\n<\/p>\n
If you\u00a0use X, you might want to try out XChat to conveniently speak to your contacts. But is the XChat app safe from a privacy and security point of view?<\/span><\/p>\n Getty Images<\/small><\/div>\n<\/div>\n<\/figure>\n Elon Musk\u2019s XChat is hoping to take on WhatsApp and Signal with its own end-to-end encrypted app on iOS and Android. The XChat iOS app<\/a> is earmarked for launch on April 27, allowing you to use the X direct message service as long as you have an account. A release date for Android has not been set.<\/p>\n If you use X, you might want to try out XChat to conveniently speak to your contacts. But is the XChat app safe from a privacy and security point of view?<\/p>\n Some experts say no. Security researcher Tommy Mysk posted Apple\u2019s iOS privacy label on X, detailing the information XChat collects. \u201cNo ads. No tracking. Fully end-to-end encrypted. But it collects all this data,\u201d he wrote<\/a>.<\/p>\n I have contacted X for a comment and will update this article if the firm responds.<\/p>\n If you\u00a0use X, you might want to try out XChat to conveniently speak to your contacts. But is the XChat app safe from a privacy and security point of view?<\/span><\/p>\n Getty Images<\/small><\/div>\n<\/div>\n<\/figure>\n XChat requires an existing X account, so your identity, device information, IP and behavioral history on the parent platform \u201care already part of the graph before you send your first message,\u201d says Varun Badhwar, CEO and founder of Endor Labs.<\/p>\n Two concerns stand out, Badhwar says. \u201cKeys live on X\u2019s servers. X stores users’ private encryption keys on its own infrastructure, protected by a four-digit PIN. X has itself acknowledged that this architecture could allow \u2018a malicious insider or X itself\u2019 to access conversations. That’s a remarkable admission \u2014 and it means the end-to-end encryption claim depends on X’s policies, not on math.\u201d<\/p>\n At the same time, image metadata is not stripped. Reports indicate that images sent through XChat retain GPS coordinates and camera details, points out Badhwar. \u201cSo even when message content is encrypted, a shared photo can leak your location and device fingerprint,\u201d he warns.<\/p>\n Although XChat encrypts the content of messages, its App Privacy Notice reveals that it collects \u201cseveral types of data\u201d \u2014 including metadata and usage activity, says Luke Dixon, a partner at Freeths who specializes in IT and data law. <\/p>\n This has implications for user privacy, Dixon warns. \u201cFor example, metadata reveals who you are communicating with, when, and for how long. Usage activity includes product interaction records, search history, and information that reveals how you use the app.\u201d<\/p>\n In the U.S., there is no federal privacy baseline. The California Consumer Privacy Act gives users there some rights, but there\u2019s nothing comparable to the U.K.\u2019s General Data Protection Regulation forcing X to disclose third-party recipients or processing purposes.<\/p>\n In the U.K. and European Union, XChat will face a very different regulatory environment. GDPR requires disclosure of lawful basis, retention periods and third-party sharing, says Badhwar.<\/p>\n But X has already collided with European regulators \u2014 Ireland\u2019s Data Protection Commission investigated X\u2019s use of user data to train Grok, and X agreed to suspend processing of EU\/European Economic Area user data on a permanent basis. <\/p>\n XChat shares account, usage and device data with third parties, including service providers, partners \u201cand potentially advertisers,\u201d says Neil Thacker, global privacy and data protection officer at Netskope. <\/p>\n \u201cThis can include contact details, activity data, and communication metadata,” Thacker explains. “Data may also be disclosed to authorities where legally required. Once data is shared, users have limited visibility and control over how it is used, increasing the risk of profiling, tracking and misuse.\u201d<\/p>\n Metadata \u2014 who talked to whom, when, how often, from where \u2014 is not encrypted on any mainstream messaging platform, including XChat, says Badhwar. And X\u2019s broader privacy policy already allows sharing user data with third-party “collaborators” unless users opt out, with those recipients free to use it for their own purposes, including training AI models, says Badhwar. \u201cThis matters because XChat lives inside the same corporate envelope as Grok<\/a>.\u201d<\/p>\n You can boost privacy in XChat, but \u201cwithin real limits,\u201d says Badhwar. He recommends practical steps such as stripping metadata from photos before sending or using a privacy-focused camera app or a metadata scrubber.<\/p>\n Another tip is to turn on disappearing messages via XChat\u2019s five-minute vanish feature.<\/p>\n Don\u2019t let your X account be your identity anchor for sensitive conversation, adds Badhwar. \u201cIf your X account is compromised, your XChat is compromised.\u201d<\/p>\n XChat gives users the ability to toggle on encryption within DMs by selecting the padlock icon, which indicates end-to-end encrypted communication. They can also access, correct or modify the information provided to it by editing their profile and adjusting their account settings, Dixon adds.<\/p>\n Users have some control via their settings, but X provides certain third parties with information to run its products and services, Dixon warns. \u201cIt may also share information with third parties that perform functions and provide services on its behalf, including those that help X understand the use of its services.\u201d<\/p>\n The app also includes a mechanism to block screenshots or alert users if a screenshot is attempted, according to Dixon.<\/p>\n For anyone using XChat, the practical guidance is \u201cthe same that applies to every messaging app,\u201d says Adam Boynton, senior enterprise strategy manager at Jamf. \u201cKeep your operating system current, be deliberate about which devices you link to your account, and remember that metadata tells a story even when message contents are encrypted.\u201d<\/p>\n XChat offers similar privacy guarantees to WhatsApp, says Thacker. \u201cWhatsApp uses end-to-end encryption but still collects metadata and shares some data within its wider ecosystem.\u201d<\/p>\n But it has one advantage over WhatsApp in that it does not require the user\u2019s phone number, says Dixon. \u201cHowever, as you would expect from such an established service, WhatsApp is a more mature platform with a huge level of user adoption. XChat has a lot of catching up to do in that regard.\u201d<\/p>\n Signal is the gold standard because \u201cthe math is public, the keys live on your phone, and the company couldn’t read your messages even if subpoenaed,\u201d says Badhwar. \u201cXChat doesn’t clear any of those three bars. WhatsApp has the Signal protocol but lives inside Meta’s ad ecosystem. Signal has the Signal protocol and doesn’t. XChat has neither.\u201d<\/p>\n For anything you\u2019d be embarrassed, endangered or exposed by if leaked \u2014 don’t use XChat. \u201cUse Signal,\u201d says Badhwar. \u201cThe best privacy setting in XChat is the decision to use a different app for sensitive conversations.\u201d<\/p>\n So the all-important question is: Should you use XChat when the app launches? For casual conversation with friends you already follow on X? \u201cIt\u2019s fine \u2014 probably no worse than SMS, and meaningfully better for group chats and media,\u201d says Badhwar.<\/p>\n For anything involving your business, your health, your family\u2019s safety or your legal exposure? \u201cAbsolutely not \u2014 not in v1, and not until the code is open-source and independently audited,\u201d says Badhwar.<\/p>\n XChat is coming, but the consensus is, the app isn\u2019t as safe as WhatsApp or Signal. Therefore, feel free to use XChat for chats you wouldn\u2019t care about becoming public. Otherwise, use Signal instead.<\/p>\n<\/div>\nWhat Data Does XChat Collect And How Does It Impact Privacy?<\/h2>\n
What XChat Data Is Shared And With Whom?<\/h2>\n
Can You Increase Your Privacy on XChat?<\/h2>\n
How Does XChat Compare To WhatsApp And Signal?<\/h2>\n
Should You Use XChat?<\/h2>\n