Is Spanbox safe to install? How do I know it isn't reading my messages on a server somewhere?

Fair worry, and the design answer is that there's no server on their side that can see your data in the first place. Spanbox runs each app's web session locally, like a browser does, and your messages and logins stay on your device. They don't operate a cloud that your chats route through, so there's nothing central to hack or subpoena. Practically: you can watch its network traffic and you'll see it talking to WhatsApp, Google, etc. directly, not to a Spanbox 'inbox server'. It's the opposite model from a bridge like Beeper, where messages do pass through their infrastructure. No account, no cloud, no credential storage is the trust story.

The 'no account needed' setup is itself a signal, there's no Spanbox login because there's no Spanbox server holding your stuff. Your sessions live locally. That's a very different risk profile from a cloud inbox.

If you're properly paranoid, run it behind a network monitor for an evening. You'll see per-app traffic to the real services and no mystery 'phone home' of message content. That's what local-first should look like.