Sign-out must clear local sensitive data
Aliases: token wipe · clear cache on log out · credential leftover
What it is
If tapping sign-out only swaps the UI to a login screen, tokens, ID numbers in drafts, WebView cookies, and downloaded statements remain on disk for the next user or the next app to read. Clearing local sensitive data means this device’s sign-out deletes session credentials and the identifiable caches and files written under that identity, which can be rebuilt only after signing in again. This entry is about whether sign-out’s side effects are clean. It is not about whether the button is findable, and not about whether a shared device should prompt you to tap it. Leakage when switching to another account is a separate isolation problem.
Why it happens
Apps store tokens and recent content locally to open in a second. If sign-out only flips an in-memory “current user” flag, a cold start still uses the refresh token on disk and signs back in silently; sign-out was an animation. Sensitive data is more than tokens: search history, message previews, autofilled forms, the cookie jar, app-group containers—all remain searchable by Spotlight or Files after a “signed-out” UI. Too-narrow cleanup (memory only) and too-wide cleanup (treating public read-only cache as sensitive) both fail. The bar is: a signed-out person picking up this device cannot read identifiable content from the last identity, and cannot re-enter the account without authenticating.
Studying it
Diff local storage before and after sign-out: keychain, databases, WebView, shared containers, downloads; then cold-start and see whether the app signs back in.
Independent variables: implementation (memory only, tokens gone but content kept, tokens and identity data both gone), whether “remember account” keeps a non-sensitive identifier only. Dependent variables: cold start still signed in, whether the previous user’s name or ID number is searchable on disk, whether WebView still carries a login cookie.
Automated tests belong at the release gate; lab interviews will not see disk residue. A login screen is not successful cleanup. Keeping “last used email” as a non-sensitive identifier is fine; keeping an avatar original that shows an identifiable scene, or unread message bodies, is not.
Where it stops holding
“Remember me” implemented as a long-lived refresh token is not sign-out—it is a longer session; a true sign-out must be able to turn it off. Offline drafts the user has not chosen to export need a prompt that they will be lost or should be exported first; the product cannot claim signed-out while leaving drafts in plaintext. OS notification extensions, watches, and car companion apps have their own stores; clearing the phone process is not enough. Enterprise sign-out may be forbidden by MDM from clearing some containers; copy should say what remains rather than pretend cleanliness.
Applying it
- On sign-out, revoke and delete local access/refresh tokens, and clear databases, cookies, and downloaded statements or ID images written by that identity; public read-only cache may stay.
- A non-sensitive last identifier (masked email or phone) may remain to prefill the next login; do not keep avatar thumbnails that still show an identifiable face.
- Companion surfaces (watch, widgets, notification extensions) must receive sign-out and clear their caches; if that fails, say on this device that other surfaces may still show content.
- Verify: after sign-out, kill the process and reopen—it should stay on login, and old tokens should fail authenticated APIs. System file search for the previous user’s name, order ids, or ID fields should miss. Opening a formerly signed-in page in the WebView should not remain signed in.