Elon Musk’s XChat is hoping to take on WhatsApp and Signal with its own end-to-end encrypted app on iOS and Android. The XChat iOS app is earmarked for launch on April 27, allowing you to use the X direct message service as long as you have an account. A release date for Android has not been set.

If you use X, you might want to try out XChat to conveniently speak to your contacts. But is the XChat app safe from a privacy and security point of view?

Some experts say no. Security researcher Tommy Mysk posted Apple’s iOS privacy label on X, detailing the information XChat collects. “No ads. No tracking. Fully end-to-end encrypted. But it collects all this data,” he wrote.

I have contacted X for a comment and will update this article if the firm responds.

What Data Does XChat Collect And How Does It Impact Privacy?

XChat requires an existing X account, so your identity, device information, IP and behavioral history on the parent platform “are already part of the graph before you send your first message,” says Varun Badhwar, CEO and founder of Endor Labs.

Two concerns stand out, Badhwar says. “Keys live on X’s servers. X stores users' private encryption keys on its own infrastructure, protected by a four-digit PIN. X has itself acknowledged that this architecture could allow ‘a malicious insider or X itself’ to access conversations. That's a remarkable admission — and it means the end-to-end encryption claim depends on X's policies, not on math.”

At the same time, image metadata is not stripped. Reports indicate that images sent through XChat retain GPS coordinates and camera details, points out Badhwar. “So even when message content is encrypted, a shared photo can leak your location and device fingerprint,” he warns.

Although XChat encrypts the content of messages, its App Privacy Notice reveals........

© Forbes