How does signing into my apps in Spanbox work? Does it get my passwords or 2FA codes?

No, and this is the part that put me at ease. You sign into each app INSIDE Spanbox exactly like you would in a browser tab, you type your password on the app's own login page (Google's page, WhatsApp's QR scan, etc.), and do the 2FA there. Spanbox never sees or stores your password or codes; each app just keeps its own private session on your machine, the same way a browser keeps you logged in. Spanbox isn't a password manager and it doesn't proxy your credentials anywhere. Since they run no server that can see your data, there's nothing on their end to leak even if they wanted to.

Think of it like a browser with one tab per app. You log in on each service's real page; Spanbox just holds the session cookie locally, same as Chrome would. It never handles the actual password.

2FA works normally because you're doing it on the app's own login screen, not a Spanbox form. WhatsApp is a QR scan, Google is Google's prompt. Spanbox is just the window around it.