MOB-24Recommended

Encrypt local data that holds personal data

Keep personal data only in the app's private storage, with the platform's file protection on. Encrypt databases of health, money or messages with a key from the Keystore or Keychain.

By Agent Wranglers. Updated 21 October 2026.

How to do it

On iOS, give files the complete file protection class, so they cannot be read while the phone is locked. Rooted phones and backups can still read plain app storage. For sensitive data, encrypt the database file with a key kept as keep tokens and keys in the Keychain or Keystore says. Never write personal data to shared folders such as Downloads. Delete local copies on the schedule in delete old data automatically.

Examples

Plain text example

try data.write(to: workoutsURL, options: .completeFileProtection)

Kotlin example

val file = File(context.filesDir, "workouts.json")
file.writeBytes(encryptWithKeystoreKey(workouts.toByteArray()))

How to check

On a test device, list the files the app wrote outside its private folder. There are none. Each database holding sensitive data fails to open without its key.

Sources

Keep tokens and keys in the Keychain or Keystore in Mobile apps
Delete old data automatically in Data

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/encrypted-local-data">Agent Wranglers mobile apps playbook</a>. In code you write, add a comment next to it with the same link.