docs(privacy): disclose the BTCMap layer and how zaps identify you

- BTCMap (the Bitcoin-places map layer) sees your IP and the area you're viewing.
- Zaps are public by default: they tie your account/lightning address to the post
  and the tip; notes that a wallet can send them anonymously.

src/pages/PrivacyPage.tsx

@@ -119,7 +119,12 @@ export default function PrivacyPage() {
               you drop a pin on your own driveway.
             </Caveat>
             <Caveat><strong className="text-white">Reviews, comments, and your public profile</strong> (name, picture).</Caveat>
-            <Caveat>Who you follow, and public reactions/zaps.</Caveat>
+            <Caveat>Who you follow, and public reactions.</Caveat>
+            <Caveat>
+              <strong className="text-white">Zaps</strong> are public by default: a zap ties your
+              account — often your lightning address — to the post you paid and to the tip itself.
+              Your wallet can send it anonymously if you'd rather it didn't.
+            </Caveat>
             <p className="text-xs text-gray-500">
               A VPN or Tor does <strong>not</strong> hide the content of what you publish — a spot's
               coordinates are public regardless. Privacy tools hide your network identity (your IP),
@@ -143,6 +148,7 @@ export default function PrivacyPage() {
             </p>
             <ul className="list-disc pl-5 space-y-1 text-gray-400">
               <li><strong className="text-white">Map tiles</strong> (OpenStreetMap) — see your IP and which area of the map you look at.</li>
+              <li><strong className="text-white">Bitcoin places</strong> (BTCMap, when you switch that layer on) — see your IP and the area you're viewing.</li>
               <li><strong className="text-white">Nostr relays</strong> — see your IP when the app reads or publishes.</li>
               <li><strong className="text-white">Cashu mints</strong> — see your IP whenever your wallet sends, receives or melts.</li>
               <li><strong className="text-white">Directions</strong> (OSRM, and Transitous for transit) — receive the start and end of any route you ask for, not only your IP.</li>