On Friday afternoon, X officially launched XChat, the company’s proprietary chat app. Unlike other chat app options, like WhatsApp, Telegram, or Signal, you need an X account to use XChat, which limits the user base to one specific social media platform. X users with a large enough social circle on the platform may find this new app to be useful, but XChat does come with some security contradictions that all new users should be aware of.
XChat is a standard chat app for X users
XChat’s biggest sell, apart from being a place for X users to communicate, is that it is end-to-end encrypted. As the app reminds you upon setup, this encryption means there is no way for anyone—including X—to read the contents of your messages. Only the sender and receiver (or receivers) of an encrypted message have the ability to open and read it. In fact, XChat has you set up a passcode before proceeding to the actual app.
Once the app boots up, you’ll find all of your X DMs arranged in the same way you’d expect from any standard chat app. However, it doesn’t seem like encryption applies to previous chats: Once you send a new message, you see an alert that reads “This conversation is now end-to-end encrypted.” Like other chat apps, you can send audio recordings, GIFs, files, photos, or take new pictures with the camera. By clicking on the recipient’s profile picture, you can see their profile and shared media, plus customize the chat a bit. You can set a nickname, block screenshots, or turn on disappearing messages so that chats go away after a set period of time.
There’s a decent level of customization available on the app level, too. There are the standard light and dark themes, but you can also choose whether left swiping on a message “likes” it or reveals info, such as when the message was sent, whether it was encrypted, or when the recipient saw it. You can also choose from one of eight different chat app icons, which I always appreciate.
What do you think so far?
XChat isn’t as private as it seems
I’m all for adding end-to-end encryption to X DMs, so there’s some good stuff happening here. But it is a bit concerning that a messaging app advertising itself as a private experience with “no tracking” actually scrapes a number of data points and links them back to your identity. XChat’s App Privacy page shows that the app reserves the right to take your contact info, contacts, identifiers, device diagnostics, and usage data, and links that information to you directly.
That’s a big improvement from what the app was taking when it was first announced, which included things like location, search history, and user content. Maybe X adjusted these after facing pushback, but it rubs me the wrong way that a “private” chat app would still take this much data. If all you care about is end-to-end encryption, however, you can rest assured X isn’t reading your messages
