Files are pass-through uploaded from users to an S3 bucket and given a UUID name. That name is stored with the push data in Postgres and a GCM tickle is sent to their phone with a push_id to act on.

The app receives the tickle and makes a quick api call for the push data and sees it needs to get a file. It then asks for the file and I make sure they have permission to download it and then let them.

Over engineered? Maybe :)