Antispam

Configuration

Open the extension options page to configure backend connectivity and general behavior.

API settings

API URL
- Storage key: api_endpoint_url
- Values: URL
- Description: Base URL of the modern API backend.
- Example: https://antispam.example.com/api

API Token
- Storage key: api_token
- Values: string
- Description: Authentication token used for API access. When set, requests send:
Authorization: Bearer <token>

New integrations should use API mode.

Webservice settings (legacy, deprecated)

Legacy webservice support is deprecated and will be removed in a future version.

It exists only for backward compatibility with older deployments.

New integrations should use the API backend.

Webservice URL
- Storage key: webservice_endpoint_url
- Values: URL
- Description: Legacy webservice endpoint URL. Requests are sent with:
?ws=antispam

Webservice Token
- Storage key: webservice_token
- Values: string
- Description: Legacy token sent as a form field named:
token

General settings

Backend Type
- Storage key: backend_type
- Values: api, webservice
- Default: webservice
- Description: Selects whether backend calls use the modern API or deprecated legacy webservice compatibility mode. Prefer api.

Refresh popup window when changing the displayed email
- Storage key: reload_popup
- Values: 1 = yes, 0 = no
- Default: 1
- Description: When enabled, an already opened popup is refreshed for the newly displayed message.

Automatic email info loading
- Storage key: auto_email_info_loading
- Values: 1 = yes, 0 = no
- Default: 1
- Description: When enabled, email info is automatically preloaded when messages are displayed. When disabled, no background preload runs; info is loaded only when explicitly requested, for example when opening the popup.

Focus popup window when refreshing it
- Storage key: popup_focused
- Values: 1 = yes, 0 = no
- Default: 1
- Description: When enabled, the refreshed popup window is focused.

Popup preferences

The popup also stores user convenience choices.
Quick move folders
- Storage key: quick_move_folders
- Description: List of folder IDs shown as quick move choices in the popup.

Last selected move folder
- Storage key: antispam_move_folder_id
- Description: Last selected move target, stored via browser.storage.local.

API endpoints

The extension currently uses only JSON POST requests for backend API integration.
No backend GET endpoints are used by the current implementation.
All API requests use the configured API URL as the base URL.

If api_token is configured, requests include:

Authorization: Bearer <api_token>
Accept: application/json
Content-Type: application/json

Responses are expected to be JSON.
The extension treats a response with status: "OK" as successful and reads payload data from data.
Error responses are expected to provide msg.

POST /antispam/maildata

Purpose: Store email metadata in the Antispam backend.
Used for: The popup action that sends the currently displayed message metadata to the backend.
Request body:

{ "maildata": { "...": "extracted message metadata" } }

Expected response:

{ "status": "OK", "data": {} }

Failure response:

{ "status": "ERROR", "msg": "Error message" }

POST /antispam/maildata/check

Purpose: Check extracted email metadata against Antispam rules.
Used for: Automatic message-display preload and popup-triggered on-demand loading of email info.
Request body:

{ "maildata": { "...": "extracted message metadata" } }

Expected response:

{ "status": "OK", "data": { "msg": "Result message", "count": 0, "count_enabled": 0, "rules": [] } }

Rule objects in data.rules are expected to include at least:
rule_id
pattern
enabled

POST /antispam/rules

Purpose: Create or update an Antispam rule.
Used for: Popup rule actions for sender email, sender domain, reply-to, recipient, and related extracted values.
Request body:

{ "type": "sender_domain", "pattern": "example.com" }

Expected response:

{ "status": "OK", "data": {} }

Added privacy opt-in for remote email data processing and added Privacy Policy.

Antispam Thunderbird Add-on Privacy Policy
=========================================

This Privacy Policy applies specifically to the Antispam Thunderbird add-on.
It is not a general website privacy policy.

Data the add-on reads locally
-----------------------------

The add-on can read the currently displayed Thunderbird message and extract
metadata needed for spam/ham analysis and Antispam rules:

- sender email address;
- recipient email addresses;
- Reply-To email addresses;
- sender, recipient and Reply-To domains/subdomains derived from those email
addresses;
- IP addresses extracted from the message Received headers;
- rule type and rule pattern when the user creates an Antispam rule.

The current implementation does not send the message subject, full email body,
selected body text, attachments or full message headers to the remote Antispam
API. It only sends the extracted fields listed above. Standard HTTP request
metadata, such as request time, IP address, user agent and the configured
backend URL, may be visible to the remote server automatically as part of the
HTTP request.

When data is sent
-----------------

The add-on sends email metadata only after the user explicitly enables the
Privacy & Data Processing consent checkbox in the add-on settings. The checkbox
is off by default.

When consent is enabled, data may be sent when:

- Thunderbird displays a message and automatic email info loading is enabled;
- the popup explicitly requests Antispam information for the displayed message;
- the user sends message metadata to the Antispam backend;
- the user creates or updates an Antispam rule.

When consent is disabled, the add-on does not send email data to a remote
server. It returns a local error message instead of calling the API or legacy
webservice.

Destination server or service
-----------------------------

The destination is configured by the user in the add-on settings:

- API mode sends JSON POST requests to the configured API URL.
- Legacy webservice mode sends POST form-data requests to the configured
webservice URL with the antispam service parameter.

The configured API token or legacy webservice token is sent only as needed for
communication with that configured backend.

Purpose of processing
---------------------

The data is used only for spam/ham analysis of email messages and for creating
or updating Antispam rules requested by the user.

Storage and retention
---------------------

The add-on stores its settings locally in Thunderbird. This includes backend
URLs, tokens, general settings and the consent setting.

The add-on may cache Antispam analysis results in Thunderbird session storage
for the current session. This local session cache is used to avoid repeating the
same check for the same displayed message during the session.

Remote storage and retention depend on the configured Antispam server. The
add-on cannot determine or control how long a third-party or self-hosted
backend stores submitted data unless that backend documents it separately.

Sharing with third parties
--------------------------

The add-on does not share email data with any third party other than the
configured Antispam backend selected by the user. If the configured backend is
operated by another organization, that backend operator receives the submitted
data.

User control
------------

The user can disable consent at any time in the add-on settings. After consent
is disabled, the add-on does not send email data to a remote server.

Website detectability
---------------------

The add-on does not inject content scripts into ordinary web pages and does not
notify websites that it is installed. Websites are not given an add-on-specific
signal by this implementation. The configured Antispam backend can of course
observe HTTP requests that the add-on sends to it when consent is enabled.

Doplňky

Vítejte na serveru Doplňky pro Thunderbird.

Na cestách?

Antispam 1.22

od Platon Technologies

O doplňku

Informace o verzi

Verze 1.22 Vydáno dne Čer. 2, 2026 123.4 KiB Podporuje Thunderbird 128.0 a novější