I dunno if it qualifies as shitty, but I've always been annoyed that they are in no way interoperable with email and calendar standards.

Why is Tuta shitty?

here and here are two of my past comments about them with more links, but, tldr:

• their email encryption is not interoperable
• their encrypted email service encourages people to use a browser-based thing with an incoherent threat model: the server that the e2ee is supposed to protect you from is the same one that serves you the code each time, which means that it would trivial to subvert it on-demand for targeted users with a negligibly-small chance of anyone catching them in the act. this is an example of cryptographic snake oil.
  • note that whether (or how often) they actually do subvert their encryption for targeted users is unproven; it has been alleged in court testimony that they do, and that the entire service is in fact a honey pot for doing exactly this (see my other comments for a link about that), but the testimony is perhaps not the most credible. however, the fact that they have the ability to do this (and without much chance of being caught) is undeniable and obvious to experts while being very much not obvious to most of their users.
• they are incessant blog spammers, writing advertorials about every vaguely-privacy-related news event to promote their products
• and, a new item on the list (not particularly surprising, given their history of shameless hucksterism): their README claims a clear policy against AI contributions but if you click that link and scroll up and click the three dots next to the commit message ("test plugin kit and nextcloud plugin") you can see it says "Assisted-by: Claude:claude-sonnet-5". (This kind of dishonest bandwagon-jumping-on is very on-brand for tuta.)