Every message is sealed on your phone to the contact's key and opened on theirs. Nothing in between can read it: not our server, not the Wi-Fi, not a phone carrying it for you.
A small coloured disc beside a message carries one letter: B, W, L or I. It says which path actually carried that message. B, W and L mean a radio did it alone and the message never touched the internet. I means our server carried it. The letters are always written in that order, B W L I, which is the order CHANNEL tries the paths in. See Reach.
One other letter can appear on a message: an S, in the app's warning colour, on a message that went out as a text. It is not one of the four, and it is never among the letters under a contact's name. See Sending as a text message below.
A tick under your own message follows it. Long press an outgoing message and choose Info for the three times: Sent, Delivered and Read.
Sent means the write completed. Not that it was queued, not that a radio was in sight: the other phone took the bytes.
A read time appears as soon as they see it, including while they already have the thread open in front of them. Read receipts are both ways or neither. Switching them off stops you sending them and stops you seeing them.
A clock beside a message means it is waiting. Nothing could carry it yet, so it sits on this phone, sealed, and nothing has been given to anyone.
CHANNEL tries again on its own: every 30 seconds while the app is open, when you bring the app forward, when you tap Check Now, and when you open the chat. You do not have to resend it. If a contact is set to wait before the internet may carry a message, the clock is also what that wait looks like.
You can write to anyone whose card has a phone number or an email address they have verified, or a handle of theirs written as @name, paired or not. Type the message and send it.
The message files with a clock, and CHANNEL leaves an invitation at that number or address. One line above the composer says where it stands: Sends when Mary accepts, then Waiting for Mary to accept. The moment they accept, the keys are exchanged and your message goes out sealed, with no further tap from you.
The other side sees a request with your name and the value you used, and chooses Accept, Decline or Block. Your words are not in the invitation, because the invitation is the one thing our server could read. See Pairing.
None of these appear on a view-once picture. That one is shown and then gone.
A picture you have staged in the composer but not sent yet has the same menu. There, the answer from Ask AI About Photo lands in the caption field, ready to send, and nothing is sent until you send it.
Set a timer on a conversation and every message after that is removed from both phones once it has been seen and the time has run. Both sides see the timer.
A photo sent view once is shown one time and then removed. The recipient's phone shields it from screenshots while it is on screen.
You can put a picture behind one thread, so two conversations do not look alike. Open the contact and, under Wallpaper, tap Choose Wallpaper. Once one is set the button reads Change Wallpaper, and Remove Wallpaper appears under it.
CHANNEL dims the picture as much as it needs to so the writing stays readable. A bright photograph is dimmed more than a dark one, and even a middling one is dimmed a little, because the dates, the marks and the time under a photo sit on the picture rather than in a bubble. Messages keep their own solid bubbles, so the words are exactly as legible as they were before. No picture is ever refused for being too bright or too dark: it is dimmed instead.
A wallpaper is a decoration for your own screen. It is never sent, never received, set for one contact at a time, and it goes when the profile it belongs to goes.
Beside the composer: Photos (the phone's own picker, running outside the app), Camera (one picture, nothing kept), and Location.
Tap Location under +:
CHANNEL never reads your location at any other time.
A location arrives as one card per share, reading Location, Live Location or Live Location Ended, with the time it runs until and when it was last updated. The card moves in place as fixes come in; the thread does not fill up with a line per update.
While a share is running in a thread, a pin sits at the top beside the lights, so you do not have to scroll back for it. It dims when the share ends and still opens the last known position.
In the thread where you are sharing, a timer sits beside the lights with the time left on it: 12m, 1h 05m, 7h. Long press it for Extend 15 Minutes, Extend 1 Hour and Stop Sharing.
Once your share has ended, its long press offers Share Again for 15 Minutes, 1 Hour or 8 Hours.
Tap a location card, the pin or your own countdown and the map opens inside CHANNEL, with both phones on it. Under the map: the distance and direction, such as 0.4 mi NE, and an arrow that points at the other phone from the way yours is facing. The arrow is garnet within about a mile and grey beyond that. A live share moves on the map as updates arrive.
The map's menu hands the place off to any map app installed on your phone, for navigation. Long press a card to do the same without opening the map, and to Copy Coordinates. Which app a plain tap uses is Settings › Location › Open With.
On Android, a one-line row above the composer shows what is on the clipboard now: the text, or Photo for a copied picture. Tap it and the text goes into your draft, or the picture is staged as if you had picked it.
On iPhone that row is off until you turn on Settings › Privacy › Clipboard Preview, because reading what another app copied makes iOS ask Allow Paste? every time. To stop it asking, set the phone's own Settings › CHANNEL › Paste from Other Apps to Allow.
With the row off, the paste button beside the composer stays. It lights when the clipboard holds text or a picture, and your tap is the consent, so nothing is read until you ask. Either way, a copied picture pastes as a photo, not as a filename.
AI is off until you set up an account of your own under Settings › AI: OpenAI, Anthropic, xAI, or a server you run yourself. A key stays on this phone and our server never sees it. Nothing is ever sent to a provider on its own. Every use shows you exactly what will leave, and the send button is the consent.
With an account set up, the ✦ in the composer opens a menu:
Summarize with AI is in the thread menu. It sends the last thirty messages and shows bullet points. The summary is not stored.
Translate with AI and Ask AI About Photo are on the long press menus above.
A result is a suggestion. It goes into your draft only when you choose it.
If you tick Chat as a Contact on an AI account, a contact named after the provider appears in every profile, and you can talk to it like anyone else. It has no lights and no call buttons, because nothing carries the message anywhere but to your own provider account.
That contact sees only the thread you are in. It has no memory of your other conversations, no access to your contacts, your location or the rest of your phone, and it cannot send a message to anyone. Nobody else can write to it.
Photos are sent as sealed attachments. With Photos: Nearby Only on, they never go by the internet: they wait until the two phones are near each other.
Translation is done on this phone, by the phone's own translator. The text never leaves it to be translated. Turn it off, or choose which languages, under Settings › Notifications. Translate with AI on a long press is the other route, and that one does send the message to your provider.
This is for somebody who does not use CHANNEL. Open their contact, under Text message, and turn on Send as Text Message. The switch is there for a contact with a phone number on their card. What you write then leaves as an ordinary text from our number, and their replies come back into this thread.
This is the one thing in CHANNEL that is not end-to-end encrypted. Our server can read what you send, because it has to in order to send it, and the phone network can read it too. Everything else in this app is sealed on your phone and opened on theirs. This is not, and the app says so three times: on the switch before you turn it on, on a standing line above the composer for as long as it is on, and on every message that went that way, which wears an S.
It is off to begin with, it is set for one contact at a time, and there is no switch that turns it on for everybody. A bridge is a decision about one conversation.
Replies are kept for as little time as possible. One is deleted the moment your phone collects it, and anything left uncollected is thrown away after a day.
One number serves everybody, and that has a limit. A text arriving at our number is matched to a conversation by the number it came from. So if two CHANNEL users are both texting the same person, that person's reply goes to whichever of them wrote most recently. There is no way around that short of a separate number for every pair, and it is why a route lapses after thirty days instead of standing for ever.
It does not work yet. The carrier registration that lets our number send texts to ordinary phones is still under review, so nothing can go out this way until it is approved. The switch and everything behind it are built and waiting on that.
You can report a conversation. What is sent is the messages you choose to include, sealed to us, and nothing else.
English is the reference text; any translation is a convenience. Help is stored on this phone and never contacts anyone.