We are looking to implement push notifications for things like when a user receives an internal message within our app. We have an application with sensitive data so we have a short length inactivity timeout of around 15 minutes. We are using firebase cloud-messaging, but are curious as to how store and manage the firebase token. Should we delete it on logout? If we do, then we obviously we won't be able to send push notifications to logged out users. I am curious if this is a normal approach, to only send push notifications to logged in users? As in our case this would have little benefit from a feature perspective as you would only be able to receive push notifications if logged into the app, which for a typical user would only be a few minutes at a time.