Removing a push relay changes who participates in delivery; it does not make routing metadata disappear.
Android notification privacy depends on more than whether the chat itself is encrypted. A push service can route a notification without receiving readable chat text, yet it still participates in delivery. A direct connection removes that particular intermediary but does not erase metadata from the messenger’s server or the network.
The useful comparison is therefore not “FCM leaks everything; sockets hide everything.” It is: what data reaches each party, how reliably does the chosen design work in the background, and what can the user verify?
What FCM transports
Firebase Cloud Messaging distinguishes notification messages, which can be displayed by the platform, from data messages handled by application code. The payload may contain readable notification text, encrypted data, or a minimal signal telling the app to fetch updates. Those designs have different privacy consequences. FCM message types.
Firebase documents TLS protection between the sending server, FCM and the device, but says FCM does not supply application-level E2EE automatically. Sensitive payloads require appropriate protection above the transport layer. In a private messenger, that protection must preserve the messenger’s intended endpoint boundary; encrypting data at a server that already knows the plaintext is a different trust model. FCM encryption guidance.
What routing identifiers do—and do not—prove
A targeted push needs an identifier for the relevant app instance. This is not the same thing as a permanent, universal identifier for a person. Registrations can change or expire; current Firebase guidance covers installation-based registrations as well as legacy tokens. Registration-management documentation.
A push provider necessarily participates in handling requests and delivery. That creates metadata considerations, but the exact retention, account linkage and visibility require documentation or measurement. Do not infer that a generic “new message” notification automatically reveals the human sender, recipient and entire social graph.
Timing correlation can be a threat-model concern, especially when an observer sees multiple relevant traffic streams. Its accuracy depends on available observations, batching, background activity and other factors. “Can provide a signal” is not equivalent to “easily reconstructs every conversation.”
FCM and direct sync compared
| Design question | Push through FCM | Direct background sync |
|---|---|---|
| Is a third-party push relay involved? | Yes | Not for that direct connection |
| Can readable chat text be excluded from that relay? | Yes, with a suitable payload design | The messenger still needs appropriate E2EE |
| Does the app server observe connection or delivery data? | Often; depends on architecture | Yes, it directly serves the client |
| Is instant delivery guaranteed? | No | No |
| What needs testing? | Payload content, token lifecycle, delays and fallback | OS restrictions, reconnect behavior, battery cost and delays |
Direct polling or sockets can reduce reliance on a push provider. They do not create automatic anonymity or prevent the operating system, network or app’s own infrastructure from observing all relevant events.
Why WorkManager is not an instant-message transport
Android restricts background work to manage resources. WorkManager schedules persistent work within those constraints; naming it in an architecture does not mean a connection will remain continuously active or every message will arrive immediately. Manufacturer settings, battery restrictions and app state matter. Android background-work restrictions.
Disabling power restrictions may change reliability and battery use, but do not apply broad exemptions blindly. Test the app’s supported mode on the actual device. Removing Google components does not automatically teach apps how to use a new delivery mechanism; some functionality may stop working.
What Livara says about notifications
Livara’s security documentation says encrypted-message push notifications contain no message details or names. It also says the service stores operational metadata and push tokens. These are product claims, not evidence that Livara is FCM-free or that delivery metadata is hidden from every intermediary.
The public documentation should be read alongside the threat model. This article does not claim a tested direct-sync option, measured battery advantage or particular log-retention policy where none has been demonstrated.
A practical notification check
Use a harmless test message. Compare what appears when the phone is unlocked, locked, offline and later reconnected. Check linked-device previews and apps with notification access separately. A lock-screen setting controls local display; it does not necessarily change the server-side push payload.
For developers, inspect test payloads and record only the minimum diagnostic data. Measure delivery under realistic battery and connectivity states, and document what “sent,” “accepted,” “delivered” and “displayed” each mean. Privacy and reliability both improve when those boundaries are explicit.
