Push notifications are disabled by default, and users can choose to run their own monitoring server (FOSS software GroundControl) if they want notifications without relying on BlueWallet
From @nvcoelho: “The data used in this feature is all public addresses. No xpubs are monitored.”