Everything BookNest has stored so far sits in its private directory, which the per-app Linux user sandbox hides from other apps, but not from a rooted phone, a copied backup or a forensic image. A session token deserves encryption with a key the app itself can't leak.