Skip to content

Update Tuta product #214

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
charlag wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update Tuta product #214

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions products/tuta.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,15 @@ notes = [
]

[rubric.third-party-collection]
value = "yes"
value = "no"
citations = [
"In order to be able to evaluate campaigns with partners and advertising campaigns (e.g. advertising via Google or other search engines), we store an ID of the campaign with your Tutanota account when you reach Tutanota via a campaign link and register a Tutanota account. To be able to assign returning users to a campaign, we store a cryptographic hash of the IP address and the user agent (including information about the user’s browser and operating system) together with the campaign ID when you visit our website via a campaign link. If you visit our website via a search query and an advertising campaign, we also store the keywords and the search query together with the hash and the campaign ID. By using the hash, it is no longer possible to infer the IP address or the user agent. The keywords and the search query are not stored with the Tutanota account.",
"The hash and the campaign ID, keywords and search query stored together with the hash are deleted after 72 hours. Beyond this period of 72 hours, for the purpose of evaluating the campaign and until the completion of the evaluation, only completely anonymized campaign data (keywords and search query) are stored and processed without any link to the hash.",
"Insofar as we process personal data during the campaign analysis, this is done on the basis of Art 6 para. 1 p. lit. f) GDPR. Our interest in being able to evaluate advertising campaigns and to improve our marketing activities constitute a legitimate interest within the meaning of Art. 6 para. 1 p. lit. f) GDPR."
]
notes = [
"Note: The privacy policy has been misunderstood. Tuta does not collect personal data from third parties, but explains here how it handles user data in their own campaigns."
Copy link
Collaborator

@doamatto doamatto May 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Admittedly, reading over the citation I'm struggling a titbit to grasp the exact "timeline". My understanding is :

  1. You click an AdSense ad or some other Google advert which brings you to tuta.com/abc?utm_id=abc
  2. Tuta stores the IP and user agent as a hash (probably to discern unique visitors rather than generic hits) alongside with the campaign ID from before and, if you came from a search, what you searched.
  3. After 72 hours, Tuta deletes all that information.. except after 72 hours what you searched can still be used for ad testing despite having been deleted ?

If that is the case, then I see no reason this couldn't be graded no

]

[rubric.history]
value = "last-modified"
Expand All @@ -34,9 +37,9 @@ citations = [
]

[rubric.data-breaches]
value = "no"
value = "yes-72"
notes = [
"Tutanota is based in Germany so it is legally obliged to notify users of data breaches, but does not make any mention about if they will do so."
"Tuta is a German company, and adheres to German law which requires the company to notify users in case of a data breach. Tuta even informed users about a security weakness, which to the company's knowledge, did not cause any data being leaked: https://tuta.com/blog/vulnerability-fixed"
Copy link
Collaborator

@doamatto doamatto May 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We err on the side of caution (and pessimism) — I have no doubts Tuta can and will follow the law, but if it's not explictly stated in the privacy policy or some other tightly linked document (like a whitepaper), then we can't grade it higher.

]

[rubric.third-party-access]
Expand Down Expand Up @@ -128,5 +131,7 @@ citations = [
]

[rubric.revision-notify]
value = "no"
notes = [ "German laws require users to be notified four weeks prior to a policy change. Tutanota has historically sent out these notices, but does not make any mention about if they will do so." ]
value = "yes"
notes = [
"Tuta is a German company, and adheres to German law which requires the company to notify users in case of a change of the data policy. Tuta's policy was last changed in 2022, and all user were informed via an email directly in the Tuta client."
]
Loading