MAX and Russian apps

For anyone asked to install MAX at school, work or for Gosuslugi, and anyone with Russian banking, shopping, taxi, Yandex or VK apps.

The 5-minute minimum

• The state messenger MAX has no end-to-end encryption. Don't write anything important in it or use it to contact lawyers or rights groups.
• Installing MAX is voluntary, as the digital and education ministries confirmed in writing in 2025 and January 2026.
• Russian apps hand data to the authorities on request. Assume anything you write, search or pay for in them can be seen.
• Give apps as few permissions as possible: no contacts, microphone, full photo access or 'always' location.

If you are at risk

• If you need MAX or other Russian apps, keep them on a separate phone without sensitive chats.
• Don't install the Russian digital ministry's root certificate on your main phone.
• Open Gosuslugi only when needed: every login, address and device is recorded and visible to the state.

What not to do

• Don't give MAX or Russian apps access to your contacts: InterSecLab (24.09.2026) found MAX uploads the whole address book and re-syncs it on every change.
• Don't open this site or rights groups' sites in Yandex Browser, the VK browser or via Yandex search.

What traces remain

• MAX messages, calls and device data are available to the operator and through it to the security services. Since 1 January 2026 Russian internet services on the ORI register keep message metadata for 3 years.

Designations of organisations in this guide: OVD-Info (foreign agent, extremist, on Rosfinmonitoring list). Contacting them carries a risk: do not write from a phone that may be seized, and do not repost their materials.

current as of 26 September 2026. More: OVD-Info: MAX at school (foreign agent, extremist, on Rosfinmonitoring list); Meduza: InterSecLab on how MAX can change surveillance per user (24.09.2026) (undesirable); Xakep: RKS Global study, 22 of 30 Russian apps detect VPN use (10.04.2026); First Department: using Russian online services more safely (03.09.2026) (foreign agent); ConsultantPlus: Law 41-FZ, internet services keep message metadata for 3 years from 01.01.2026; First Line: VKontakte, the security services' favourite network