One to many. Nobody holds the list of who listens.
A channel is a sender, any number of readers, and a link. A community is a group of groups with a roster and rules. The large messengers stand on these two things, and on a list of every reader kept on a server. Avano's channel is served from a relay as sealed, padded posts that readers fetch through blind slots, with a reader counted by nobody and the author's phone never knowing who reads.
Three secrets and a relay. Posts at addresses only the link can derive.
A channel is a read secret, a signing key minted for the channel alone, and a delete secret that never leaves the author, plus the relay the posts live on. Each post has a number, and its address on the relay and the key it is sealed under are both derived from the read secret and the number: a reader who holds the link asks for the next number, and "not found" means nothing new. Nothing on the relay says which addresses belong together, and nothing on it changes shape when a channel is created. The author's signature is inside the seal, so the relay proves nothing to anyone who does not hold the link.
Create, post, follow by link, read forward, edit as a new post, delete for readers who have not fetched; the Follow sheet in both apps.
A reader has no identity on the wire.
A reader presents no token, no key and no slot of her own: a fetch of sixteen bytes, over its own Tor circuit, on its own clock, never on a connection that also carries her contacts. The author cannot be told she exists. A relay can count a post's readers roughly, in memory, at the instant of the fetch, and under Tor it cannot name them; that is the honest version of "counted by nobody", and it is the one the app's own screen says.
A channel carries nothing back to its author. A reader may reply only if the author offers a way: a pairing link in the description, or a group the author names. That absence is what keeps the author's phone free of any reader.
A community is a group of groups, with a roster and rules.
The group machinery under it is the one the messenger has had since the summer: a group with an authoriser, hand-overs of control that are signed link by link, members who compare what they were sent so that no one can be shown a different roster, co-admins, topics, rules, join requests, pinned messages, and a read count that says "by r of k" and names nobody. A community gathers rooms under one roster and one set of rules, thirty-two to a room.
Rooms under one roster and rules, built on the group machinery; measured on two phones for the group half, not yet for a community of several rooms.
A program can post a card. No code of its author's runs on your phone.
A bot, or a channel's author, can send a card: a title, lines, fields and up to eight buttons. The app draws it from text with its own code; the card is data, never executed. A button sends one ordinary message back, from you, or opens the same sheets a pasted link opens, which do nothing until you act. Mini-apps that run their own code are a separate decision, written down and not built. The developers page says how to send one.
What a channel does not hide, said before you rely on it.
A post's size is one of about eighteen rungs, and a relay sees which. A leaked link is a leaked channel, for good: there is no roster to revoke it from, and the sheet that makes a link says so. The author's own relay knows the author posts, as a paying circuit. Nothing here moderates: a relay serves bytes it cannot read, and a report carries one post's address and key so that an operator can open and remove that one post and learn nothing else about the channel.