It’s locked to the pubkey of the recipient; once you send the zap you can’t spend it anymore; only the recipient can.