Each relay peels one encryption layer and learns only its predecessor and successor, so no single relay sees both source and destination. Circuits typically cross three relays, and onion services keep traffic inside the network entirely.
The documented limits: an observer of both ends can correlate timing and volume, and exit traffic to the clearnet is readable at the exit unless separately encrypted. Application-level identifiers defeat the routing if reused.