What data is sent over to the Internet?

Hipchat Server sends the following data for push notifications to an Atlassian-managed service called barb.hipch.at, which is hosted on the Internet. 

Push notifications for 1-1 chat

• Sender username
• Chat message

Push notifications for @mention in rooms

• Sender username
• Receiver mention name
• Room name
• Chat message

Is the data sent to anyone other than Atlassian?

はい。

Hipchat Server runs a service called barb that sends push notifications from Hipchat Server to barb.hipch.at (hosted on the Internet), which relays to either APNS or GCM. These services deliver the push notification to iOS and Android mobile devices, respectively. We require an SSL connection between the Hipchat Server and barb.hipch.at to relay push notifications.

How can I prevent the server from sending message content to the Internet?

Hipchat Server (v1.3.7 and higher) has a feature called Scrubbed notifications that removes the content of messages from push notifications. This feature is off by default but can be enabled from the Group admin >> Preferences (Server admin >> Features prior to v1.4.0) screen in Hipchat Server's administrative web interface. 

Once enabled, @-mention and private message notifications sent to users when they are away will no longer contain message content, or any of the surrounding messages.

For more detail on Scrubbed Notifications, please see Administering Hipchat Server - Hide message previews on notifications.