Even the Smithsonian is foggy on mobile-app privacy