MAX is a messenger built by VK, unveiled in March 2025 and made mandatory pre-installed software on new smartphones and tablets sold in Russia starting September 1, 2025. In just over a year, its user base grew from roughly 35 million in autumn 2025 to over 130 million by August 2026. MAX is also integrated with Russia's Gosuslugi public-services portal and Goskluch digital-ID tool, although the messenger itself is not a mandatory requirement for signing in to Gosuslugi — other login methods remain available.
That scale naturally raises the question of what exactly the app knows about its users and how well that data is protected. We've covered general messenger-privacy hygiene before in our guide to choosing a genuinely secure VPN — here we focus specifically on MAX: its encryption model, data collection, how it compares to Telegram, and concrete steps to lock down an account.
Does MAX use end-to-end or only transport encryption?
By default, MAX does not use end-to-end encryption (E2EE) — it relies only on transport-level TLS encryption with GOST support via CryptoPro, meaning the server is technically capable of accessing message content once the transport channel is decrypted. The developers have stated plans to add end-to-end encryption in the future, but as of this writing it is not implemented for regular chats.
A separate risk comes from local storage: messages on the device are kept in an unencrypted SQLite database, so anyone with physical access to an unlocked phone can read the chat history directly, without touching the server at all. That's a distinct vulnerability from the channel's encryption type, which is exactly why an in-app passcode (covered below) isn't optional — it's a baseline requirement.
What data does MAX collect, and who can it be shared with?
MAX collects IP address, the user's contact list, carrier information, network-environment parameters, and on-device VPN status. Data-localization rules require this information to be stored on servers inside Russia, and the "Yarovaya" law (374-FZ) requires telecom operators and information-distribution organizers to retain chat data for up to six months and hand it over on an official request from authorized agencies.
Independent confirmation that data collection can differ account by account comes from an InterSecLab report on selective surveillance in MAX: researchers found that the developer can remotely toggle specific features — including network diagnostics and VPN detection — for an individual account, without shipping an app update. One honest caveat from that report: on-device VPN detection only triggers for a VPN running directly on the device itself; a VPN configured at the router level is not detected this way.
Has MAX had real security incidents?
Yes — in the first nine months of its bug-bounty program, independent researchers found 288 vulnerabilities in MAX, a high number for a messenger of this scale and a sign that the app's attack surface is substantial. One finding was an IDOR-class issue (insecure direct object references) that, under certain conditions, allowed access to other users' images without authorization; the developers patched it after researchers reported it.
On April 30, 2026, infrastructure provider Cloudflare briefly flagged the max.ru domain as spyware; the flag was removed the next day. A single provider's one-day flag isn't the same as a formal finding that the app is malware, but it's a telling data point: automated classification systems judged MAX's traffic behavior to resemble tracking software.
MAX vs. Telegram: what differs in privacy
MAX and Telegram use different encryption models by default, and that single difference drives most of the other gaps in the table below.
| Parameter | MAX | Telegram |
|---|---|---|
| End-to-end encryption by default | No (transport-only TLS/GOST) | No in regular chats, yes in "secret chats" |
| Metadata collection (IP, contacts, carrier) | Yes, including on-device VPN status | Minimal metadata set |
| Client code openness | Closed source | Client apps partially open-source |
| Phone number required | Yes | Yes |
| Data localized in Russia | Yes, mandatory | Servers outside Russian jurisdiction |
For contrast, it's worth keeping a third reference point in mind — Signal, which encrypts all chats end-to-end by default and collects minimal metadata. A broader look at choosing a trustworthy, well-audited VPN to pair with any messenger is in the safest VPN guide.
How to turn on a cloud password (2FA) in MAX
Without a cloud password, a MAX account can be hijacked by intercepting a single SMS code, so this is worth enabling right after installing the app — before the account accumulates chats and contacts.
- Open the app's "Settings" → "Privacy and Security" → "Cloud Password" section.
- Set a password that isn't reused on any other service you have.
- Add a recovery email in case you ever lose the password — without one, recovering the account is much harder.
Once a cloud password is set, a single SMS code is no longer enough to sign in on a new device — an attacker would also need the password that only you know.
How to check active sessions and lock down a MAX account
Regularly checking active sessions is the second most important step after the cloud password, because the session list is what reveals whether someone else has signed into your MAX account from another device.
- Open the active-sessions list in privacy settings and sign out of any device you don't recognize.
- Turn on an in-app passcode — a separate layer of protection against anyone reading your chats if they get physical access to an unlocked phone.
- Limit who can see your phone number and "online" status in privacy settings.
- Review which apps have access to your contact list and revoke permissions you don't need.
- Enable biometric unlock (fingerprint or face) for the app if your device supports it.
Do you need a VPN if you use MAX?
A VPN hides the network layer of your connection — your ISP and public Wi-Fi can't see that you're specifically using MAX, and your real IP address is hidden from the messenger at the connection level — but a VPN does not change what the MAX platform itself can see and store under its own policy and 374-FZ.
It's important to be honest here: a VPN does not hide the fact of a conversation from MAX, and it doesn't turn transport encryption into end-to-end encryption — the app remains technically capable of processing message content on its own servers regardless. Per the InterSecLab report mentioned above, on-device VPN detection can be applied selectively to specific accounts, and it's specifically a VPN running on the device itself (not at the router level) that falls under that kind of check.
If you're choosing a VPN specifically for network-layer privacy, see how to actually verify a no-logs claim rather than take it on faith on the LiMP VPN pricing page, which also lists current plans and the feature overview for supported platforms.
