Alerts for a group trip

What this actually looks like

Thirty people, four hotels and a coach that leaves at seven. A sealed channel for the trip carries the change of meeting point, the ferry that is late and tomorrow’s itinerary as a picture — to everybody at once, in one message.

How you would set it up

1. Create a private channel for the trip and put its invite QR code on the welcome sheet.
2. Attach the day’s itinerary or the map as an image, so it still works when the signal does not.
3. Archive the channel when the trip ends. It has done its job.

Private means sealed, not merely unlisted

A private channel is not one that is simply missing from a directory. It requires an invite code both to subscribe AND to read anything about it, and a request without one gets exactly the same “not found” as a handle that never existed — because a different answer would let anybody confirm that a school’s or an ops team’s channel exists by guessing its name. Invite codes can carry a use limit and can be revoked; revoking is a timestamp and by default removes nobody who already joined.

A picture, a sound or a document, when words are not enough

A diverted bus route is a map. A boil-water notice is a paragraph of instructions people will re-read. An alert can carry an image, a sound file or a document alongside the text. Documents are stored exactly as written and re-rendered from a sanitised copy rather than being run as markup, so an attachment cannot turn into a script on somebody’s lock screen. The bytes are uploaded once and attached by reference, which keeps a send cheap however large the audience.

Draw a circle without knowing who is inside it

You place a centre and a radius on a map, and the circle travels attached to the alert. Every subscriber’s phone receives it and compares its own position locally, then decides whether to show it. No subscriber position is ever sent to us, which is why this is a design fact rather than a promise: there is no column anywhere that could hold one. Two consequences follow deliberately. A geofence only ever narrows — it cannot add somebody who did not subscribe. And it fails open: a phone that cannot work out where it is shows the alert rather than hiding it, because missing an evacuation is worse than seeing one meant for the next street.