Alerts for a wedding or a party

What this actually looks like

The ceremony has moved indoors, the coach leaves from the other car park, the second sitting is at eight. A sealed channel for the day reaches every guest who scanned the code on the invitation, and does it without collecting a single phone number.

How you would set it up

1. Create a private channel and print its invite QR code on the invitation and the order of service.
2. Schedule the timings in advance and send only the changes on the day.
3. Attach the map or the seating plan as a picture. It is easier to find at the door than a link is.

Private means sealed, not merely unlisted

A private channel is not one that is simply missing from a directory. It requires an invite code both to subscribe AND to read anything about it, and a request without one gets exactly the same “not found” as a handle that never existed — because a different answer would let anybody confirm that a school’s or an ops team’s channel exists by guessing its name. Invite codes can carry a use limit and can be revoked; revoking is a timestamp and by default removes nobody who already joined.

A picture, a sound or a document, when words are not enough

A diverted bus route is a map. A boil-water notice is a paragraph of instructions people will re-read. An alert can carry an image, a sound file or a document alongside the text. Documents are stored exactly as written and re-rendered from a sanitised copy rather than being run as markup, so an attachment cannot turn into a script on somebody’s lock screen. The bytes are uploaded once and attached by reference, which keeps a send cheap however large the audience.

Draft, schedule, send — and what cancelling cannot undo

Composing and sending are deliberately different permissions, so the person or script that writes an alert can be forbidden from publishing it. A scheduled alert becomes visible at its time without anything having to run at that minute, which means a server that was briefly down delivers late rather than never. Cancelling is honest about its limits: it stops an alert reaching phones that have not fetched it yet and does nothing at all to the phones that already have it. An alert cannot be unsent.