As you said, there’s still metadata. For example, if they requested a new token every time you used one. Technically the token itself is still zero knowledge, but now the issuer knows when you use it.