The MAX messenger has officially formalized the tracking of user activity. MAX recently updated its privacy policy and now legally collects data on how users interact with content: what they view, like, and save, as well as which channels they subscribe to or unsubscribe from. All of this is recorded and filed away—effectively creating a dossier on every MAX user for the authorities.
MAX had previously disclosed its data collection practices, noting that it stores information such as IP addresses, operating systems, browsers, locations, and service providers, along with address book contacts, cookies, and even ESIA/GIS data if the user links those accounts. Now, MAX is also capturing data on content interaction: which channels a user views, subscribes to, or leaves; what they specifically like or dislike; and what they save. A clause covering this was added to the privacy policy on September 25. The policy states that MAX uses this information to personalize advertising; however, the messenger also shares this data with partners involved in analytics and security—not just advertising—including app developers, telecom operators, mobile and web analytics services, and government agencies.
Earlier, the digital security lab InterSecLab, in collaboration with RKS Global, determined that MAX possesses the full functionality required to monitor specific accounts; while the messenger does not constantly spy on every single user, it could easily begin doing so at any moment. The messenger is designed so that the app can behave differently for two people running the same version of MAX—displaying different content or results to each. This allows VK to remotely enable or disable specific features for individual users, including surveillance functions. Commands are transmitted in real-time from VK servers without the user receiving any notification.
In reality, the app offers no privacy whatsoever: even so-called "secret" chats turn out to be nothing more than standard disappearing messages with a timer—and they vanish only from the users' devices, not from the server. Every message in MAX is automatically scanned for links and specific keywords; the list of these keywords can be modified at any time without requiring an app update. Every call and voice message is tracked as well.
The user's entire contact list is automatically uploaded to VK servers, allowing anyone to look up a name, registration date, and status using just a phone number. If you use the government services, banking tools, medical services, or even school chats integrated into MAX, the messenger can see every page you open and take screenshots. Moreover, it can execute arbitrary code within those services and even perform actions on the user's behalf.
To facilitate this level of control, MAX incorporates specialized technical components. For instance, five independent analytics systems from VK Group (OneLog, AppTracer, MyTracker, OK.ru analytics, and DPS) are integrated into the app; they simultaneously log every tap, screen view, and interaction with videos. A TensorFlow Lite machine learning system is embedded in the code to handle speech analysis and keyword searches.
To conceal these capabilities, MAX employs a self-protection mechanism: the app obfuscates network addresses within the code and shuts itself down if it detects analysis software. For the user, deleting the account does not mean that Makh will stop using their personal data and collected information: "the company reserves the right to continue processing the Information if there are legal grounds to do so in accordance with the legislation of the Russian Federation," the privacy policy states.
