How the mask is applied
A program asks for a mode when it creates something. touch asks for 666, read and write for everyone, and mkdir asks for 777. The kernel then clears every bit that's set in the umask. The Linux man page gives the example: 0666 with a umask of 022 makes 0644.
It's a bit operation, not subtraction. Each umask digit clears bits in the matching digit of the mode. A 2 clears write, a 4 clears read and a 1 clears execute, and clearing a bit that's already off changes nothing. Files never start out executable, whatever the umask, because the mode they ask for has no execute bit to begin with.
Common masks and what they leave
022: files 644, directories 755. Group and others can read but not write. This is the usual default.002: files 664, directories 775. The group can write too, so teammates can edit each other's files.027: files 640, directories 750. The group can read and others get nothing.077: files 600, directories 700. Owner only.
The CHMOD Configurator shows what any mode looks like in letters.
Where it comes from and how to change it
Every process has its own umask, and a child process inherits its parent's. Run umask to see the current value and umask 027 to change it for the current shell and anything it starts. Put the line in your shell's startup file to keep it.
Services are separate. systemd starts system services with 0022 unless the unit sets UMask=, so a service can create files with a different mode than your shell does. Two things override the mask. A directory with a default ACL ignores it and hands its ACL to new files. And a program can set permissions itself afterward with a chmod call.
umask and chmod +x
chmod +x with no letter honors the umask. A 644 file becomes 755 at umask 022, 754 at 027 and 744 at 077. With a letter, as in u+x, the umask isn't consulted and the result is 744. If a script ends up with surprising bits, check the umask before you check the chmod command.