Who sees what
The five parties that learn something when you act, including the ones you did not choose.
This is the page the rest of the product is organised around. Every surface names the relevant parties before you act; this is the whole list in one place.
Reading it
"Private" is relative to a named party, never absolute. Your counterparty sees you — that is what makes them your counterparty. The relayer sees your IP. Everyone sees deposit amounts. The auditor sees more than any of them.
The point is not that this list is short. It is that it exists, and that no screen in the app asks you to act without showing you the part of it that applies.
What the pool actually hides
Deposits are public: an observer sees the depositor and the amount. What the pool hides is which notes are yours afterwards — the link between the money going in and the money moving later.
So the honest one-line summary of the whole system is: amounts are often public, identity usually is not, and the exceptions are named on the screen where they apply.
Per-action detail
The app carries a machine-readable visibility matrix — four actors by five facts (amount, sender, recipient, timing, IP) — and renders it inside the disclosure panel for the specific action you are about to take, plus on the receipt afterwards. That per-action grid is a different question from this page: this one is who are these parties, that one is for this transaction, what does each one learn.