

Monero hides a great deal on-chain, but your wallet still has to talk to some node to sync and broadcast transactions. That connection is a privacy surface people forget about. The question is not just "which node," but "over what network," and the two answers together decide how much metadata you leak.
A remote node does not get your private keys and cannot spend your funds or read your balance the way a custodian could. But by virtue of serving your wallet, it can observe:
None of this breaks Monero's on-chain privacy, but it can attach you — your IP, your timing — to actions that are otherwise anonymous. That is exactly the identity-linkage layer that on-chain privacy does not cover.
Routing your wallet-to-node connection over Tor removes the single most useful piece of metadata: your IP. To a remote node over Tor, requests arrive from the Tor network, not from you. This matters most at broadcast time — the moment a transaction enters the network is the moment IP correlation is most valuable to an observer, and Tor severs it.
So the first, cheapest upgrade for most people is not "run your own node" — it is connect over Tor, whichever node you use. A trusted remote node reached over Tor already closes the biggest gap.
Running your own node adds two things on top of Tor:
The costs are real: disk space, initial sync time, and keeping the node updated and reachable — ideally itself over Tor. For high-stakes or high-frequency use, that overhead is easily worth it. For occasional use, a trusted remote node over Tor is a reasonable middle ground.
On-chain privacy and network privacy are separate problems. Monero handles the first; the node-plus-Tor choice handles the second. Getting the coins private but broadcasting from your home IP through a stranger's node undercuts the whole exercise. Pick the highest tier you can maintain, and at minimum, put Tor between your wallet and whatever node you use.