I would turn this argument around on itself and say, yes,
of course I have things to hide, but none of those things need to hidden from 1) authorities conducting legitimate searches; 2) mass surveillance programs that are looking for terrorists; 3) advertising trackers; 4) and so on.
You're absolutely right that who and what matter here, but I find the typical who and the typical what to be entirely unobjectionable.
It's telling that the best arguments the privacy activists have are all slippery slope arguments. Of course it's easy to think of hypothetical policies to which I'd object; the point is that I don't object to any of the actually-existing programs as currently constructed. If Gmail wants to scan my mail, I don't care. If the NSA wants to drop in on my phone calls every once in a while to see if I'm affiliated with ISIS, that's fine with me. If Facebook wants to keep a log of my activity on the site to better target ads, then they should go for it.
The only way to get me to agree that a policy is odious is for you to make up some hypothetical policy that doesn't exist and say, "but what if that happened?!!" And I just don't find that very compelling.
In summary, you're absolutely right that, "nothing to hide is an incomplete sentence." The complete sentence is this: I have nothing to hide from any of the people currently looking in any of the places they're looking.