What we built instead

The four ways a message travels

CHANNEL takes the most direct path that works right now, and it tries them in this order. Each path has a letter, and the letter on a message tells you which one carried it.

• W
  Direct Wi-FiBoth phones nearby. No network of any kind is involved.
• B
  BluetoothBoth phones nearby.
• L
  Local networkBoth phones on the same Wi-Fi. The message stays on that network.
• I
  Internet mailboxOur server holds the sealed message until the other phone collects it. You can switch this one off for a profile.

The first three never leave the room. The Internet is a fallback, not a copy: if a radio can reach the other phone, the message goes that way and the server never sees it. If a radio can see them but the message is not getting through, each contact has its own waiting time before CHANNEL uses the mailbox instead, from at once to never, with fifteen minutes as the default.

Beside each contact, small lights show which paths are open at this moment. A contact shows Waiting when nothing can carry a message to them yet. CHANNEL never tells you that somebody is not on CHANNEL, because it does not know that, and neither should anyone watching.

In range: no server, no internet, no bill

When you and a contact are within Bluetooth or Wi-Fi range, your message goes straight from your device to theirs. No server sees it, no network carries it, and there is nothing to intercept in transit because nothing is in transit anywhere else. It works with no signal and no data plan at all — a basement, a flight, a ship, a hospital, a country where the network is watched. If your phone is in your pocket when a message arrives this way, the app wakes on the connection and creates the notification itself.

It also works where the network is congested rather than absent, which is the case most people actually meet. A cell tower is built for the people who live, work and drive through its patch. It is not built for a whole city's worth of extra people standing in a quarter of a square mile for five hours, most of them sending photographs and video of the same touchdown. Your phone shows four bars and will not send a text — because signal strength and capacity are different things, and the bars only ever showed you the first one. CHANNEL does not queue behind that crowd, because it never asks the tower for anything.

Be realistic about distance, though. This is a radio link between two handsets: your group a few rows apart, the concourse, the tailgate, the next room, the same carriage, a boat, a basement. It will not carry from the club level to the cheap seats, and it does not extend your range beyond direct radio contact. A crowd is the hardest case for a small antenna — bodies absorb these frequencies, which is precisely why the tower is struggling too.

Out of range: a server that knows nothing

Most conversations are not conducted standing next to each other. When direct radio is not available, your message can be queued and, if you allow it, carried by our server over the internet instead.

That server is not a chat service. It cannot read your messages — they stay end-to-end encrypted the whole way, and it never holds the keys. It holds no accounts, and a phone number or email address you prove is kept as a keyed hash, never as the number or address itself. It identifies your inbox only by a token that changes every ten minutes, and it is configured not to log the IP addresses that connect to it. A message is deleted the moment it is confirmed received, and anything nobody collects expires on its own: seven days by default, thirty at the outside, and you can set it shorter.

Nothing new to learn

CHANNEL looks and works like the messenger you already use — the same conversation list, the same chat screen, the same gestures. The privacy is in the plumbing, not in the controls, and it is deliberately identical on every platform so that moving between your phone and your computer teaches you nothing new.

What is in the app

Everything below is in the current test builds. The Status page says which parts have been exercised on real phones and which have not.

Profiles

A profile is a separate identity: its own keys, its own contacts, its own conversations. Two profiles on one phone share nothing, and nobody you talk to can tell that two of them are on the same phone. A new profile can start as a copy of an existing one, but only the settings are copied. Keys, contacts, messages and verification never are, because a profile that shared them would not be a separate identity.

Adding someone, in person or by invitation

One of you shows a pairing code and the other types it in, or you send them one through something you already use. The code carries a public key and nothing secret, so it is safe to show in public. When somebody pairs by reading your code off your screen, each phone says so afterwards — they were standing there, and that is the thing being checked. You can also simply write to somebody at a number or address they have proved is theirs: the message is sealed and queued, an invitation is left for them, and the moment they accept it goes out with no further tap from you.

Being found

You can let people reach you at a phone number or an email address, but first you have to prove it is yours. A six-digit code is sent to it by text message, by a call that reads the digits aloud twice, or by email. Proving a value and advertising it are two separate switches, so a verified number can stay private, and a value you have not proved is inert. Our server keeps no list of verified people and no list of numbers: an invitation is addressed to a slot derived from the number itself, and it is accepted whether or not anyone will ever collect it, so the server cannot answer the question of whether a given number belongs to a CHANNEL user.

Messages

Disappearing messages on a timer both sides can see, removed from both phones once seen and once the time has run. View once for a picture, shielded from screenshots while it is on screen. Photos, from your phone's own picker or the camera, with a setting that keeps pictures off the Internet entirely. Read receipts, both ways or neither. Translation done by the phone's own translator, so the text never leaves the phone to be translated. A clipboard row above the composer. And voice and video calls, sealed between the two phones like everything else, beside buttons that hand a call off to the calling apps you already use.

Location

Send one fix, taken at the moment you tap and never kept, or share live for 15 minutes, an hour or 8 hours, updating while the app is open and ending by itself. There is also a share with no end time, which runs until you stop it. Between two CHANNEL phones the message carries coordinates rather than a link, so the person receiving it chooses how to see it. A share arrives as one card that moves in place instead of filling the thread with new lines. Tapping it opens a map inside CHANNEL with both phones on it, the distance and an arrow pointing at the other phone, and from there you can hand off to any map app installed on your phone. While a share is running a pin sits at the top of the thread, and the person doing the sharing gets a countdown they can extend or stop. CHANNEL does not read your location at any other time.

The lock, and the distress code

CHANNEL can ask for your phone's own unlock to open it, and you can add a code of your own, 4 to 8 digits, which is asked before anything else and works even on a phone with no lock at all. Neither code is stored, only a slow hash of it, so nobody can reset one, ourselves included. A second, different code wipes everything CHANNEL holds on the phone: the key that seals the stores first, then identities, then every file. The app then opens as if freshly installed, and nothing on screen says it happened. Everything CHANNEL writes to disk is encrypted under a key held in the phone's secure hardware, so a copied file or a stolen device backup yields nothing without it.

AI

Where the AI runs depends on the phone. On an iPhone that supports Apple Intelligence it runs on the phone itself — no account, no key, no cost, and nothing leaves. Everywhere else, and as the fallback on an iPhone, you add your own account with OpenAI, Anthropic or xAI: the key stays on your phone, our server never sees it, and you can add more than one. Nothing is ever sent on its own: no background calls, no automatic summaries, no suggested replies you did not ask for. Every use shows you exactly what will leave the phone, including the other person's words when you choose to include them, and the button you press is the consent. It can write or rework a draft, fix spelling and grammar, make a message shorter, friendlier or more formal, suggest replies, summarise a thread, translate one message, or answer a question about a picture. You can also switch an account on as a contact, so ChatGPT, Claude or Grok appears in your contact list and you chat with it like anyone else.

Backup and restore

Off unless you use it, and never silent. CHANNEL seals your profiles, identities, contacts, conversations and settings into one file under a passphrase you choose, and hands it to your phone's own file picker, so you decide where it goes. We never hold the passphrase and cannot recover it, and we never receive the file. Disappearing and view-once messages are never included, and attachments are left out for size. Restoring replaces everything on the phone, and it is how you move to a new one.

Carrying for other people

Settings has a Relay for Others switch, off unless you turn it on. With it on, this phone offers to carry sealed mail for contacts another phone cannot reach yet, and to hand it on later; a carrying phone cannot read what it carries. We are not going to oversell this one. Carrying only pays off when there are enough phones running CHANNEL in one place, and that has not been measured on real hardware at real density. It is in the product and in the protocol. It is not a promise.

Help, inside the app

Plain help pages ship inside CHANNEL, in the same five languages as the app. They work with no network, they contact nobody, and nothing you read in them is reported to anyone.