---
title: "Data on the device · Agent Wranglers"
url: https://agentwranglers.se/playbook/mobile-apps/data-on-the-device
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Data on the device

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Mobile apps](https://agentwranglers.se/playbook/mobile-apps.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

> Phones get lost, backed up and shared. Keep tokens in the system keystore, ship no secrets in the app, and sync offline changes without losing any.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/mobile-apps/data-on-the-device">Agent Wranglers mobile apps playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- MOB-19 [Keep tokens and keys in the Keychain or Keystore](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/keychain-keystore): Store session tokens, refresh tokens and keys only in the iOS Keychain or behind a key in the Android Keystore. Never in plain preferences, files or JavaScript storage.
- MOB-20 [Ship no secrets in the app package](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/no-secrets-in-app): The app package holds no secret keys, passwords or private certificates. Anything the app needs that must stay secret lives behind your own server.

## Recommended

- MOB-21 [Check that requests come from your app](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/app-attestation): Send an attestation token from App Attest or Play Integrity with calls that cost money or unlock content. The server refuses calls without a valid token.
- MOB-22 [Keep secrets out of device backups](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/backup-exclusions): Exclude tokens, keys and caches of personal data from cloud backups and device transfers. Keep what the person made, so a new phone restores it.
- MOB-23 [Keep personal data out of device logs](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/no-personal-data-in-device-logs): Release builds write no tokens, passwords or personal data to the system log or to log files. Debug logging is compiled out of release builds.
- MOB-24 [Encrypt local data that holds personal data](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/encrypted-local-data): Keep personal data only in the app's private storage, with the platform's file protection on. Encrypt databases of health, money or messages with a key from the Keystore or Keychain.
- MOB-25 [Wipe local data at sign-out](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/wipe-on-sign-out): Signing out removes the person's tokens, local database, caches and files from the phone. The next person to sign in sees none of it.
- MOB-26 [Queue offline changes and resolve conflicts on the server](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/offline-sync): Save changes made offline in a local queue and send them in order when the network returns. Each change carries an idempotency key and the version it was based on.

- Previous: [Updates and versions](https://agentwranglers.se/playbook/mobile-apps/updates-and-versions)
- Next: [Privacy declarations](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations)
- [All chapters](https://agentwranglers.se/playbook/mobile-apps)