Know what
leaves the PC.
TorrentMax keeps the torrent engine and file contents on the desktop. Remote is optional, and the trust boundary is worth understanding before you turn it on.
Verify the installer
The SHA-256 hash on the download card is a direct integrity check: after downloading, compare it with the file on disk. A match confirms the file is the build published here.
Get-FileHash .\TorrentMax-Setup-3.0.7.exe -Algorithm SHA256Download only from the official TorrentMax download section. If a third-party mirror provides a different hash, do not run that file. Keep Windows Security enabled; the documentation never asks you to disable it.
What stays on your PC
The desktop app stores its library, settings, transfer history, and downloaded data on your computer. Normal desktop use does not require an account. TorrentMax 3.0.7 does not include an advertising SDK or a third-party analytics client.
Version 3.0.7 sends an anonymous install check-in by default so the project can measure active installations. It contains a random install identifier, the app version, and the operating system platform, and is sent at launch and about every four minutes. It never includes torrent names, file paths, download history, account details, or file contents. You can turn it off in Settings → About. The server stores a salted one-way hash of the install identifier, and the privacy notice has the full detail.
The public website uses a first-party download counter that stores a one-way hash of the request IP address and basic request metadata, not the raw IP. Server logs and the optional Remote account are described in the privacy notice.
On Windows, Scan completed downloads uses Microsoft Defender and puts the result in the torrent details. It is a local scan of completed files, not a file upload.
What Remote sends
Remote is off until you enable it and pair a desktop. When it is on, the desktop opens an outbound HTTPS connection to the TorrentMax relay. The relay carries authenticated commands and status between the browser and the app.
That traffic can include torrent metadata, file names, peer and tracker details, RSS entries, settings, and command results. It does not include the contents of your downloaded files. The relay cannot read the files on disk or drive the torrent engine directly.
Because the connection is outbound, Remote does not require a forwarded router port or an inbound firewall rule. If the desktop is off or TorrentMax is not running, the browser cannot reach the queue.
Device credentials
After pairing, the device credentials are encrypted with Windows DPAPI and kept on the computer. The browser does not receive a permanent device secret to store as a password.
- The pairing code is single-use and expires after ten minutes.
- Do not send a live code to anyone. Redeeming it links the desktop to that account.
- Remove a lost or retired computer from Devices in the dashboard.
- Turn Remote off in Settings → Remote to stop this desktop from connecting.
The relay can see the metadata and command payloads needed to provide the service. It is not end-to-end encrypted storage for your torrent library. If that trust model is not acceptable, leave Remote disabled; the desktop client still works.
Account security
Remote passwords must be at least 12 characters. Use a password manager and a password you do not reuse. A password reset link expires after 30 minutes and can only be used once. Changing the account password signs out every browser session.
Browser sessions can last up to 30 days or until you sign out. If you use a shared computer, sign out of the dashboard when you are finished rather than relying on the session expiry.
The desktop app and the website are separate surfaces. Protecting the Windows account matters too: anyone who can open your Windows session can use the desktop client.
BitTorrent is public by design
Peers in a torrent swarm can see your IP address, just as they can with any BitTorrent client. TorrentMax is not a VPN, a proxy, or an anonymity tool. A VPN can change what peers see at the network layer, but it does not make the BitTorrent protocol private.
Remote does not change that. It adds a browser control path to the desktop; it does not hide the desktop's peer connections.
Only join swarms you have the right to participate in, and do not disable Windows Security to bypass a protection prompt.
Report a vulnerability
Email torrentmax@torrentmax.cc.cd with the subject [Security]. Include the affected version, Windows version, a reproduction path, and the impact. Do not include your account password or a live pairing code.
Please give the issue time to be fixed before publishing exploit details. The contact page also covers privacy and account requests.
Still stuck? Send the details to support.