Great question, from my understanding, notifications through private nextcloud or ntfy instances should be safe but I just started looking into this a month ago, so let’s wait for someone more knowledgeable to join in here.