On-Device Privacy and Zero-Knowledge Storage in Mobile Applications: A Review with Attention to Cross-Platform React Native Development

Abstract

Mobile applications hold the most intimate data that most people generate—messages, health signals, finances, locations, and journals—and the architectural question of where such data live in plaintext has become the defining privacy decision of app design. On-device privacy names one pole of the answer: data is processed, stored, and protected where it originates, and services are designed so that servers hold ciphertext they cannot read, an architecture popularly called zero-knowledge storage. This review synthesizes the research literature relevant to building such applications, with specific attention to the cross-platform reality in which much of the mobile ecosystem, prominently React Native applications, is actually built. It first fixes terminology, distinguishing the cryptographic meaning of zero knowledge from the architectural marketing usage, and organizes the threat models—curious servers, device compromise, network adversaries, and legal compulsion—against which designs are meaningfully compared. It then reviews the platform security foundations, hardware-backed keystores, trusted execution, biometric gating, and their documented limits; encrypted local storage, from key derivation through database encryption to searchable and oblivious techniques and their leakage trade-offs; end-to-end encrypted synchronization and the protocol lineage that made forward secrecy deployable; and on-device privacy-preserving computation, including local inference, differential privacy, and federated learning, with the attack literature that bounds their guarantees. The cross-platform layer receives dedicated treatment: the JavaScript runtime, bridge architecture, dependency supply chain, and the misuse findings of the mobile security measurement literature as they bear on React Native designs. The review closes with the recurring gaps—usable key recovery, metadata protection, and verification of zero-knowledge claims—and identifies directions for research and practice.