Suppose we have an app that works for mobile phones. One of the things that make this app is to insert some critical information of an user in the last steps of shipment of a particular website that is not from the app creator. It fills adress, credit card and real name. After buying something in that website, app will not have any responsability of it because it only fills some info. In this particular case, and considering that is not probabily that an user uses his account from an other mobile/pc, is it a better idea to store this information in the DDBB where there's other user's infomation or to store it in his mobile phone as a "cookie" encrypted?
I think it's a better idea the second one because if someone attemps to catch all information of ddbb will have any credit card instead of one particular as in the second case but I would like to listen for more opinions.
In case of selecting the second one, which method should I do? App will be for android and maybe for iOs
