Update: Since this post, monostr got two changes that answer the main concerns raised here:
Your view key can stay with you (0.17). A personal watcher runs on a Raspberry Pi, a NAS or any small server. It needs no Monero node, no domain and no open port. It scans through public nodes, and a payment counts only when two independent nodes report it. Tutorial: https://monostr.com/watcher/personal/
Tip amounts are hidden by default (0.18). Receipts show that someone tipped, not how much. Showing amounts is opt-in.
Update: Since this post, monostr got two changes that answer the main concerns raised here:
If you'd rather run a full watcher with your own node, for yourself or for others: https://monostr.com/watcher/self-host/
Feedback welcome, here or on Nostr.