I personally don't believe anything is privacy-first unless it is open source do that it can be self-hosted.
Obviously can't speak to the back-end since it's not open source so there's no way to know what metadata it's recording, but there's no email verification required so as long as you can remember your login details, it won't necessarily link back to you - pending IP addresses etc.