Nothing here is hidden from the chain. The deposits are just made impossible to tell apart.
Solana's ledger is public and this does not change that. What changes is whether the public record is useful to someone following your money: a pool of identical deposits turns a trail into a dead end.
Two random numbers — a nullifier and a secret — are drawn in your browser and hashed together with Poseidon into one commitment. Only the commitment reaches the chain. It becomes a leaf in a Merkle tree twenty levels deep, and the SOL joins a shared vault. The two numbers are your note and they stay on your machine.
Every deposit in a pool carries the same amount and a hash that discloses nothing. With four hundred deposits in, yours is one of four hundred identical entries. That count is the anonymity set and it is the entire quantity of privacy available. The cryptography guarantees the set is genuine; it cannot make it bigger.
A withdrawal is a Groth16 proof of one claim: I know the nullifier and secret behind some leaf of this tree. Secrets and Merkle path are private inputs; the root, a nullifier hash and a binding hash are the only public outputs. The word carrying the weight is some — a valid leaf exists and you hold its secrets, with no indication of which.
The contract verifies the pairing check on chain, confirms the root is recent, and creates an account keyed to the nullifier hash. A second attempt with the same note fails because that account exists. The hash derives from the nullifier alone, so it records that a note was spent without revealing which.
Recipient, relayer and fee are hashed and bound into the proof, so altering any of them breaks verification. A relayer can decline to send. It cannot redirect the money or take more than agreed.
Next: the costs, or how public Solana already is.