When someone clicks a link on your page, or your page loads an image or script from elsewhere, the browser tells the other site where the request came from. That matters when your URLs contain something private, such as a password reset token, an invite code, a search term or an internal document id. The full address can end up in another company's logs and analytics.
Modern browsers default to strict-origin-when-cross-origin, which sends the full address only to your own site, sends just the domain to other sites, and sends nothing when moving from HTTPS to HTTP. That default is sensible, but older browsers behave differently and some templates set the far looser unsafe-url value, so it is worth stating the policy yourself.
Set strict-origin-when-cross-origin for the whole site, or no-referrer if you want to share nothing at all. More importantly, keep secrets out of URLs where you can, because the address is also stored in browser history and server logs, which this header does not affect.
Referrer-Policy: strict-origin-when-cross-origin