Excellent set up, and in fact exactly what I’m using / how I’m set up. In addition for a few IOT type sensors and things like thermostats around my house, I have another vlan as well as a dedicated SSID tagged for that vlan, that only allows Internet access and everything else is dropped for that vlan. (Ie a firewall rule on the forward chain that drops anything in on that IOT vlan, that has a destination address of the private ip ranges: ie dst= 10.x or 192.168.x or 172…. anything locally that needs to access those sensors does so through the cloud/Internet, and for the one or two device devices that need to access them locally I have a fw rule allowing just that devices IP

A fully isolated setup can certainly provide good privacy. A key benefit of Privastead is that it can send the videos to your smartphone remotely using a strong (MLS-based) end-to-end encryption.

Privastead does not currently send thumbnails as part of the notifications. Performing proper end-to-end encryption on data in push notifications is a bit tricky and I haven't solved that yet. I do have some ideas on how to make that happen though. Once I do, I plan to add thumbnails to push notifications as well.

And thanks for the pointer on Pushover. I'll check it out to see if it can be a replacement for Google FCM.