Vaults just connect and route messages. No relays. So your Vault tries to connect to the network. Other Vaults assign you an address in XOR and allow you to become part of their group. You can’t choose your own address or group. Several of these Vaults know your IP-address. That sounds like a weak spot but there’s a catch.
When you connect to the network as a client (wanting to browse websites, stores some data) you connect to a group of Vaults but through a relay_node. Think of it as a proxy. So the proxy knows your IP but can’t understand the data you exchange with the client_managers. And the client_managers see your request for chunk “XYZ” but they only know your XOR address.
Jump in this topic to learn more. And in this one. Also search the forum as there’s quite some info how this stuff works.