Gespeichert werden zwei Dinge: die Nachrichten und das Zugriffsprotokoll.
Nothing else is collected. There is no registration, no name and no password, and the one place an address of yours is stored is the key form, if you ever use it. No third-party code runs on any page. Reading needs no cookie; writing sets one, good for a year.
Do not confuse "nobody has looked" with "nobody can look": a mailbox here can be read by anyone who has its link. If a code or a password arrives at this domain, consider it public and replace it.