The mint only creates tokens when prompted for. The token receiver has to provide a blinded message to “receive” the token on in order to make it work.

That does indeed mean that a mint can use metadata to trace. However that can be mitigated by privacy enhancing tools like Tor or a simple VPN.