For Mastodon, each mobile app developer needs to have a "webpush relay server" to receive Mastodon's webpush notifications and transmit them to the platform's push service. For Android, Mastodon recently added support for the latest webpush standard which allows the app developer to directly register Google's webpush endpoint with Mastodon, removing the need for a relay. In all cases, push notifications are encrypted by the Mastodon server, and decrypted by the Mastodon client, so any intermediaries (relay server, push notification service) can not read their content.