What we built instead

The five ways a message travels

CHANNEL takes the most direct path that works right now, and it tries them in this order. Each path has a letter, and the letter on a message tells you which one carried it.

• B
  BluetoothBoth phones nearby.
• W
  Direct Wi-FiBoth phones nearby. No network of any kind is involved.
• L
  Local networkBoth phones on the same Wi-Fi. The message stays on that network.
• 6
  Direct over the internetBoth phones have an IPv6 internet address, so CHANNEL connects them straight to each other, with no server in between. The networks in between can see that the two addresses are talking. Switching the mailbox off for a profile switches this off too.
• I
  Internet mailboxOur server holds the sealed message until the other phone collects it. You can switch this one off for a profile.

The first three never leave the room, and 6 never touches our server. The mailbox is a fallback, not a copy: if another path can reach the other phone, the message goes that way and the server never sees it. If a radio can see them but the message is not getting through, each contact has its own waiting time before CHANNEL uses the mailbox instead, from at once to never; a new contact starts at once. Email is a sixth path: off until you turn it on for a contact, tried after all the others, and for text only. The mail services on the way can see who wrote to whom.

Beside each contact, small lights show which paths are open at this moment. A contact shows Waiting when nothing can carry a message to them yet. CHANNEL never tells you that somebody is not on CHANNEL, because it does not know that, and neither should anyone watching.

In range: no server, no internet, no bill

When you and a contact are within Bluetooth or Wi-Fi range, your message goes straight from your device to theirs. No server sees it, no network carries it, and there is nothing to intercept in transit because nothing is in transit anywhere else. It can work with no signal and no data plan at all — a basement, a flight, a ship, a country where the network is watched — when the phones are close and a direct link holds. In our own tests, Bluetooth between an iPhone and an Android phone delivered 20 of 20 messages in each direction, though results vary by phone model. When a direct link does not hold and there is no internet, the message waits until a path opens. If your phone is in your pocket when a message arrives this way, the app wakes on the connection and creates the notification itself.

It also works where the network is congested rather than absent, which is the case most people actually meet. A cell tower is built for the people who live, work and drive through its patch. It is not built for a whole city's worth of extra people standing in a quarter of a square mile for five hours, most of them sending photographs and video of the same touchdown. Your phone shows four bars and will not send a text — because signal strength and capacity are different things, and the bars only ever showed you the first one. CHANNEL does not queue behind that crowd, because it never asks the tower for anything.

Be realistic about distance, though. This is a radio link between two handsets: your group a few rows apart, the concourse, the tailgate, the next room, the same carriage, a boat, a basement. It will not carry from the club level to the cheap seats, and it does not extend your range beyond direct radio contact. A crowd is the hardest case for a small antenna — bodies absorb these frequencies, which is precisely why the tower is struggling too.

Out of range: a server that knows nothing

Most conversations are not conducted standing next to each other. When direct radio is not available, your message can be queued and, if you allow it, carried by our server over the internet instead.

That server is not a messaging service. It cannot read your messages — they stay end-to-end encrypted the whole way, and it never holds the keys. It holds no accounts, and a phone number or email address you prove is kept as a keyed hash, never as the number or address itself. It identifies your inbox only by a token that changes every ten minutes, and our code keeps no record of the IP addresses that connect to it; Netlify, the company that hosts it, keeps its own request logs, which include them. A message is deleted the moment it is confirmed received, and anything nobody collects expires on its own: thirty days unless you choose a week or a day.

Nothing new to learn

CHANNEL looks and works like the messenger you already use — the same conversation list, the same conversation screen, the same gestures. The privacy is in the plumbing, not in the controls, and it is deliberately identical on every platform so that moving between your phone and your Mac teaches you nothing new.

What is in the app

Everything below is in both apps. The Status page lists every feature.

Profiles

A profile is a separate identity: its own keys, its own contacts, its own conversations. Two profiles on one phone share nothing, and nobody you talk to can tell that two of them are on the same phone. A new profile can start as a copy of an existing one, but only the settings are copied. Keys, contacts, messages and verification never are, because a profile that shared them would not be a separate identity.

Adding someone, in person or by invitation

One of you shows a pairing code and the other types it in, or you send them one through something you already use. The code carries a public key and nothing secret, so it is safe to show in public. When somebody pairs by reading your code off your screen, each phone says so afterwards — they were standing there, and that is the thing being checked. Each contact’s page also shows a Safety Number, eight groups of five digits that are the same on both phones, so the two of you can compare it in person or on a call. Comparing is optional: nothing asks for it, and a conversation works the same whether or not you ever look. You can also simply write to somebody at a number or address they have proved is theirs: the message is sealed and queued, an invitation is left for them, and the moment they accept it goes out with no further tap from you.

Being found

You can let people reach you at a phone number or an email address, but first you have to prove it is yours. A six-digit code is sent to it by text message, by a call that reads the digits aloud twice, or by email. Proving a value and advertising it are two separate switches, so a verified number can stay private, and a value you have not proved is inert. Our server keeps no list of verified people and no list of numbers: an invitation is addressed to a slot derived from the number itself, and it is accepted whether or not anyone will ever collect it, so leaving one tells nobody whether the number belongs to a CHANNEL user. A number you advertise is different: anyone who has it can ask whether it is published, and our server files each slot under a keyed hash, so a copy of its records without that key cannot be tested against numbers, while whoever holds both can test every possible number.

Messages

Disappearing messages on a timer both sides can see, removed from both phones once seen and once the time has run. View once for a picture, shielded from screenshots while it is on screen. Photos, from your phone's own picker or the camera, with a setting that keeps pictures off the Internet entirely. Photos and videos are redrawn before they leave, so the copy carries no location, no time taken and no camera model. Read receipts, both ways or neither. Translation done by the phone's own translator, so the text never leaves the phone to be translated. A clipboard row above the composer. And voice and video calls, sealed between the two phones like everything else, beside buttons that hand a call off to the calling apps you already use.

Writing to somebody who does not use CHANNEL goes from your own phone's Messages app, from your own number. A text is not end-to-end encrypted, and it never passes through our server.

Location

Send one fix, taken at the moment you tap and never kept, or share live for 15 minutes, an hour or 12 hours, updating while the app is open and ending by itself. Between two CHANNEL phones the message carries coordinates rather than a link, so the person receiving it chooses how to see it. A share arrives as one card that moves in place instead of filling the thread with new lines. Tapping it opens a map inside CHANNEL with both phones on it, the distance and an arrow pointing at the other phone, and from there you can hand off to any map app installed on your phone. While a share is running a pin sits at the top of the thread, and the person doing the sharing gets a countdown they can extend or stop. CHANNEL does not read your location at any other time.

The lock, and the distress code

App Lock is a code of your own, at least six characters, asked before anything else, and it works even on a phone with no lock at all. No face or fingerprint opens CHANNEL. The code is never stored: where the phone's security chip can check it, the chip does, and otherwise only a slow one-way calculation of it is kept, so nobody can reset it, ourselves included. A second, different code wipes everything CHANNEL holds on the phone: the key that seals the stores first, then identities, then every file. The app then opens as if freshly installed, and nothing on screen says it happened. Conversations and contacts are sealed on disk under a key that stays on the phone; on Android, so are pictures, videos and files. On iPhone those are under iOS's own file encryption, and sealed under CHANNEL's key as well while Secure Mode is on.

AI

Where the AI runs depends on the phone. On an iPhone or a Mac that supports Apple Intelligence, or an Android phone that supports Gemini Nano, it runs on the phone itself — no account, no key, no cost, and nothing leaves. Everywhere else, and as the fallback on a phone, you add your own account with OpenAI, Anthropic or xAI: the key stays on your phone, our server never sees it, and you can add more than one. Summaries, suggested replies and translations are sent only when you ask: no background calls, no automatic summaries. Each one shows you exactly what will leave the phone, including the other person's words when you choose to include them, and the button you press is the consent. Automatic replies is the exception: switched on for a profile, it answers incoming one-to-one messages itself, and its answers go out without you seeing them first. It can write or rework a draft, fix spelling and grammar, make a message shorter, friendlier or more formal, suggest replies, summarize a thread, translate one message, or answer a question about a picture. You can also switch an account on as a contact, so ChatGPT, Claude or Grok appears in your contact list and you message it like anyone else.

Backup and restore

Off unless you use it, and never silent. CHANNEL seals your profiles, identities, contacts, conversations and settings into one file under a passphrase you choose, and hands it to your phone's own file picker, so you decide where it goes. We never hold the passphrase and cannot recover it, and we never receive the file. Disappearing and view-once messages are never included, and attachments are left out for size. Restoring replaces everything on the phone, and it is how you move to a new one.

Carrying for other people

Settings has a Relay for Others switch, off unless you turn it on. With it on, this phone offers to carry sealed mail for contacts another phone cannot reach yet, and to hand it on later; a carrying phone cannot read what it carries. We are not going to oversell this one. Carrying only pays off when there are enough phones running CHANNEL in one place, and that has not been measured on real hardware at real density. It is in the product and in the protocol. It is not a promise.

Help, inside the app

Plain help pages ship inside CHANNEL, in the same five languages as the app. They work with no network, they contact nobody, and nothing you read in them is reported to anyone.