iirc the mint can see your ip address and lightning payments received of course, but cannot tie any amount to any particular token because the mint is blinded. If you make a lightning payment to someone outside of the mint (as opposed to trading the ecash token itself - most private way to use it) the mint can see the invoice amount and the receiver as well.

So if the mint receives a specific lightning payment for X amount and immediately after the mint is being asked to exchange some ecash to make a lightning payment for ~X amount it is very likely the same person. That's why it's best to stay awhile (to put as many transactions that could've been you in between your deposit and withdrawal) and not withdraw a similar amount that you deposited (need to use tor or a good vpn too)