diff --git a/docs/NOTIFICATIONS.md b/docs/NOTIFICATIONS.md
index 3561232..e35f9b4 100644
--- a/docs/NOTIFICATIONS.md
+++ b/docs/NOTIFICATIONS.md
@@ -32,15 +32,16 @@ base_url: https://hbd.example.com
 
 ### Channel definitions
 
-Channels are defined under `notification_channels`. Each entry specifies a delivery type and its credentials. Two optional metadata fields control visibility:
+Channels are defined under `notification_channels`. Each entry specifies a delivery type and its credentials. Ownership is the single visibility signal:
 
 | Field | Default | Description |
 |---|---|---|
-| `owner` | *(absent)* | Username who created/owns this channel. Absent = admin-created. |
-| `private` | `false` | When `true`, only the owner can see and select this channel. |
+| `owner` | *(absent)* | Owning username. Present = private to that user; absent = global. |
 | `min_level` | `WARNING` | Minimum alert level this channel receives. |
 
-**Admin-created channels** (set in the config file or via the admin settings UI) are public by default — all users can select them:
+(The former `private` flag is retired; leftover `private` keys are ignored and dropped on the next edit.)
+
+**Global channels** (no `owner`; set in the config file or by an admin) can be selected by all users but edited only by admins:
 
 ```yaml
 notification_channels:
@@ -90,7 +91,7 @@ notification_channels:
     username: heartbeat-bot
 ```
 
-**User-created channels** are written by authenticated users through the API or their profile page. They carry an `owner` field and optionally `private: true`:
+**User-created channels** are written by authenticated users through the API, their profile page, or the settings page. They carry an `owner` field and are private to that user:
 
 ```yaml
 notification_channels:
@@ -99,17 +100,18 @@ notification_channels:
     type: pushover
     token: personal-token
     user: personal-key
-    owner: alice          # created by alice
-    private: true         # only alice can see this channel
+    owner: alice          # private to alice
 ```
 
 ### Channel visibility
 
-| Channel | Who can see / select it |
-|---|---|
-| No `private` field (or `private: false`) | All users |
-| `private: true` | Only the `owner` |
-| Any channel | Admins always see everything |
+| Channel | Who can see / select it | Who can edit it |
+|---|---|---|
+| No `owner` (global) | All users | Admins |
+| `owner` set (private) | Only the `owner` | The owner |
+| Any channel | Admins always see everything | Admins |
+
+Admins can **promote** a private channel to global by clearing its owner on the settings page, or **demote** a global channel by assigning an owner.
 
 ### Users with notification channels
 
@@ -299,7 +301,7 @@ Called once at startup from `main.py`. Pass the running asyncio event loop so Ma
 - Check that the host has an `owner` or `managers` set
 - Check that users have `notification_channels` listed
 - Check that the channel names in user config match keys under `notification_channels:`
-- If a user can't select a channel, check whether it is `private: true` and owned by someone else
+- If a user can't select a channel, check whether it has an `owner` other than that user
 
 **min_level filtering too aggressive:**
 - Default is `WARNING` — both WARNING and CRITICAL are sent
diff --git a/docs/USERS.md b/docs/USERS.md
index 777caa0..a9737e5 100644
--- a/docs/USERS.md
+++ b/docs/USERS.md
@@ -19,6 +19,15 @@ Users are defined in the server config file. Each host can have an **owner**, ze
 
 `admin` is a flag on the user, not a per-host role. An admin user has owner-level access on every host without being listed as owner/manager/monitor.
 
+### Settings page access
+
+All authenticated users may open `/settings`. Admins see every section; non-admins see only **Notification Channels**, **Hosts**, and **Threshold Configurations**, filtered to global items plus what they own or manage:
+
+- **Owners** may add hosts, delete their hosts, edit host settings, and change access lists (managers/monitors, ownership transfer).
+- **Managers** may edit host settings (watch, dyndns, channel and threshold assignments) but not access lists, and may not delete hosts.
+- Anyone may create private notification channels and threshold configs (owned by them) and assign them — or global ones — to their hosts.
+- Admins promote a private channel/threshold config to global by clearing its owner, or demote by assigning one.
+
 ---
 
 ## Configuration
@@ -200,7 +209,7 @@ Update the current user's profile. All fields are optional — send only what yo
 ```json
 { "notification_channels": ["pushover_ops", "email_ops"] }
 ```
-Only channels visible to the user (public + own private) are accepted; others are silently dropped.
+Only channels visible to the user (global + own) are accepted; others are silently dropped.
 
 **Change password:**
 ```json