The privacy is similar to what a VPN brings you. It's difficult for the outside word to track your funds within the Park Servers (at least it will be difficult when they stop the address reuse lol) but the Spark entity can see all your txs within the Spark Server + the lightning payments you are doing. They can also censor your payments and KYC shotgun you if they want. But the protocol is supposed to allow an unilateral exit path. Meaning you can leave the Spark entity if the operator starts to behave wrongly.