A confidential message can stay encrypted inside a conversation and still disclose its contents through a notification. The preview on a locked phone is the obvious example. The less visible question is what the application sent to the push-delivery service before the phone displayed it.
That distinction matters to a person discussing a medical appointment, a commercial negotiation or a family emergency. They chose a private conversation. They did not necessarily choose to distribute its first sentence through a second delivery system. A useful security assessment follows that sentence, rather than stopping at the messaging application’s encryption badge.
Follow the preview separately from the conversation
Google’s Firebase Cloud Messaging encryption documentation distinguishes encrypted transport from application-level end-to-end protection. FCM does not supply the latter automatically. Its guidance describes protecting sensitive data in application code and explains why ordinary notification payloads differ from encrypted data messages that an application processes.
The accompanying message-type documentation separates notification messages from data messages. For a privacy review, that creates a concrete engineering question: is the preview delivered as readable notification content, constructed locally after decryption, or replaced with a generic alert?
These are statements about Firebase’s documented interface, not findings about every application that uses it. A delivery dependency alone does not establish that a particular provider receives readable conversations. That conclusion requires evidence about the application’s actual payload and implementation.
Two different disclosures
Consider an invented example. A solicitor sends a client the words “The settlement offer is attached.” The conversation may have a sound encryption protocol. If the phone displays those words on a conference-room table, someone nearby can learn about the negotiation without defeating that protocol.
Now change the setting so that the locked phone displays only “New message.” That reduces the disclosure to nearby observers. It does not, by itself, establish what a remote delivery service received. Conversely, an encrypted push payload does not stop a phone from displaying the decrypted text after receipt. Display policy and delivery confidentiality are separate controls.
This is why a screenshot of a notification setting is incomplete evidence for a transport claim. It demonstrates a user-interface choice. A network capture from an authorised test environment answers a different question. Neither should be presented as proof of the other.
A harmless test for an ordinary user
Use two accounts you control and a made-up sentence. Send the sentence while the receiving phone is locked. Repeat with the application open, then with preview settings changed. If a paired watch or desktop receives the notification, include it in the test. Record the operating-system version and application version, because behaviour can change.
This exercise reveals where readable previews appear. It cannot establish everything inside the push infrastructure. Do not send genuine client information as a test marker or collect traffic from other people’s devices. The point is to discover your own workflow’s disclosure, not create another one.
The engineering review
For developers, the next step is a data-flow diagram with the message body, push payload and rendered preview drawn as separate objects. List which component creates each object and which component can read it. Include logging and error handling: a protected payload can still be mishandled if an application writes the decrypted preview into a diagnostic record.
A generic wake-up notification can reduce content sent through a delivery channel, but its operational cost should be measured. Offline behaviour, battery constraints and notification delays affect whether users keep the privacy setting enabled. A design that fails silently may push people back toward a less private workflow.
The strongest documentation pairs a precise claim with a reproducible test. “No message text in this push payload” is a narrower and more useful result than “notifications are secure.” It still leaves timing and routing metadata to examine. Do not turn the narrower result into a promise of anonymity.
What this asks of UseCrypt
The UseCrypt evidence register separates assessments by date and scope. Notification handling deserves that same discipline. Historical evidence about file protection or an earlier application version cannot answer how today’s notification preview is assembled.
For Paweł Makowski’s Bringing Privacy Back mission, the practical demand is straightforward: make the boundary understandable to the person relying on it. Explain where the readable preview exists, provide an appropriate control, and document the behaviour of the specific release. Privacy should survive the moment the phone lights up.
