Local storage and sensitive data on the device
What goes where
Login tokens and keys belong in the operating system's secret store, not a config file and not simple key-value storage. Content data can sit in an encrypted local database.
Don't store passwords at all. Store a short-lived token with a refresh option.
Remote revocation
When a user reports a lost device, there must be a path that drops all their tokens. If the tokens have no expiry and no server-side record, there's no way to do it — and that's a decision made in design, not in a crisis.
What not to store at all
Full credit details, identity documents, and content the user has already deleted. And: don't write logs with personal information to files that stay on the device — they're collected in crash reports and reach places you didn't intend.
Going deeper
Encrypt the traffic and verify the server's identity. In apps handling sensitive information, consider a biometric lock for entry to certain screens, and automatic clearing of local data after a period of non-use.