It is safe. XMR.TO is very well established in the community and nobody can link your XMR wallet to your BTC address.
It is not like exchanging BTC with ETH through an exchange where everyone is capable of linking every address to a wallet and every wallet to a real person, since Monero's blockchain is obfuscated. Senders are protected through Ring Signatures where 10 different people sign a transaction with you and make you anonymous within a group of signers.
I am playing with a few exchangers lately to see how fast they are, the fees and trying to gain some knowledge about the privacy aspects.
From what I know, exchangers are able to link your wallets together, for example if you do BTC -> XMR, they know that the BTC wallet and the XMR wallet where the XMRs go to, belong together.
How is it with xmr.to though? If I send XMR to xmr.to and receive BTC, will xmr keep track of any logs etc. that makes the linkability of the xmr and btc wallet possible (in case you obviously have access to the servers, the logs, and what not)?
Or is xmr.to different and they won't store anything that makes the linkability possible?
turned off scripts completely and used the xmr.to onion address and yet, every time my secret url refreshes (which is every 10 seconds or so), it also requests a googleapis.com url for some reason.
This leaks my secret url to google as an http-referer, and therefore actually leaks my transaction details too!