CHANNEL never uploads contacts. A contact exists in CHANNEL because you typed it, imported it, or paired with it. Contacts › Phone can show your phone's own address book so you can find somebody without retyping them: it is read only while that tab is open, is never saved and never sent anywhere, and only the person you choose to import is kept.
Nothing stops the other person from screenshotting, recording, or photographing what you send them, and CHANNEL would not know. There is no setting for this, because a setting here would protect nobody from anybody.
What is shielded on this phone, always: a view-once picture while it is on screen, the pairing QR code, and every screen where a secret is typed, which is the PIN pad, the distress code, the backup passphrase and an AI key. A capture of one of those is blank, and the blank page says why. The app switcher card is blank too.
What is not shielded: your conversations and your contacts. Screenshotting your own chat is ordinary, and the privacy of this app rests on what leaves the phone, not on stopping its owner photographing it.
When you leave the app, its card in the app switcher shows a blank garnet page, not your conversations.
Settings › Lock › Face ID requires the phone's own unlock, whether that is a face, a fingerprint or a passcode, to open CHANNEL, and again after it has been in the background for a while.
Settings › Lock › App PIN adds a code of your own. It works even on a phone with no lock at all, and it is asked before anything else. A face alone never opens a PIN-protected CHANNEL. With Face ID also on, it is the PIN first, then the face or fingerprint. The PIN is never stored; a slow hash of it is. Three wrong tries start a delay that doubles.
### There is no reset, and that changes what a good PIN is
Nobody can recover this PIN. Not you, not us. We never hold it — only a slow hash that can check an answer and cannot produce one. There is no account, no email on file and nobody to appeal to. Forget it and the messages on this phone are gone.
So choose one you will still know in six months, and make a backup before you set it (Settings › Backup), kept somewhere you can reach without this app.
That cost is also why CHANNEL asks less of a PIN than a website does. Only two are refused:
Those are the first two things anyone tries. Everything else is yours, including repeats: 1223, 7788 and 1911 are all fine. A rule that banned them would push you toward a code you write down or forget, and forgetting is the outcome that costs you everything.
Four digits is enough. Six is better if you will remember it — and if you would rather have words, turn on Use letters and numbers and type a phrase instead.
Guessing is already handled elsewhere: the delay after wrong tries doubles, and checking one guess is deliberately slow. A longer PIN adds very little on top of that. Remembering it adds everything.
### It belongs to this phone
The PIN is not copied to a linked device. Each one gets its own, so unlocking here never unlocks there, and a device you lose does not hand over the others.
Both are off until you turn them on, under Settings › Lock, and both are for a device somebody else might be holding.
Ask for PIN to change profile. The profile picker is a list of identities you keep apart on purpose, and without this it opens any of them with one tap. Turn it on and switching asks for the app PIN first — even into a profile that has no lock of its own, because what is being protected is the switch, not the destination.
This is the borrowed-tablet case. Under one login the phone or tablet gives CHANNEL no way to tell two people apart, so the PIN is the only separation there is.
Ask for PIN before deletes. Deleting a contact, a conversation or a profile asks for the app PIN first, and then still asks whether you meant that one. Two different questions: whether you are allowed to, and whether you meant it.
There is no grace period on either. The app lock waits a minute before asking again, so that stepping out to copy a code does not cost you an unlock; that reasoning does not apply to something nothing can undo. A delete here is real — the record goes, not a flag — so being asked is the whole protection.
Neither uses your face or fingerprint. On a shared device those are often available to whoever is holding it; the PIN is the part that is not.
A profile can hold a code of its own, separate from the app's. Under Settings › Privacy, with This profile on, tap Set a Profile PIN. Once set the row reads Change Profile PIN, and Remove Profile PIN appears under it.
It is genuinely a second code: its own salt, its own count of wrong tries, its own delay. Guessing at one profile's door does not lock the app, and knowing the app's PIN does not open the profile. The point of having several profiles is that they are separate, and one code for all of them would make that separation only look real to anybody who has watched you type once.
The order follows the app's. Opening the app asks for the app PIN, then the face or fingerprint. Opening a protected profile asks for the profile PIN, then its face or fingerprint if Lock This Profile is on. A face alone never opens an identity that asked for a second secret.
Two differences from the app's lock are deliberate. The profile's entry screen names the profile, which the app's own lock screen never does. And the profile door has no distress code, because the distress code destroys everything CHANNEL holds on this phone: a per-profile one would be a code typed at one profile's door that wiped the other nine. The distress code stays where its reach matches the door it is entered at, which is the app.
Deleting a profile takes its PIN with it.
Under one login, the operating system does not separate two people. Everything CHANNEL holds is reachable by whoever is holding the device. The PIN is not a convenience here; it is the entire isolation.
Turn on Other people use this device under Settings › Lock. That one switch does what three settings would otherwise have to: the app locks the moment it leaves the screen with no grace period, and every profile switch asks for the PIN. It is one switch on purpose — handing a tablet round should not require working out which settings add up to the protection you want.
Then give each person's profile its own PIN, under Settings › Privacy with This profile selected. That one setting does three things:
Turn on Ask for PIN before deletes on the same page. Deleting is real here — the record goes, and nothing restores it — so being asked is the whole protection.
The honest limit. None of this makes a shared device private. Anyone holding it can still see that CHANNEL is installed, that profiles exist, and that messages arrive. A profile that genuinely matters does not belong on a device other people use, and no setting on this page changes that.
The distress code belongs here too: it destroys everything CHANNEL holds on the device, so on a shared one it destroys everybody's. It is app-wide by design, for that reason.
Distress Code, under the same heading, is a second code, and it appears only once a PIN is set. Entered instead of your PIN, the lock screen shows one small Confirm. Confirm destroys everything CHANNEL holds on this phone: the key that seals the stores first, then the identities, then every file. The app then opens as if it had just been installed, and nothing on screen says otherwise. A copy kept elsewhere, such as a backup or another phone, is untouched.
Every store CHANNEL writes is sealed with a key that never leaves this phone's secure hardware. A copied file, a disk image or a stolen backup yields nothing without it.
Nothing else. No analytics, no crash reports, no usage beacons, and Help contacts nobody unless you press Get It.
The whole of Help is inside the app and works with nothing connected, for ever. When newer pages exist, a line at the top of Help says Updated help is available and offers Get It.
Knowing that costs nothing: the app learns it from a poll it already makes for your mail, so there is no extra connection and no new pattern for anybody to watch. Help does not check on launch or on a timer, because a request on a schedule would report when you open the app whether or not anyone was counting.
Nothing is downloaded until you press the button, and the sheet says plainly what pressing it does. It contacts our public website, channelmessenger.net, and that server sees your address. Nothing else is sent, and Help works without it. If that matters where you are, do it on a network that is not your own.
Our server never says where the pages are, only that there are newer ones, and the app writes them only once every page is in hand, so a download that stops halfway leaves the Help you have as it was.
Settings › AI takes My own server as a provider: a machine you run, usually reached over a private network of your own. Nothing about it reaches us. We are never told the address, the request never touches our server, and the words go to your machine and stop there. See Settings.
If you turn on Chat as a Contact for an AI account, that contact is a thread with your own provider account and nothing else. It is told, in its instructions, that it can see only this conversation, that it has no memory of your other sessions, no access to your contacts, your location or your phone, that it cannot send a message or take any action, and that it must never ask you for a password, a key or a code. Nothing else on this phone is ever sent to it. Only you can write to it, and it can reach nobody.
Requests are counted per account, so you can see what an account has been used for.
English is the reference text; any translation is a convenience. Help is stored on this phone and never contacts anyone.