Local handset data is encrypted using platform secure enclaves; no plain‑text account details sit in caches. Push notifications contain only generic alerts, never sensitive content, so even a lock‑screen preview on public transit shows no information.