accepted by that device.
Ticks follow the message. On iPhone and Mac, a message the profile sent from one device shows its delivered and read ticks, its read colour and its route letter on the profile's other devices too, as it does on the device that sent it.
On a device, a contact's card says Through your phone until their app has met that device: what they send reaches the phone and is copied to the device. That happens on its own once their app next hears from your phone. When this device keeps writing to them through the phone, it asks the phone to have their app introduce itself again. The contact is never asked to accept, and reads as Linked rather than Not linked in the list, the thread and the detail. Once the contact's own hello arrives, the device sends directly. This is for text: attachments and replies to a message wait.
Each device has a name. On Shared Profiles, every device of the profile shows as its name, its model and the date it was shared, so five Macs are five different rows. The model is read from the device itself, for example Mac Studio, MacBook Air, iPad Pro or Google Pixel 8. Choose Rename on a device, from any device of the profile, to call it "Studio" or "Kitchen Mac"; leave the name blank to use the model, with a number added when two devices are the same model. Only your own devices see these names — they are never sent to your contacts. A device that receives a profile asks for its own name, offering its model — or, for an iPad app on a Mac, the computer's name, or on Android the name set in Settings — and the name it keeps shows on every device of the profile. Tap a device to see its actions, Rename, Transfer This Profile Here and Revoke, and a line saying what Revoke does for that row.
Progress and the whole set. While a profile is being shared, the Shared Profiles screen shows a bar you can leave at any time: Sharing with <device>: N of M on the device that sends, Receiving from <device>: N items and then Up to date on the device that receives. The copy runs slowly in the background so the app stays responsive. Every device of the profile also shows Devices on this profile: N of M, this one included, M being how many fit (10). The count and the list follow the profile: when a device is added or removed, they change on every device of it. Only a profile on no other device says Not shared with any device. A device that received the profile lists each of them by name, with This device marked; the list there is read-only.
Deleting a shared profile removes only that link. Delete a received profile on a device and the phone drops that device from its list; delete the phone's profile and each device stops treating the phone as its origin and keeps everything it holds. Neither side ever deletes or wipes the other.
Transfer moves a profile to one of the devices it is shared to, and off this one. On the device the profile was made on, open Shared Profiles and, on that device's row, choose Transfer This Profile Here. Everything moves: who you are to your contacts, every conversation and every photo. While it moves, nothing is sent or received for the profile, and messages for it wait until the other device takes over. Formal groups whose posts are kept on our server, and messages set to disappear or to be seen once, stay behind, and other devices the profile is shared to must be linked again. When everything is there, the screen offers to remove the profile from the first device. Until the other device takes over, Cancel the Move leaves everything as it was, and a move the other device never answers cancels itself after ten minutes. If the other device has not confirmed after a day, the screen says so and offers Try Again and Keep a Copy Here; Keep a Copy Here leaves the profile on this device, and your other devices treat this one as gone until you share the profile to it again.
A shared profile has a PIN. Making a profile with New profile asks nothing about a PIN. Send This Profile and Freeze Sharing ask you to choose a Profile PIN first when the profile has none: A New PIN, typed twice, or the PIN of another of your profiles, typed once. The PIN follows the profile to every device it is shared to. Locking the profile is a separate choice in Privacy. Change Profile PIN asks for the current one. Remove Profile PIN is always there once a PIN is set; a profile without a PIN cannot be shared until you set one again, and devices it is already shared to are not affected. A PIN used on two profiles opens both, so whoever learns it has both.
Every device a profile is shared to holds its messages and can read new ones, so a profile kept for sensitive conversations is safest on one device. Share or transfer a profile only to a device you own and keep with you, and give a profile that is on more than one device a profile PIN.
Think before sharing a profile that matters. CHANNEL protects what it holds, and every device holding the profile adds one more thing to keep safe: the device itself, its passcode, and the setup described in If a device is lost or stolen on the Privacy page. A family profile shared across your iPad and computer is a sensible use. A profile for work where exposure would be serious is safest on one device you keep with you; weigh what sharing it gains against what one lost or seized device would expose before you share it at all.
The same screen lists what this device RECEIVES, when somebody has shared a profile with you. A device sharing a profile is not a person you message, so its messages stay out of your conversations and its card stays out of your contacts. Stop Receiving ends it. If one of them really is a contact, Stop Receiving brings that conversation back where it belongs and deletes nothing. When the device sharing it removes you, this entry clears itself. If this device is off at that moment, the entry stays until you use Stop Receiving here.
The handle comes with the profile. A profile that holds a handle carries it to the device that receives it, together with its Find me by tick: ticked on the sending device, ticked on the receiving one, and unticked stays unticked. The received profile takes the name and the handle of the sending profile, and a handle the receiving profile already holds is kept. People reach the profile at that handle from either device, and our server can see that someone is published at a ticked handle, though not who.
If a device is lost or stolen, do both things on the list: Revoke it, which stops people writing to it immediately and needs nothing from the device, and Erase it, which tells it to destroy everything it holds. The erase reaches it only if it is switched on and can reach the internet within thirty days, so treat it as the extra rather than the answer. With a PIN set on that device, its contents are already behind the PIN.
On a device that received the profile, the phone it came from has Revoke on its row as well. This device then takes nothing more from that phone, neither contacts nor settings nor an erase, and keeps everything it already holds. Your contacts know the profile by that phone, so a lost phone receives what they send it. The row of another device that received the profile has Revoke too: it asks the phone the profile came from, the row says it is waiting, and that phone revokes the device as soon as it can be reached. Every Revoke asks for the app PIN when one is set; with no app PIN, anybody holding the unlocked device a profile was shared from can revoke the others. If a lost device knew the profile PIN, change it: the new one reaches only the linked devices.
Freeze Sharing is for a profile that is on more than one device when one of them is lost or stolen. Open Shared Profiles on any device of the profile and choose Freeze Sharing. It asks for a new freeze PIN, which stays on that device and is never sent to your other devices.
While the profile is frozen, no device shares it or moves it. A device that was not one of the profile's devices when the freeze reached yours gets nothing from yours, neither messages nor history, and stays refused after the freeze ends. The devices that were already there keep working, and messages still reach them. A freeze does not take the profile off the lost device; use Find My or Find Hub for that.
A freeze ends by itself after 7 days. On the device that set it, Extend Freeze by 7 Days with the freeze PIN adds another 7 days and Lift Freeze ends it at once. Only the device that set a freeze extends or lifts it. Five wrong freeze PINs in a row make that device take the profile off itself and tell your other devices. Several devices can each freeze the profile, and it stays frozen while any freeze is in force.
Before a profile is shared or moved, both devices collect their messages and ask our server for the time. A freeze is judged by that time and never by a device's clock. A device that cannot reach our server cannot share a profile. Our server sees that a time was asked for, and nothing about the profile.
Start Fresh is for a profile you cannot trust. Open Shared Profiles and choose Start Fresh. CHANNEL makes a new, empty profile on this device that carries your contacts' cards: their names and the numbers, addresses and handles on them. Keys, messages, notes and pictures stay with the old profile, which is not touched. Whoever holds it keeps it.
You choose when to press Tell My Contacts. If you verify your number on the new profile first, your contacts see that you did. Each contact with a number, address or handle receives a request, and nothing flows until they accept. A contact with nothing to write to is listed under Meet in person to reconnect. A note you write goes with the request and is not proof of who you are. A contact whose CHANNEL does not show the request is met in person.
Your contact reads the request in their message requests. It says "Says it replaces" and then their own card for the old profile, never a name the new profile supplies. When they have no such card, it says so as a warning. A verified number is shown as weak evidence, because a stolen phone keeps its SIM. When two new profiles claim the same old profile within 30 days, both requests carry a warning to meet or call before approving either. A request with no verified video asks them to call you or check another way. Accept makes a new contact; their card for the old profile and its conversation stay as they are. Decline and Block work as for any request.
A request proves who says it and never that it is true. The invitations go through our server to each contact's number, address or handle, and it sees that an invitation was left at each, so it can see which values one new profile wrote to.
Each profile's settings are the same on every device it is shared to, except those marked This device only. A change to a setting reaches the profile's other devices, sealed between your own devices the same way your contacts are, and never to a contact.
These are the same on every device a profile is shared to: read receipts, typing indicators, link previews, private messages from group members, accepting every link request, calls from people not in your contacts, what the lock screen shows, quiet hours, translation, photo size, how long undelivered mail waits, Relay Only for calls and the other privacy settings. These are marked This device only, because they belong to this machine's hardware, battery, radios, sounds, screen or windows: the routes on Reach, sounds and banners, keeping a copy in Photos, Wi-Fi for calls, background noise, hiding the app, the keyboard, Relay for Others and Carry for.
When two devices change the same setting, every device settles on the same answer, counted by changes rather than by any clock, so a device that was switched off cannot undo a newer choice when it comes back. A privacy setting loosened on one device is loosened on every device the profile is shared to; when that happens, Settings on this device says so in one line under your card, naming the device and the time, until you dismiss it.
The profile's PIN, its distress code and Lock This Profile always follow the profile to its other devices, with no choice: a locked profile arrives locked on the device you send it to, and the same PIN opens it there. Setting, changing or removing the PIN or the distress code on one device does the same on every device. What travels is a check each code can be tested against, sealed between your own devices, never the code itself. Typing the distress code empties the profile only on the device where you type it; the profile on your other devices is untouched and nothing is sent.
The app PIN, the app's distress code, Secure Mode, erasing, the backup folder and the Local API stay on each device and are marked This device only. So is how messages are fetched (How to Get Messages), the message sound, the camera and AI accounts.
Notify Me is a switch for each profile, on to begin with. Off, this device stays silent for that profile: no banner and no sound for its messages and requests. They still arrive, are filed, and are counted on the badge. Calls still ring. An AI connected to the profile through the Local API is told of new messages either way. The switch belongs to this device and does not follow the profile to its others.
Quiet Hours for Alerts is a switch for each profile, off to begin with. On, it asks for a start and an end time; between them this device shows no banner and plays no sound for that profile. Messages still arrive, are filed, and are counted on the badge, and calls still ring. A start time later than the end time runs through midnight. Like Notify Me, the times belong to this device and do not follow the profile to its others. The Pause Checking switch on Getting Messages is a different thing: it stops this device from being woken to check for mail. On iPhone, Let Urgent Messages Through, on to begin with, lets a text its sender marked with Send as Urgent show a banner and play its sound inside the window. The start and the end cannot be the same time: a picker refuses the time the other one has and keeps the time it had.
Message Sound for arriving messages. On Android the banner and lock screen behaviour belongs to the phone's own settings after the first install.
Notification Sound is chosen for each contact and each group, over the profile's Message Sound: on iPhone on the contact card and in Group Info, on Android in the conversation's menu. Choose one of CHANNEL's sounds, None for silence, or From a File… to load your own (on Android, Phone Sounds… lists the sounds the phone itself has); a row plays when you choose it. A sound you load from a file stays on this device: another device falls back to the profile's sound, and the row says Not on this device. In a conversation that is open, a new message plays a soft tick while Sounds While App Is Open is on.
In the app is the sound and the banner while CHANNEL is open: Sound When You Send (the tick), Sounds While App Is Open, and Banners While App Is Open. A banner names the profile the message arrived in and says nothing else, because a banner is visible to whoever is holding the phone. Profile names are kept short, so that line always fits (Limits has the length).
Lock screen has a switch for each kind of notification: Messages on Lock Screen, Calls on Lock Screen and Groups on Lock Screen. All three are off to begin with. Off, a notification says only CHANNEL and that a message or call arrived: no name, no words, no group name. On, it shows who it is from and what they wrote, where anyone holding the phone can read it.
A contact's page has its own Lock Screen choice for that one person: Use Profile Setting, Show or Hide. Show and Hide win over the switches here, for their messages and calls. A group follows Groups on Lock Screen alone. A profile behind its own lock, and a thread with Enhanced Conversation Privacy on, show nothing on the lock screen whatever the switches say. See Privacy on this device.
A preview of a picture, a clip, a voice message, a file or a location names the kind of message and never shows the content itself: no picture on the lock screen, no map, no coordinates. The words are the same ones the Messages list uses.
A notification that shows a preview also carries Reply and Mark as Read. Pull the notification down, or press and hold it, and a box appears; what you type is sent from the conversation it arrived in and the app stays closed.
It needs the preview. A reply box has to show who wrote and what they said, so a notification that is deliberately saying nothing does not grow one. A notification that shows nothing on the lock screen carries neither button.
A reply always goes from the profile the message arrived in, never from whichever profile happens to be open. If a notification cannot say which profile it came from, it carries no buttons at all rather than guessing.
Messages holds the settings for the words, pictures and voice in a conversation. Translation chooses whether the phone's own translator offers to translate what you receive. Photo Size is the size photos are sent at: Standard (about 2048 pixels), High (about 3200 pixels) or Full Resolution, which sends the original file; large photos take many more pieces to send. Location, time and camera details are removed from every photo at every size. Translation and Photo Size are the same on all your devices. Transcribe Voice Messages Automatically turns voice messages into text under the message, on this device; it is on by default and each profile keeps its own choice. Translate Transcripts Automatically shows a translation of a voice message's transcript beneath it, in your language, on this device; it is off by default and each profile keeps its own choice. Default Message Timer is the disappearing-messages timer for people you start messaging from now on; it is Off by default, each profile keeps its own choice, and people you already message keep their own timer.
The phone and video buttons in a thread hand the call to another app. Calls is where you tick the ones you use: Phone, FaceTime, WhatsApp, Signal, Telegram. An app you do not have installed says so.
On the other person's card you tick which of those apps know each of their numbers. Tap a call button and CHANNEL offers only the apps ticked on both sides. One match opens straight away; several show a chooser; none, and the button is greyed out rather than opening a dialog to explain.
The button says Call with only where the app really places a call, which is the dialer and FaceTime. For WhatsApp, Signal and Telegram it says Open in, because their links open the conversation and the call is one more tap. In that case CHANNEL puts the number on the clipboard on the way out, so you can paste it rather than come back here to read it.
Navigation, on the Settings page itself, is the map app CHANNEL hands a place to when you ask for directions. The list holds the map apps installed on this device. That app opens outside CHANNEL and receives the place you are going to. Long press a location card and every installed map app is offered, whatever this is set to. Every map shown inside CHANNEL is drawn from CHANNEL's own map service.
Transfer progress, on the Settings page itself, draws a bar under a picture, video or file while it sends. With it off there is no bar. The bar goes away once the transfer has finished. Sending, Resend and Cancel appear either way, and so does a send that fails.
AI in CHANNEL fixes a draft, suggests replies, summarises and translates. It comes from the phone's own AI where there is one, and from an AI account of your own, with OpenAI, Anthropic or xAI or a server you run yourself. AI puts everything CHANNEL does with AI on one page.
An API key is how an account of your own connects: a code the AI service gives you so that an app like CHANNEL can use your account. Settings › AI Features links to the page where each service issues one. The key stays on this device, our server never sees it, and the service bills you for what you use. What you ask it about goes to that service.
Apple Intelligence (iPhone). On an iPhone that supports it, AI answers come from Apple Intelligence on the phone itself: no key, no cost, and the message never leaves the phone. Settings › AI Features says whether this iPhone can. If you have also added an account of your own, that account answers when Apple Intelligence is busy or a message is too long for it — and if Apple Intelligence declines a message outright, nothing is sent to your account either.
Gemini Nano (Android). On an Android phone that supports it, AI answers come from Gemini Nano on the phone itself: no key, no cost, and the message stays on the phone. Settings › AI Features says whether this phone can, and Download Gemini Nano fetches it once, when you ask. It is used while CHANNEL is open on the screen. If you have also added an account of your own, that account answers when Gemini Nano is busy, not downloaded, or a message is too long for it, and if Gemini Nano declines a message outright, nothing is sent to your account either. Google receives usage statistics about Gemini Nano, never your words. Pictures still go to your own account.
CHANNELclaw.tail1234.ts.net:8080, and puts the standard path on the end itself, so give it the machine and the port and nothing more. Plain http is accepted here on purpose: a private network of your own is already encrypted underneath, and no certificate can be issued for a name only you can reach. The key field can be left empty, which is what most of these servers want, so Save asks for an address instead of a key. Nothing about that server reaches us: the words go to your machine and stop there.Settings › Advanced › Local API opens this page, on a Mac. On your first profile the row says it is not offered there, and has no way in. Settings › AI Features holds only what CHANNEL itself does with your AI accounts.
On the Mac only. CHANNEL on a Mac can let an app, a script or an AI program on this Mac read and send messages in one of your profiles: a Python function, or an AI app or assistant such as Claude Code. It connects to CHANNEL directly, on this Mac, over HTTP or as an MCP server. You steer it in that app; CHANNEL is what it uses to read and write. A model's API key on its own cannot use this, because a model's API only answers questions: something has to drive it. The keys you add under AI Features power CHANNEL's own AI features, such as translating and rewriting. A phone cannot offer this: it cannot keep a listening connection open while it is not in front of you. Off by default, and nothing is shared until you say so.
claude mcp add command, for programs that connect over MCP, such as Claude Code. Copy Key copies the key alone. Connecting needs that key, or a pairing code shown on this Mac, and only a program on this Mac can connect. A profile has one AI at a time.Which paths this device will use: Direct Wi-Fi, Bluetooth, Local Network, Internet. CHANNEL tries them in the order the lights are written, B W L 6 I: Bluetooth, Direct Wi-Fi, Local Network, a direct connection over IPv6, then the Internet. Switching one off hides its light everywhere. On Android a line under the Bluetooth switch says whether this device can be seen by others. How CHANNEL picks a path, at the foot of the page, opens a page with one line about each path. See Reach.
One reach setting is not here but on each contact's own page: Internet Fallback, which is how long a message for that person waits for a radio before the internet may carry it. It starts at At Once. See Reach.
One question, How to Get Messages, three answers: Push, Check Regularly, Only When I Check. Choose Check Regularly and a second row offers Every 15 Minutes, 30 Minutes or Hourly. Under the This profile scope there is also This Profile: On Demand. How often the app checks while it is open follows the same choice, so there is nothing else to set. Pause Checking, with Pause From and Pause Until, is on the same page and stops this device from checking between those times. Tap either time to set it with the time picker; the times are greyed out while the switch is off, a start later than the end runs through midnight, and the two cannot be the same time. Push shows Push for Messages and Push for Calls for each profile; Check Regularly shows Push for Calls. See Waking your device.
Relay for Others lets this profile carry sealed mail it cannot read, and post it to the recipient's mailbox once it reaches the internet. Each profile has its own, with three positions — off, contacts only, and anyone — and the page changes the profile you are using. Reach explains what each one means and why it works in both directions at once.
Off unless you use it, and never silent. Back Up Everything… seals profiles, identities, contacts, conversations, avatars and settings into one file under a passphrase you choose, and hands it to the phone's own file picker: your cloud drive, a folder, a computer. We never hold the passphrase and cannot recover it. Back Up Messages…, and Back Up Messages in This Profile… with more than one profile, make smaller files; Backups has every kind.
Automatic Backup makes the same file daily or weekly, into a folder you choose once: iCloud Drive or anywhere in Files on an iPhone, and on Android any folder the phone's picker offers, Google Drive included. It runs when you open CHANNEL and one is due, keeps the one before it as CHANNEL-backup-previous.cmb, and shows when it last ran. It never goes to our server. To run without asking, it keeps the passphrase on this device. The file stays sealed wherever it is, and whoever holds the folder sees it change each day or week. Back Up to Folder Now runs it at once, and Choose Another Folder… changes where the file goes.
Not in the file: disappearing and view-once messages, which were meant to go; photos and other attachments, for size; the app PIN; and the wake registration, so a restored phone registers afresh.
Whoever stores the file learns that a backup exists, its size, and when it changed. Restore… opens every kind. A full backup replaces each profile in the backup with its copy from the file, keeps this device's other profiles, and closes the app, so the next launch is a clean start on the restored data. A phone holds at most 10 profiles; when the backup and the profiles already here come to more, the app asks which of this device's profiles to keep, and the ones turned off are deleted with their messages and keys.
A backup can only be restored on the kind of phone it was made on: an iPhone backup onto an iPhone, an Android backup onto an Android. The two apps keep conversations in different shapes, and a restore writes its profiles straight onto the phone it lands on, so one made elsewhere is refused rather than half-applied.
CHANNEL has no account, so there is nothing on a server to close. What you have is on your device, and Settings › Erase, under Danger Zone at the foot of Settings, is where you remove it. Two choices, both final:
Both ask for your app PIN when you have one set. Both erase this device only — a linked device keeps its own copy until you deal with it, below.
What our server holds, and how to remove it: turn remote wake-ups off under Getting Messages to delete your push registration, and release your @handle if you claimed one. Both are immediate, and nothing else about you is there.
Erase everything asks you to type the word ERASE before it goes ahead. It then shows Erasing while it finishes and closes CHANNEL; open it again to start fresh.
Settings › Subscription says what a subscription covers, in the app's own words:
Bluetooth and Wi-Fi are always yours, even with no network at all. A subscription adds Internet sending, for when the other phone is out of range. If it ends, only your Internet sending stops: you keep the radios, every message and contact, and anything sent to you still arrives. A subscription covers your own sending, not the other person's. If you subscribe and they do not, your messages still reach them over the Internet, because receiving never stops. Theirs reach you when a radio can carry them.
What a subscription adds, and what is always free. A subscription is what sends over the Internet: through our server (I) and by the direct link to the other phone (6). Free with or without one: Bluetooth (B), Wi-Fi Direct (W), the local network (L), and receiving everything sent to you, however it comes. A free trial is the store's own offer, and Subscription shows it with its length and price. Without a subscription, a message only the Internet could carry waits in the conversation while the radios keep trying, and the line above the message field says so; tapping it opens Subscription. Everything else you send waits the same way: receipts, reactions, edits, deletions, group changes, shared cards and what your own devices keep in step. It goes by a radio when one reaches the other phone, or over the Internet the moment you subscribe. What lets you receive is never held back: your own card, which tells your contacts how to reach you, linking with somebody new, and asking for the rest of a file that is arriving. Neither is removing or erasing one of your own devices. Calls are in Calls: over the Internet they need a subscription, on the same network they are free.
It belongs to the account you bought it with on that store — your Apple ID or your Google account — on every device signed in to it, and renews until you end it. To end it: on an iPhone, Manage Subscription at the bottom of Settings › Subscription opens Apple’s own page, where Cancel Subscription ends it; on Android, Manage Subscription there opens Google Play’s subscriptions page, where Cancel subscription does. You keep what you paid for until the end of the period. Apple or Google takes the payment and therefore knows you subscribed. Our server never learns who pays: the app asks the store on the phone and keeps the answer there.
A family plan is one subscription, shared with up to five other people. On an iPhone, Family Sharing covers everyone in your Apple family group automatically. On Android, where the store has no such sharing, you choose who to share it with: Settings › Subscription › Family Plan lists up to five of your paired contacts, and each one's app counts as subscribed while your plan stays active. Removing someone there stops sharing it with them. Nothing about who you share it with passes through our server — your phone tells each chosen contact directly, over the same private connection your messages already use.
Settings › Diagnostics › Performance shows, for each path, how often this device saw the other one, how often it delivered, and how long the check and the send took — best, average and worst. It is there so you can see which path is actually doing the work on your device. Nothing on it leaves the device.
How long CHANNEL waits on one path before trying the next is learned from those numbers, and only ever gets shorter than the shipped setting, never longer. A Bluetooth send that is not going to work gives up after about six seconds and goes by the Internet, so the longest you wait for a message to leave is a few seconds, not a quarter of a minute.
Copy for support, at the top of the page, puts every line on it on the clipboard as plain text, and the buttons beside it share that text or reset the counts. What each line means, and what the copied text does and does not carry, is on Performance, in detail.
Settings › Diagnostics › Transfers shows every transfer in progress, in both directions and for every profile: an arrow for which way it is going, how far it is, and how long it has been since anything last moved — the figure that tells slow from stuck. A transfer that is moving says Last part … ago; one that has stopped says Nothing has moved for …, in the brand colour, and a stalled arrival also offers Ask for the missing parts. When nothing is moving because the other phone's messages are not opening here, the row says so and points to linking again from their card, which finishes the transfer.
Every row has Stop and free the relay, outlined in red. It asks first and says exactly what is lost: for a send, the parts already sent, deleted from the relay at once; for an arrival, the parts received so far, deleted from this device. Either way nothing is kept, and a transfer you stop starts from the beginning if it is tried again.
A transfer is built to survive what happens to phones. A half-arrived photo or video is kept for up to 48 hours, sealed, on this device, and picks up where it stopped when the next slice lands — the app being closed in between does not matter, and neither phone has to be there for the other. A dropped connection costs one slice, not the transfer. The size of a slice adapts to the link: it starts large, halves when one fails, and grows again after three in a row succeed. A transfer that would fill this device is refused before it starts rather than half-way through. Cancelling frees the space on our server at once. A large transfer goes by the internet or a shared network when either can reach the other phone, and by Bluetooth only when nothing faster can.
Runs the setup interview again, from the top, with your answers kept. See Getting started.
A name people can write to without knowing your number or your address, shown here as your handle or None. Tap it to claim one, and to give one up. It needs a verified number or address on your card first, and that value is never published. Lowercase letters, digits and underscores, one per profile. See Being found, and Limits for the length and how many a phone holds.
When a newer version of CHANNEL is out, a line at the top of the Messages list says which version is available, with Get It beside it. On iPhone, Get It opens TestFlight, or the App Store for a copy installed from there. On Android, Play downloads the update in the background and CHANNEL then offers Restart now or Later; a copy not installed from Play opens its Play page instead. The cross hides that version, and a later one shows again. TestFlight, the App Store and the Play Store can also update CHANNEL on their own. On a Mac, Check for Updates… in the CHANNEL menu names the version you are running and opens TestFlight or the App Store.
To learn the newest version, CHANNEL asks our server at most every six hours, with nothing about you or your device in the request; our server sees that a phone asked, and the address the request came from. A copy installed from Play asks the Play Store app on the phone instead, and our server is not involved.
CHANNEL follows the phone's own language setting: Spanish, Portuguese, German and Italian, as well as English. There is no language setting inside the app. English is the reference text. Any translation is a convenience; where the two differ, the English governs.
Near the top of Settings, straight after your profile. Shows the app's version and build number, ELTON SERVICES LLC's copyright, and rows for Terms of Service, Privacy Policy, Help, Support, and Third-Party Notices -- the licences of the other people's work CHANNEL includes. See Third-Party Notices.
Four things belong to one conversation rather than to the phone or the profile, so they are on the contact's page and not here: Internet Fallback, which is above; Wallpaper, the picture behind that one thread; Lock Screen, above; and Message another way, which hands your words to another app for somebody who does not use CHANNEL. So does Enhanced Conversation Privacy, which restricts one thread on both phones. See Messages. Delete Contact is at the foot of a contact's page, under Danger Zone; Revoke link is in the closed Advanced row below it.
A phone backup does not carry your CHANNEL identity, and that is on purpose. The key that proves you are you is kept in a place iOS and Android will not copy off the device — not to iCloud, not to Google, not into a backup that another phone could restore. It is the same property that stops anything else copying it out.
CHANNEL also keeps its conversations and contacts out of the phone's own backups. If a new phone holds CHANNEL's data without the key, it says so rather than pretending: the profile cannot receive anything, and your messages keep arriving on the old phone, which still has the key.
What moves a profile is CHANNEL's own backup. On the old phone, Settings › Backup › Back Up Everything, and choose a passphrase. Bring the file across however you like — it is sealed, and the passphrase is not in it and not known to us, so we cannot open it and cannot recover it if you forget it. On the new phone, restore it with that passphrase.
Two things it does not carry: photos and other attachments, for size, and messages set to disappear or to be seen once. Restoring those would break a promise made to the person who sent them.
Afterwards, stop using CHANNEL on the old phone for that profile. Two phones holding one identity both collect from the same place, and whichever gets there first takes the message — so a conversation would split between them at random. If you want both phones live at once, that is what linking a device is for: the second phone gets its own place in every conversation from then on.
On a paired Apple Watch, CHANNEL's notifications appear on your wrist, the same banner your iPhone shows (or New message when previews are hidden or the profile is in Secure Mode). Reply from the notification with dictation, Scribble, emoji or a suggested reply; your iPhone sends it as if you had typed it there. A notification's text can be read by anyone who sees your wrist, and it stays in the watch's Notification Center until you clear it; with previews hidden or the profile in Secure Mode, the watch shows only New message.
English is the reference text; any translation is a convenience.