About privacy, if you look at how web push notifications are implemented, it’s quite good for privacy since the push server only sees and opaque encrypted blob: the device has the per-subscription private key and the app server sending the notification the public key to encrypt. It’s true that the push server knows where you are getting notifications from though.