as long as push notifications are not encrypted, this is definitely a point that must be considered separately in the privacy policy. Even if you host your Rocket.Chat instance on your own servers to keep the data in-house, the push messages are sent by third parties and could be read here in plain text. Ultimately an unsatisfactory situation if you want to be the complete master of your data and therefore host it yourself.