What CHANNEL keeps, and what it never has.

What CHANNEL does instead

• No contact upload, ever. The app can show you your own address book so you can pick a name; that list never leaves your phone.
• No analytics about you, no crash reporter, no advertising identifier, no advertising or tracking SDK. A Mac where you let an AI use a profile sends one daily count of that AI’s calls, linked to nobody.
• No copy of a sealed one-to-one message on our server once it is collected. A formal group's posts are kept, encrypted, for 30 days, or for a year once a member reports the group.
• When your contact is in range, no internet connection needed when a direct link holds — so no bill, no roaming, and nothing to intercept upstream.

Who can see what

Our mailbox server

It sees that a sealed envelope arrived at a mailbox address, when, and roughly how large it is, rounded up into one of a few fixed sizes. The address is a pseudonym: it belongs to one conversation, changes every ten minutes, and carries no name, phone number or account. So the server can tell that one address receives mail and roughly when, but nothing in it says whose address it is, what a message says, or who sent it, because the sender’s identity is inside the sealed part. Our code keeps no record of the IP addresses of devices that connect to it; Netlify, the company that hosts the server, keeps its own request logs, which include them. The one exception is a rate limiter, which keeps a keyed hash of the caller’s network block for up to two hours to slow down abuse, then deletes it.

Writing to someone you have not paired with

When you write to a number, address or handle somebody has published, your phone fetches their public keys from our server, so the first message can be sealed while their phone is switched off. This is the one place our server sits between two people who have not met: a server that chose to misbehave could hand out keys of its own and read that first exchange, and nothing on the screen would show it. Pairing with a code you read off the other person’s screen does not have this limit, because the code carries the key. For a person you reached through a published value, the Safety Number on their contact page is the check: compare it in person or on a call, and a substituted key shows as a different number. Comparing is optional, and nothing in CHANNEL asks for it.

Someone watching your network

An observer on your network can see that this phone talks to CHANNEL. They cannot read what you say or see who your messages are for. A call that goes directly between two phones shows each phone's network address to the other, and to anyone watching either network; with Internet Only on (Settings › Calls), it does not.

If a phone is taken

What is on a phone is what is readable on it. App Lock, under Settings, is an App PIN of at least six characters; no face, fingerprint or phone passcode opens CHANNEL. Where this phone's security chip passes a test CHANNEL runs when the PIN is set, the chip checks the PIN and a copy of the phone's storage cannot be used to guess it; otherwise a slow one-way calculation of the PIN is kept, and a copy can be guessed against. The Distress Code, set alongside it, opens the app and erases everything CHANNEL holds on that phone at the same moment, with no second step to confirm. It is for someone with no legal authority to demand your PIN; where the law requires you to unlock, using it can itself be an offence. Privacy on this device has the detail, including how long guessing a PIN takes.

The Double Ratchet

The core both apps share is an independently developed cryptographic core implementing a Double Ratchet design based on Signal’s published specification, with CHANNEL-specific session establishment, recovery and post-quantum extensions. The ratchet is the part of the design that changes the message key as you go. It has been tested with the test suites and fuzzing described below and reviewed by outside AI models, which the last item under How we check our work names. Its limits, including what a holder of the pairing key can read, are on the encryption page.

Post-quantum key agreement

Between two phones that both carry it, a conversation starts from a secret made by X25519 and ML-KEM-768 (FIPS 203) together, so somebody who records the traffic today and gets a quantum computer later has to break both. After that, each step of the message ratchet adds a fresh X25519 secret, and once in each ratchet session the phones also mix in a fresh ML-KEM-768 secret. Signatures stay Ed25519. More detail is on the encryption page.

An AI reading other people's words

Summarize, Suggest Replies and Translate can send another person's words to an AI on your own account. Before they go, CHANNEL removes characters a person cannot see but a model can read, and marks the words as quoted text the AI must never obey. That makes it much harder for a message to steer what the AI tells you, though not impossible, and the answer to Summarize, Suggest Replies or Translate is shown to you first, never sent by itself. Automatic replies, switched on for a profile, is the exception: it sends its answers without showing them first.

How we check our work

Privacy on this device has the same list with every number.

• The wire format is written down first, and the shared core must reproduce 55 files of test vectors generated from that description every time its tests run.
• One Rust core holds the cryptography and the wire format for both apps, so the sealing itself is the same code on iPhone and Android.
• A test or check whose failure would go unnoticed is broken on purpose, to see it fail, before it is trusted.
• Every decoder in the core that reads data from another phone, 137 of them, is fuzzed by one of 39 targets. The runs found 2 real bugs, both fixed and kept as tests.
• More than 300 automatic checks run before a release, looking for the mistakes that break no build and fail no test.
• Before an Android release, a build optimised exactly as the store copy is gets installed and started on a test device, and the full on-device test suite is run.
• 39 screens are described once, and a test on each app checks that both draw them the same way.
• Security-critical changes are reviewed adversarially by AI models from other companies, given the real files, and every finding is checked against the code before anything changes; some are rejected. On 15 October 2026 the shared core, its protocol and its tests were reviewed this way by Grok (the reviewer calls itself Grok Bot (SpaceXAI) and gives no version), by Gemini (it names itself Gemini 2.5 Flash, on a free tier) and by Kimi (from Moonshot AI; version not given). A model’s name for itself is its own claim, not something we measured. They read the core, not the code of the two apps.

Read how it is done

• How encryption is usedThe keys, the ciphers, and what each one protects.
• Privacy policyWhat the app and our server store, in full.
• Threat walkthroughWho could attack CHANNEL, how, and what each attempt would get them.
• Network metadataWhat a network operator can see, and what it cannot.
• The wire protocolEvery byte a message carries, published for anyone to check.
• Data safetyThe answers given to Apple and Google about the data the app handles.

Read the documentation

The design notes, the wire protocol, the threat walkthrough, the privacy documents, and the help pages exactly as they ship in the app are all published at channelmessenger.net/docs. Publishing it costs us nothing: a design that depended on the secrecy of its own description was already broken. We would rather be checked than believed.