[illiac786]

As far as I know you can also have an encrypted payload in the notification, which only the app can decrypt.

I'm not sure that payload can be decrypted by an app without unlocking the phone or launching the app though.