Nothing is hidden from the chain. The deposits are simply made indistinguishable from one another.
Solana's ledger is fully public and TornadoSol does not change that. What it changes is whether the public record is useful: it turns a set of deposits into a set of lookalikes, so following the money runs out of road at the pool.
Your browser draws two random numbers — a nullifier and a secret — and hashes them into a single commitment with Poseidon. The commitment is all the chain receives. It is appended as a leaf to a Merkle tree twenty levels deep, and your SOL joins a shared vault. The two random numbers never leave the page; together they are your note.
Every deposit in a pool carries the same amount and a hash that discloses nothing. Four hundred deposits in, yours is one of four hundred indistinguishable entries. That count is the anonymity set, and it is the entire quantity of privacy on offer. Cryptography guarantees the set is genuine; it cannot make the set larger.
To take money out you build a Groth16 zero-knowledge proof of one claim: I know the nullifier and secret behind some leaf of this tree. Your secrets and your Merkle path are private inputs. Three values go public — the tree root, a nullifier hash, and a hash binding the recipient, relayer and fee. The word doing the work is some: the proof establishes that a valid leaf exists and that you hold its secrets, without indicating which.
The contract verifies the pairing check on chain, confirms the root is recent, and creates an account keyed to the nullifier hash. Presenting the same note again fails, because that account already exists. The nullifier hash derives from the nullifier alone, never the commitment, so it records that a note was spent without revealing which leaf it came from.
The recipient address, the relayer and the exact fee are hashed together and bound into the proof. Change any of them and verification fails. That is what makes it safe for a relayer to broadcast on your behalf — it cannot redirect the payment or inflate the fee, only decline to send.
More: the real costs, or how public Solana actually is.