Tuta logged 49 release events in 30 days and 30 GitHub releases in 90 days. For an encrypted email provider, that is the interesting part: this is not just a privacy brand with a static web app. It is a multi-client product with real release machinery behind it.

The official site positions Tuta around encrypted email, calendar, and contacts. It also claims quantum-safe encryption, a zero-knowledge calendar, mobile apps, offline use, and private push reminders without Google Push on Android. Tuta Drive is listed as closed beta, so that should be treated as a near-term product signal, not a generally available feature.

The GitHub repository backs up the client-platform reading. The README describes Tuta Mail as a secure email service with built-in end-to-end encryption across devices, and links to Android, F-Droid, web, iOS, and desktop clients. The repository is GPL-3.0, and the ToolVitals openness classification is OSI-approved OSS, so it is fair to call Tuta open source.

The recent release examples are not flashy. The May 8 Android mail and calendar releases both point to a fix for blank Calendar settings screens after an edge-to-edge WebView change, with SHA256 checksums attached to the APK assets. That is maintenance work, but it is the kind of maintenance work a privacy email client has to do if it wants to be trusted on phones.

The other signal is editorial. Tuta’s recent RSS items are not narrow product updates. They cover private browsers, Meta AI visual analysis for age detection, disabling Gemini across Google apps, Facebook data collection, age verification, and private period tracking apps. That tells you what Tuta is betting on: privacy anxiety as a durable acquisition channel.

That can get noisy. A privacy email provider writing about browsers, period apps, age checks, and AI scanning is playing a broad trust game. The upside is obvious, Tuta meets users before they are shopping for encrypted email. The risk is also obvious, broad advocacy content can drift from product proof if the shipping cadence weakens.

Right now, the cadence has not weakened. ToolVitals gives Tuta a 93 health score, 100 shipping score, 84 ToolVitals score, 208.3 hot score, and 7,590 GitHub stars. Data confidence is 97, so the activity signal is strong enough to take seriously.

What ToolVitals cannot infer

ToolVitals can see releases, stars, score signals, SSL and uptime style checks, and public event volume. It cannot tell you whether Tuta’s encryption design is correct, whether the UX is pleasant, whether support is good, whether migrations are painless, or whether paying customers are happy.

It also cannot infer revenue quality from release cadence. Forty-nine release events in 30 days says the public machinery is active. It does not prove product-market fit.

The release notes inspected here are maintenance-focused, not major feature launches. So the conservative read is simple: Tuta is actively maintained and shipping across clients, while its public content strategy keeps pushing the broader privacy case.

Among related email tools in the payload, NeoMD has 244 GitHub stars, a 95 shipping score, and 15 release events in 30 days. Tuta is much larger by public GitHub attention, with 7,590 stars, and it has more recent event volume at 49 release events in 30 days.

matcha shows a 100 shipping score and 21 release events in 30 days, but ToolVitals has no GitHub star count for it in this payload. That makes the comparison incomplete. ToolVitals can say matcha appears active, but it cannot compare audience size from the supplied metrics.

Recommendation

If your team wants hosted encrypted email and calendar software with public client code, evaluate Tuta because the project combines OSI-approved GPL-3.0 licensing with active release flow. If you only need a quiet mailbox and do not care about open client code or privacy-first positioning, the release cadence matters less. For privacy-sensitive teams, it matters a lot.

Sources