I haven't had any issues with tracking (that I'm aware of, anyway) and their privacy policy is pretty straightforward (email storage is opt-in, they don't share data with third parties except law enforcement and what they need to process payments). I suppose one could argue that you have to take them at their word, but that's true of anything.

It's hosted out of the Netherlands, which I believe has pretty strong privacy protections, though the developer is from the UK which fares marginally worse in that regard (again, grain of salt with my opinions here).

I'll confess I'm also not a technical expert in email systems, but you can use your own PGP keys for what that's worth, and if you're super concerned you can always download their server runtime and self-host it as well.

I probably wouldn't use it for my bank, mostly because it's another moving piece that could break, but that's why I combine it with Tuta - I can have a "real" address for my bank, another one for my doctor, and a few others for anything that might reject an Addy address (and that I can't live without), and then Addy for everything else.