The entire website doesn’t work without JavaScript. It is super duper duper reliant on JavaScript and I don’t plan on changing that. The reason is that JavaScript lets you prevent cross site request forgery. Without it, I wouldn’t be able to tell if you actually made a request to send an email, delete an email, create an alias, etc, or if that request came from some website tricking you into clicking some malicious link/button. (To be more accurate, it is possible, but would be much harder and require managing a lot more state objects in the DB.) Also, without JS, you couldn’t have push notifications, and you’d have to refresh the page to see new email.

If you’re worried about trackers, there are none. The only things that are loaded from external domains are Google Fonts, Cloudflare Turnstile, and the Stripe payments script. The site would still work if you blocked all of those, except for the specific things they’re used for.