No marketing. This page tells you exactly how your data is handled, in plain language, including the parts that aren't private. If a page like this isn't honest about its limits, don't trust it.
Last reviewed: July 2026
Don't take this page's word for it either. Every claim below now has a live, checkable counterpart: the source code that implements it, its SHA-256, and tests you can run in your own browser and on your own machine — plus the list of things we refuse to claim.
Two promises we keep in code, not just words:
| What | Status | What that actually means |
|---|---|---|
| Direct messages (end-to-end mode) | 🔒 Private | Encrypted on your device, decrypted only on theirs (ECDH P-256 + AES-GCM). XSCN cannot read these. Default whenever both people have set up encryption. |
| Direct messages (readable mode) | 🔓 Visible to us | A mode you can switch on so the AI assistant can help. Encrypted in transit and at rest, but XSCN can read it. Clearly labeled in the chat every time. |
| Your password / PIN | 🔒 Hashed | Stored only as a bcrypt hash. We never see or store the plaintext and cannot recover it for you. |
| Your private encryption key | 🔒 Wrapped | Locked with a key derived from your PIN before it ever reaches us. We store a blob we can't open. Forget your PIN and those encrypted messages are gone — even to us. |
| Sensitive fields at rest (e.g. message bodies, some records) | ⚠️ Encrypted, but with our key | Field-level AES-256-GCM stops casual database theft. It is not zero-knowledge — a server operator with the key can read it. This is why end-to-end mode exists for things that must stay private. |
| Connection to the site | 🔒 HTTPS | All traffic to xcash.net is encrypted in transit (TLS). |
| Who you message, when, and how much you send | ❌ Not encrypted | Metadata — sender, recipient, timestamps, amounts — is visible to XSCN even for end-to-end chats. Encryption hides the contents, not the fact of a conversation. |
| Your profile, listings, deals, balances | ❌ Visible to us | Operational data needed to run the app. Treat anything you post publicly as public. |
| Your Vault (passwords, card numbers, private notes) | 🔒 Zero-knowledge | Encrypted in your browser under a passphrase we never receive. The database tables have no column a passphrase or plaintext could go in — check the schema live. Lose the passphrase and it's gone for everyone, us included. |
| Files in XSeed Cloud | 🔒 Zero-knowledge | Encrypted in your browser, then split into shards. Every stored piece is a fragment of ciphertext. |
| Your ID photo (age verification) | ⚠️ Encrypted, then deleted | Encrypted at rest while it waits, decrypted only for the one human who reviews it, and the row is destroyed the moment it's approved or rejected. The live count of retained IDs is published and must be zero. |
| Camera footage / face recognition | ⚠️ Off unless you enable it | Nothing analyses faces by default. If you turn on Face Watch for your own cameras, descriptors are computed in your browser and matched only against people your own cameras have already seen or that you labelled. Never an outside face database; never across owners. |
| Deleting your account | ⚠️ Manual, by request | There is no self-serve delete button yet. Ask through Support and it's done by hand, usually within days. Transaction records required for tax/accounting survive. We'd rather say this than ship a button that half-works. |
| Independent security audit | ❌ Not done | No third party has reviewed this code. Everything here is either self-verifiable or our word. A paid audit is on the roadmap. |
When you turn on private messaging, your browser generates a personal key pair using the standard Web Crypto API built into your device. Your public key is shared so people can send you locked messages; your private key is wrapped with a key stretched from your PIN (PBKDF2) before it's uploaded, so we only ever hold a blob we can't open. Each message is sealed with a key derived from both people's keys (ECDH) using AES-GCM.
Verify us yourself: the entire encryption routine ships to your browser as readable code at /e2e.js. Open it. There is nowhere for a private key or plaintext to be sent to our server — and you don't have to take our word for it.
A conversation uses one long-lived shared key. If someone ever steals a private key, past messages in that thread could be read. Tools built purely for high-risk secrecy (like Signal) rotate keys every message; we don't, yet. For most users this is fine — but you should know it.
We hand out public keys, so in theory a malicious server could slip you a fake one and sit in the middle. To rule that out, every user has a safety number (a short fingerprint of their key). Compare yours with a contact in person or over a call you trust — if they match, no one is in the middle. This is the same idea as Signal's safety numbers.
Encryption protects message contents. It does not hide who you talked to, when, or how often. If that matters to you, see the EFF's explainer on why metadata matters.
XCash is closed-loop in-app credit. You buy it with real money (card via Square, or Cash App / Venmo / crypto by sending to a posted destination and submitting a reference for approval). It is spent on goods and services inside XSCN. It is one-way and non-redeemable — there is deliberately no withdraw, cash-out, or transfer-to-bank feature anywhere in the app. Don't treat XCash as a savings account.
For card payments we never see or store your card number — that's handled by the payment provider's hosted checkout. Manual methods (Cash App / Venmo / crypto) go directly to the recipient; we only record the reference you submit.
Everything above is a statement. The verification page turns each one into something checkable: the encryption source code served straight from this server with its SHA-256, a live in-browser test that encrypts a message and then fails to decrypt it as an eavesdropper, falsifiable counts over the real database (e.g. how many end-to-end messages are stored readable — must be zero), and the differential-privacy maths as a test you can run on your own machine with node privacy.js.
Found something here that doesn't match how the app actually behaves? That's a bug in our honesty and we want to know — tell us in the app's Support section.
Create an account