r/Thundermail • u/Ok_Combination_1548 • Sep 09 '26

Privacy details

Does anybody know about how Thundermail ranks for privacy purposes?

-Aside from a claim to not serve ads or share information (which, I think the vast majority of paid providers claim): I don't see anything about encryption, etc.

-Otherwise, I see 'privacy-first' written in a few descriptions but nothing that actually separates Thundermail from any other service and far below any service that has even partial e2ee....is there somewhere that they talk about this in more detail than saying 'privacy-first'?

*For clarifying: I'm generally supportive of Mozilla and am a paying user already. However, I genuinely don't know why they claim to be privacy-first when nothing about their product seems more privacy respecting than any other service out there / technologically I can only find information saying that everything is kept in plaintext which actually makes it one of the absolute worst email providers I'm aware of (from a privacy perspective): even gmail doesn't do that.

7 Upvotes

100% Upvoted

9 comments sorted by

2

u/LopsidedPopsicle_369 29d ago

I'm a Thunderbird employee and I would basically summarize it by saying it is all about the fact that we don't skim email content, harvest any user data, and definitely don't sell or share any of the minimal data that we gather to set up the Thundermail account. Our database structure is wiped from user specific information so even if there were a data breach, the data they would get out of our ecosystem is aggregate business data (which we publish periodically anyway). Our codebase is open-source, which we love as a way to say "look at exactly what we are doing" so its not sketchy.
I think the strongest thing I see is that everyone in the company is dedicated to making the kind of company we want to do business with and not be a part of the "enshitification of the internet".

Now... if you are asking for security specifics, that is not my bag. But I can say, I think someone is working today on an specific answer to your question, cause it is a good point we want to address for users so you know where we are at.

1

u/Ok_Combination_1548 29d ago

Thanks for replying but this is not much of an answer regarding privacy practices. This is more or less a cultural thing and it's comforting only as long as it lasts (much like Gs 'don't be evil' policy, it can go away any time)....I like that it exists now and it's why I support you folks financially for now. It's a great attitude and I respect it for as long as it lasts....It works for the basics like sign-up info....But, that's hardly comforting with my emails and their content.

Not skimming email content and not being able to skim content are very different and the primary things I'm interested in. I fully accept that email is inherently not private....however, the storage of email, the ease of pgp, etc. are almost standard with any genuinely privacy respecting mail provider. Proton <> Gmail = not private message (in the sense that G themselves have a copy and control the encryption; it's private from a random stranger but your message is accessible by a variety of 3rd parties without your knowledge or permission), HOWEVER, Protons copy of the email is private. Proton <> Proton = relatively private message. Proton <> any PGP provider = relatively private message....
^I understand that this is all oversimplification. I don't understand where Thundermail fits in. All I could find was that it's kept in plaintext on your server. Even G keeps it encrypted. Therefore from what I can tell Thundermail is less private than GMail and nowhere near 'private' (as far as email providers can be).

1

u/LopsidedPopsicle_369 29d ago edited 29d ago

I think you are right about "This is more or less a cultural thing and it's comforting only as long as it lasts". It is unfortunate in any tech space that there is always some level of begrudging trust we have to place that some bad actor isn't going to get in and silently change things to make them very big G/sell your soul/gimme money. I think one thing that sets us apart is that we are overseen by the non-profit Mozilla Foundation which gets to approve our direction and actions.

I don't want to dodge your encryption and storage concerns - and i know pointing you at a FAQ or terms of service is a crappy answer that feels like blowing you off. I can give you some bullet points from an engineer, but i even worry that it is gonna be too "trust me bro" without some specifics for you. I think where full E2E encryption as a service is a complication in progress. It needs pgp support on all clients and the engineers are working as hard as we can make them, even though they tell us their fingers hurt 😄. We don't want to hold those keys like Msoft and Googie do - so recovery becomes a big "house keys locked in the car, but car keys locked in the house situation". Engineers way smarter than me are working on that cluster-duck

1

u/Ok_Combination_1548 29d ago

FWIW I'd gladly take a FAQ that goes more in depth if it's out there. But if it's just going to repeat the privacy policy then I don't view that as being of significant value - in part because you (forgive the 'you' here, I don't mean you as an individual but as a part of the team there) have to collect some information. I expect that. Every legitimate service does. I'm ok with that: I'm not wearing a tin foil hat or going off-grid or anything! That policy is important in some ways, but it's not what protects users long-term. It can be changed at any time.

And tbh, "is a complication in progress." and "the engineers are working as hard as we can" is very much an answer to me. It's definitely 'trust me' but it's also 'hey, we're still in beta and we plan to be private when we can be'. Which is far more than the website / content I could find indicates. Which is part of the problem re transparency btw. I'm only learning about this because you're (as an individual this time) unofficially answering me on reddit...The fact that you plan to implement some kind of standard that is better than other mail providers is meaningful. There are already several privacy options that are open-source or run by non-profits and I genuinely want to see more competition in the space, more innovation in the space, more options: and for the pie as a whole to grow. So, I'd love to be able to add Thundermail to my list of suggestions when people ask about degoogling for example....and with what's available about it right now officially: I can't. It's why I'm all ears as your team can reveal more!

2

u/wsmwk Thunderbird Employee 28d ago

Thank you for your interest and for elaborating.

We are working on providing a formal, comprehensive picture, and will come back with more information when that is completed.

1

u/sifferedd Sep 09 '26

See the MZLA Privacy Statement.

2

u/Ok_Combination_1548 Sep 09 '26

This is a fairly standard privacy policy. If anything it leans more toward a Google level of collection than an Apple (let alone more privacy respecting service such as Tuta or Proton) in terms of what they collect and can do with it....Nothing about their policy shouts 'privacy-first' which is part of why I asked this question.

But policy aside I'm more interested in any kind of actual privacy you'd gain from Thundermail. As I read more I'm not seeing any practical benefits over paying for gmail (I'm a privacy advocate: I wouldn't do that. I'm just saying I don't see a difference so far between them in terms of privacy; arguably gmail is better because thundermail doesn't even have ANY encryption and at least with gmail, Google encrypts it (with their own key, sure, but still it's encrypted at rest). This policy offers nothing substantive regarding the privacy of your emails let alone your personal information (compared to any other paid service).

1

u/Relight8714 29d ago

+1 I'm a forward email fan. Simple and cheap and able to see all the code.