Thunderbird is a free, open-source email, calendar, and contacts client developed by MZLA Technologies Corporation, a wholly owned subsidiary of the nonprofit Mozilla Foundation since 2020. It is a local client: message content and address books are stored and processed on the user's device and exchanged with the user's own mail provider, not MZLA's servers — MZLA states it receives only the email domain during account auto-configuration. The desktop app sends interaction and technical telemetry to Mozilla by default, with an opt-out in settings; the Android app (built from the 2022 K-9 Mail acquisition) states it does not currently collect telemetry. The project is donation-funded ($10.3M in 2024), carries no ads, and says it does not sell data or train AI on it. In 2025 MZLA announced Thunderbird Pro services (Thundermail, Appointment, Send), adding a new server-side data surface.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
15 ON FILE
[2024-01-26] · COLLECTION
Mozilla's 'Thunderbird Telemetry' support article, last updated 2024-01-26, states that desktop Thunderbird collects telemetry data by default — interaction data (such as number of accounts, filters, protocols, and installed add-ons) and technical data (version, OS, hardware, crash information) — and that users must deselect the 'Allow Thunderbird to send technical and interaction data to Mozilla' checkbox in Privacy & Security settings to opt out.
Mozilla's 'Thunderbird Mobile Telemetry' support article, last updated 2024-11-14, states that Thunderbird for Android does not currently collect telemetry, that the app plans to ask users to enable telemetry at first install, that telemetry data would be retained up to 400 days by default, and that disabling telemetry is treated as a request to delete previously collected data within 30 days.
The Thunderbird Privacy Notice, last updated 2025-05-09 and covering Thunderbird Desktop, Thunderbird for iOS, Thunderbird for Android, and K-9 Mail, states that email messages, names, and address books are stored and processed locally on the user's device and never sent to MZLA, and that MZLA receives only the email address domain — the full email address is never processed or stored on its servers unless the user chooses to share it in a crash report.
Thunderbird's blog post of 2020-01-28 announced that the Thunderbird project moved from operating directly under the Mozilla Foundation to MZLA Technologies Corporation, a new wholly owned subsidiary of the Mozilla Foundation, in order to hire more easily, collect revenue through partnerships and non-charitable donations, and offer products and services not possible under the Foundation, while stating Thunderbird remains free and open source.
Thunderbird's blog post of 2022-06-13 announced that the open-source Android email client K-9 Mail joined the Thunderbird project, with maintainer Christian Ketterer (cketti) joining Thunderbird's full-time staff, and that K-9 Mail would ultimately transform into Thunderbird on Android — the lineage of today's Thunderbird for Android app.
Thunderbird's 'State of the Bird 2024/25' report, published 2025-10-08, discloses that the project received $10.3 million in donations in 2024 (up 19% year over year) from more than 335,000 individual donors across 200+ countries, with a median contribution of $16.66 and only 17 contributions above $1,000, and reports a staff of 43 full-time employees — describing a community-donation funding model rather than corporate sponsorship.
The Thunderbird Privacy Notice, last updated 2025-05-09, discloses that during account auto-configuration Thunderbird contacts Mozilla's configuration database, DNS servers, and standard autoconfiguration URIs — sending the user's email domain to Mozilla's configuration database and potentially disclosing the email address to network administrators — that AWS hosts Thunderbird's servers and collects device IP addresses in server logs, and that telemetry data may be disclosed to Mozilla Corporation and Mozilla Foundation.
The Thunderbird Privacy Notice, last updated 2025-05-09, discloses that prior to version 128 desktop Thunderbird partnered with Gandi.net and Mailfence for in-app email address creation, sending users' email address search terms to both partners and sharing the user's country location for pricing.
Mozilla maintains a public registry of security advisories for Thunderbird, publishing per-release lists of fixed security vulnerabilities on an ongoing basis dating back to early Thunderbird versions — an open, continuous disclosure process for the client's security fixes.
The SECURITY.md file in Thunderbird's public thunderbird-android repository publishes the project's vulnerability-disclosure channel — GitHub's private security-advisory reporting form — alongside the SHA-256 signing-certificate fingerprints for Thunderbird, Thunderbird Beta and K-9 Mail so users can verify builds before install. The same document records an annual third-party review: Thunderbird for Android and K-9 Mail state they have completed the App Defense Alliance's Cloud Application Security Assessment (CASA) at Tier 2 through approved assessor NetSentries. No monetary reward is described.
The EFAIL research disclosure of 2018-05-14 documented that Mozilla Thunderbird was among the email clients vulnerable to a direct-exfiltration attack that could leak the plaintext of OpenPGP- and S/MIME-encrypted emails via crafted HTML messages; the researchers noted these client-side vulnerabilities could be (and subsequently were) fixed in the affected clients.
Thunderbird's blog post of 2023-07-20 reports an extensive third-party security audit of K-9 Mail — the codebase that became Thunderbird for Android — carried out by six auditors at 7ASecurity in collaboration with OSTIF, covering threat modelling, fuzzing and the software supply chain, with the full report published. Thunderbird reports zero high-risk vulnerabilities were found and a handful of low-to-medium risk vulnerabilities, most already resolved or being addressed at time of publication.
Thunderbird's blog post of 2025-12-09 reports that MZLA commissioned a full whitebox security audit of Thunderbird Send — the end-to-end encrypted file-sharing service planned for Thunderbird Pro — with the Open Source Technology Improvement Fund (OSTIF) and 7ASecurity, covering client and server code, shared infrastructure, supply-chain analysis and threat modelling. The audit surfaced two vulnerabilities (one critical, one high) plus twenty hardening recommendations; MZLA states both vulnerabilities were fixed in April 2025 and links the full published report.
Thunderbird's official source documentation describes its telemetry implementation as built on Mozilla's Glean framework, with Thunderbird-specific probe definitions (metrics.yaml, pings.yaml, tags.yaml in comm-central) compiled into the Glean probe registry alongside Mozilla's own, and telemetry compiled in by default for official builds.
Thunderbird's 2025-04-04 announcement of Thundermail and Thunderbird Pro services commits to a no-ads, no-data-sale, no-AI-training model for its hosted email service, and states that the experimental Thunderbird Assist AI features (developed with Flower AI) are optional and require user opt-in.