The first question is whether the data needs to be on the device at all. Short-lived tokens refreshed from the server beat long-lived ones stored locally, and a cached profile blob is rarely worth the risk of storing personal data outside a container you control.
For what must persist, use hardware-backed keys. Generate keys in the Android Keystore with user-authentication requirements where appropriate, encrypt values before writing them, and never roll your own AES helper — the mode, IV handling and key rotation are where those go wrong.
Then close the leaks around storage: set android:allowBackup="false" or supply backup rules that exclude sensitive files, strip debug logging from release builds, mark sensitive screens FLAG_SECURE so they do not appear in the app switcher or screenshots, and wipe databases, caches and WebView data when the user logs out.
In short
- Plain SharedPreferences is world-readable to anyone with device access — treat it as public.
- Prefer Keystore-backed encryption; never hand-roll crypto helpers.
- Exclude sensitive files from auto-backup and cloud sync.
- Clear caches, cookies and WebView storage on logout, not just the token.