Apple says "The actual website address is never shared with the safe browsing provider" but this feels a little like Meta saying "we never sell your private information." Technically true, but in a way that usefully redirects attention away from other behavior that an otherwise discerning user would not prefer.

Last time I looked at it you're only sending a hash prefix of the website address. You get back a list of sites matching that hash prefix. Works basically the same as the "Have I been pwned" API.