The sender automatically generates a one-time stealth address from the receivers public address, that only they both know, that is used once to receive for that transaction and never used again. No third party knows the address if they're simply looking at the blockchain and the recievers public address, and the sender doesn't know what happens with it after either.