Good question. I use Google's Cloud Messaging to actually deliver the pushes but the data in a push is not plaintext, and the push sometimes doesn't even have the data at all (the GCM message is just a tickle). All interaction with PushBullet app servers is done by https. Overall, I don't think I've done anything stupid but I wouldn't trust PushBullet to anything you consider prudently private.