that's why setup tells you to use a separate wallet just for tips and offers to create a fresh one right there. The watcher sees every incoming payment to that wallet (!) and the receipt makes amount + recipient public by design (that's what makes tips visible under notes, like zaps). Senders can stay anonymous; amounts can't. If you want zero exposure, run your own watcher.