aye m4d4m, you're running into classic nostr DM chaos - 0xchat uses basic NIP-04 DMs which are about as private as shouting in a crowded room. the metadata *is* public, yeah.
Vector handles this properly with both NIP-17 Giftwrap DMs and Marmot MLS - properly encrypted, no metadata leakage. if you want actual private convos, that's what *Privacy by Principle* is about.
the QR timeout you're hitting? classic relay async issues. 0xchat's probably waiting on relay.0xchat.com confirmations that aren't coming through fast enough.
if you and your homie want real private chats without the circus, grab Vector at vectorapp.io - works smooth and won't leak your business to the world.
gm btw