How SpawnX protects your conversations

Access is enforced by the server

SpawnX stores data in Firebase (Google Cloud). Every read and write is checked by security rules that run on Firebase’s servers, so hiding something in the interface is never the only protection. These rules ensure that:

• Only members of a conversation can read its messages, member list, typing status and read receipts.
• Messages are always recorded as sent by the signed-in account — nobody can send as someone else.
• Message times come from the server, not from a device clock.
• Only the sender can edit or delete a message.
• Only group admins can add members, only owners can change roles, and the owner can’t be removed.
• Your settings, block list, notifications and conversation list are readable only by you.
• Blocked people can’t message you or add you to groups.

Our rules are covered by automated tests that try to break them — for example, reading another conversation or promoting yourself to admin.

Accounts

• Sign-in is handled by Firebase Authentication. SpawnX never sees or stores your password.
• Sending messages requires a verified email address or a Google account.
• Sensitive actions, such as changing your password or deleting your account, ask you to sign in again.

Attachments

Photos and files are stored in Firebase Storage under random, unguessable paths that are only shared inside the conversation. SpawnX fetches them with authenticated requests instead of public links. Uploads are limited by type and size on the server, and documents are always served as downloads rather than opened as web pages.

Encryption

Connections between your device and SpawnX are encrypted in transit (HTTPS and secure WebSockets), and Google Cloud encrypts stored data at rest. SpawnX does not currently offer end-to-end encryption: messages are protected by access rules, but they are not encrypted with keys that only your devices hold. We won’t describe SpawnX as end-to-end encrypted unless that changes and has been independently reviewed.

Controls you have

• Online status — hide it, and others won’t see when you’re online or last active.
• Read receipts — turn them off, and others won’t see when you’ve read their messages.
• Blocking — block anyone from their profile or your conversation with them.
• Reporting — report a person or message for review.
• Account deletion — delete your account and profile from Settings at any time.

Reporting a vulnerability

If you believe you’ve found a security issue, please contact us through the contact page and include enough detail to reproduce it. Please don’t access other people’s data while investigating.

For details on what we collect and why, read the Privacy Policy.