ChaCha20 uses only additions, rotations and XORs, so it runs in constant time on any CPU, and Poly1305 is a one-time MAC keyed per message from the cipher's first block. RFC 8439 (which replaced RFC 7539) uses a 32-bit block counter, limiting one message to 256 GiB. XChaCha20-Poly1305 extends the nonce to 192 bits so random nonces are safe; it is described in an Internet-Draft and implemented by libsodium and others.
A repeated key and nonce pair breaks confidentiality and lets an attacker forge messages, exactly as with AES-GCM. On CPUs with AES instructions AES-GCM is usually faster for bulk data (on one Apple M4 Max core: about 2.1 GB/s for ChaCha20-Poly1305 against 8.8 GB/s for AES-256-GCM with OpenSSL 3.6.5), but ChaCha20-Poly1305 wins on small messages and on devices without AES hardware.
It appears as TLS 1.3 TLS_CHACHA20_POLY1305_SHA256 (0x1303), OpenSSH chacha20-poly1305@openssh.com, WireGuard's transport cipher, age's payload encryption and PASETO v2 local tokens.