Tuta Mail

Tuta is an e-mail service by Tutao GmbH in Hanover, Germany, launched in 2014 as Tutanota and renamed Tuta in November 2023; the app keeps the old package name. Tuta Mail is its Android app: mail, contacts and a calendar in one, for a free or paid Tuta account. It is not a general e-mail app; F-Droid marks it with the anti-feature “App is tethered to the Tutanota eMail service.”

Technically, the app is Tuta’s web client, shipped inside the APK and shown in Android’s web view, with native parts for notifications, encryption and search.

What Tuta says is encrypted

These are Tuta’s statements about its service, which we can’t check from the app alone:

• End-to-end encrypted: “Emails, including subject lines and all attachments”, the address book and calendars.
• Not encrypted: “The only data that is not encrypted in a Tuta email are the email addresses and the date of an email sent or received.”
• Mail with other providers is “not protected with end-to-end encryption, but are only encrypted once they reach our servers”. To send an encrypted message to someone outside Tuta, you set a password that the recipient needs to open it.
• The protocol, TutaCrypt, combines AES-256, RSA-2048 or x25519 and, as a “quantum-safe” part, Kyber-1024.

In the app

• Mail, contacts and calendar tabs. The free plan has 1 GB, one calendar and three labels; paid plans add more storage and calendars, among other things. Tuta also publishes a separate Tuta Calendar app.
• Images and other content from the web are blocked in messages by default. Per sender you can show them once, always show them or always block them, and the web view refuses cookies.
• Phone contacts: syncing Tuta contacts into the phone’s address book is off by default; with permission, the app suggests recipients from your phone contacts.
• Saved logins are protected by the screen lock, the system password or biometrics, as you choose.
• Paying works through Tuta’s own payment page in this build, since it has no Google Play Billing.
• Not on Android: importing mail, which needs Tuta’s desktop app, and Tuta Drive.

What goes online

• Tuta’s servers, for all mail, contacts and calendar data, and the connection for notifications.
• Usage data: after login only if you agree, when the app asks to “Share anonymous usage data” and stores a random identifier on the phone. From our reading of the code, the sign-up screens can send such usage tests before that question is asked.
• Error reports go to Tuta only when you choose to send one.
• Web content in messages once you allow it, and links, which open in your browser.

Our scan found no trackers, and this build contains no Google Play Billing or Firebase code. Tuta’s own APK of the same version, from GitHub, includes Google Play Billing, and a user reported the GitHub version contacting Google’s Firebase logging server; a Tuta contributor replied that the Google Play version now uses Google Play Billing and that F-Droid’s release removes it.

About this file

• This is F-Droid’s build of version 360.260922.0, compiled from Tuta’s tagged source with Google Play Billing removed, and signed with F-Droid’s key. Tuta’s GitHub APK is signed with Tutao’s own key, so the two can’t update each other; Google Play’s copy we couldn’t check. Tuta released 361.261006.0 on GitHub on 12 October 2026; F-Droid hadn’t built it a day later.
• The 77.3 MB file runs on Android 8.0 and later. It has library folders for seven processor types, but Tuta’s own native library only for ARM, 32- and 64-bit, and 64-bit x86; the others hold a helper library only, and Tuta says it doesn’t support 32-bit x86. The app declares 20 permissions: internet, notifications and restarting them after a reboot, exact alarms for calendar reminders, the battery-optimization request, contacts and Android accounts for the contact sync, the camera for scanning QR codes when verifying a contact’s keys, biometrics, and storage on Android 9 and older.
• Tuta is licensed under the GPL-3.0. The project lists its bundled libraries in a third-party file; one icon set, Icomoon, is used under a custom licence with what the file calls a “confirmation for usage in Open Source project”, and Signal’s search extension, under the AGPL-3.0, is built in without being listed there.
• The screenshots are Tuta’s own store images, on an iPhone frame; we leave out the three that don’t show the app.

Flagged by F-Droid:

• NonFreeNet: Relies on or promotes a proprietary network service.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi; armeabi-v7a (32-bit ARM, older and budget phones); mips; mips64; x86 (32-bit Intel, emulators); x86_64 (64-bit Intel, emulators and Chromebooks).

Versions currently kept in the F-Droid repository. We host and check only the newest one. Full changelog.