Is the PathProvider documents directory a secure location?

Question

Can anyone confirm that the documents directory file storage method with Flutter is secure or whether the AppData directory is where/how Android stores its Internal Storage files?

I'm looking at storing some persistent local data on the device but I want to make sure the data I write is not plain text or accessible by anyone/anything else. If this was a regular Android application, I'd be using Android's Internal Storage which says data stored is "private to your application and other applications cannot access them (nor can the user). When the user uninstalls your application, these files are removed."

Flutter has its own platform-agnostic way to read and write files and its documentation says saving things to its documents directory stores files "only it can access. The system clears the directory only when the app is deleted. On iOS, this corresponds to NSDocumentsDirectory. On Android, this is the AppData directory."

It looks like these are talking about the same thing and would therefore meet my security criteria, but these are things I'm not very familiar with and I don't want to take a risk with my users' data. I tried googling to find out what gets saved in the "AppData" directory on Android but mostly found people talking about their Android Studio installations.

Solution

Yes, NSDocumentDirectory on iOS and AppData on Android are secure locations.

This line from the example gives you the correct path for storing files which can only be accessed by your app:

String dir = (await PathProvider.getApplicationDocumentsDirectory()).path;

On Android dir resolves/data/data/com.yourcompany.AppName/. On iOS devices the folder is /var/mobile/Containers/Data/APP_ID/Documents.

Check the Android Security Tips , the section on Internal Storage:

By default, files that you create on internal storage are accessible only to your app. Android implements this protection, and it's sufficient for most applications.

The exception here is that when your app runs on a rooted Android device, the app data folder is not secure any more, see https://stackoverflow.com/a/8184699.

Comments

[Nithin Sai]

Hey, the data stored in this directory is getting deleted after updating. Any idea what to do?