---
title: "Give widgets and watch apps only the data · Agent Wranglers"
url: https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/widget-and-watch-data
id: MOB-39
level: Recommended
updated: 2026-10-22
tokens: 1147
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Give widgets and watch apps only the data they show

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Data on the device](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: MOB-39
- Level: Recommended
- Chapter: [Data on the device](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device.md)
- Rule: Share with widgets, watch apps and other extensions only the fields they display, and never a token. Clear that shared data at sign-out.
- Check: After sign-in on a test device, read the App Group container and the widget's stored state. They hold no token and no field outside the widget's list. After sign-out, every widget shows its signed-out view within 1 minute.
- How: Widgets and watch apps run apart from the main app, so data reaches them through a shared store. On iOS that is an App Group container, and copying the whole session there is a common mistake. Widgets also show on the lock screen and the watch face, where anyone holding the device can read them. Write a small snapshot with only the values on screen. Mark private values with `privacySensitive()` on iOS, so the lock screen hides them. If an extension must call your API, give it its own read-only token in the Keychain, never the main refresh token. Send watch data over the platform channel, such as WatchConnectivity or the Wear OS Data Layer. At sign-out, delete the snapshot and reload every widget, as part of [wipe local data at sign-out](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/wipe-on-sign-out.md). Tokens stay where [keep tokens and keys in the Keychain or Keystore](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/keychain-keystore.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Plain text example

```swift
struct WidgetSnapshot: Codable { let stepsToday: Int; let goal: Int }

func publishSnapshot(_ snapshot: WidgetSnapshot) throws {
    let shared = UserDefaults(suiteName: "group.com.example.fittrack")
    shared?.set(try JSONEncoder().encode(snapshot), forKey: "widget")
    WidgetCenter.shared.reloadAllTimelines()
}

func clearSnapshot() {
    UserDefaults(suiteName: "group.com.example.fittrack")?.removeObject(forKey: "widget")
    WidgetCenter.shared.reloadAllTimelines()
}
```

### Kotlin example

```kotlin
data class WidgetSnapshot(val stepsToday: Int, val goal: Int)

suspend fun publishSnapshot(context: Context, snapshot: WidgetSnapshot) {
    context.getSharedPreferences("widget", Context.MODE_PRIVATE).edit()
        .putInt("stepsToday", snapshot.stepsToday).putInt("goal", snapshot.goal).apply()
    StepsWidget().updateAll(context)
}

suspend fun clearSnapshot(context: Context) {
    context.getSharedPreferences("widget", Context.MODE_PRIVATE).edit().clear().apply()
    StepsWidget().updateAll(context)
}
```

## Sources

- [Apple, creating a widget extension](https://developer.apple.com/documentation/widgetkit/creating-a-widget-extension)
- [Apple, privacySensitive](https://developer.apple.com/documentation/swiftui/view/privacysensitive%28_%3A%29)
- [Android, app widgets overview](https://developer.android.com/develop/ui/views/appwidgets/overview)

## Related rules

- MOB-25 [Wipe local data at sign-out](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/wipe-on-sign-out.md) in Mobile apps
- MOB-19 [Keep tokens and keys in the Keychain or Keystore](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/keychain-keystore.md) in Mobile apps

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/widget-and-watch-data">Agent Wranglers mobile apps playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Wipe local data at sign-out](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/wipe-on-sign-out.md)
- Next: [Queue offline changes and resolve conflicts on the server](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/offline-sync.md)
- [Data on the device](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device.md)