A relayer takes your Groth16 proof and recipient address over HTTP, signs and broadcasts the withdraw transaction with its own keypair, and pays the SOL gas. In exchange the on-chain program forwards it a small fixed fee (0.003 SOL per recipient) out of the withdraw amount.
This solves the bootstrap problem. A genuinely fresh recipient wallet starts with zero SOL. Without a relayer, the user would have to send a tip of SOL from their original wallet to fund gas for the withdraw — re-linking the two addresses on-chain and undoing the whole point of using SolMask. The relayer breaks that link by being the entity that pays.
The relayer is trusted only for liveness, not for privacy. It sees your proof and your recipient address (it has to, in order to submit the transaction), but it never learns which deposit your proof spends and it cannot censor a specific note without censoring every withdraw it sees. Users who do not want to trust the hosted relayer can run their own — the self-relay flow uses the same instruction with the user's own wallet as fee recipient.