MAX and Russian apps

For anyone asked to install MAX at school, work or for Gosuslugi, and anyone with Russian banking, shopping, taxi, Yandex or VK apps.

The 5-minute minimum

• The state messenger MAX has no end-to-end encryption: according to InterSecLab researchers, VK can read messages. Don't write anything important in it and don't use it to contact rights groups or lawyers.
• Installing MAX is voluntary: the digital and education ministries confirmed this in letters in 2025, and the digital ministry again in January 2026. According to OVD-Info ('extremist', 'foreign agent'), if you refuse, the school must give you another way to receive information.
• By law, Russian apps and services hand data to the authorities on request. Assume that anything you write, search for or pay for in them can be seen.
• Give apps as few permissions as possible: no access to contacts, microphone, all photos or 'always' location. iPhone: Settings → Apps → the app's name. Android: Settings → Apps → the app's name → Permissions.

If you are at risk

• If you need MAX or other Russian apps, it is safer to keep them on a separate phone without sensitive chats and contacts.
• Don't install the Russian digital ministry's certificate on your main phone. For government sites a separate device or a separate browser is better.
• Open Gosuslugi only when you need to. Every login, address and device is recorded, and the state sees them.
• According to an RKS Global study (April 2026), 22 of 30 popular Russian Android apps detect whether a VPN is on, and 19 of them report this to their servers. In spring 2026 the digital ministry told large companies to restrict access for users with a VPN on. According to InterSecLab, every time MAX starts it sends VK your IP address, your operator and whether a VPN is on, and it uploads your whole phone book.

What not to do

• Don't give MAX and Russian apps access to your contacts: that is how the people you know end up in their databases. According to InterSecLab (24.09.2026), MAX uploads the whole address book and re-syncs it on every change.
• Don't discuss anything in MAX, VK, Odnoklassniki or Russian email that you are not ready to show an investigator.
• Don't open Kompas or rights groups' sites in Yandex Browser, the VK browser or via Yandex search.

What traces remain

• Messages, calls and device data in MAX are available to the operator and through it to the security services.
• Taxi and delivery services and banks know where you go and what you pay for.
• Since 1 January 2026 Russian internet services on the register of 'information dissemination organisers' keep data about messages and users for 3 years instead of one.
• Logging in to Gosuslugi leaves the state a record with your IP address and the time.

Designations of organisations in this guide: OVD-Info (foreign agent, extremist, on Rosfinmonitoring list). Contacting them carries a risk: do not write from a phone that may be seized, and do not repost their materials.

current as of 26 September 2026. More: OVD-Info: MAX at school (foreign agent, extremist, on Rosfinmonitoring list); Meduza: InterSecLab on how MAX can change surveillance per user (24.09.2026) (undesirable); Xakep: RKS Global study, 22 of 30 Russian apps detect VPN use (10.04.2026); First Department: using Russian online services more safely (03.09.2026) (foreign agent); ConsultantPlus: Law 41-FZ, internet services keep message metadata for 3 years from 01.01.2026; First Line: VKontakte, the security services' favourite network