Purchase entitlements survive app reinstall and device transfer

Users who reinstall an app or transfer to a new device lose any premium state stored only in local storage (AsyncStorage, SharedPreferences, UserDefaults, MMKV). CWE-311 (Missing Encryption of Sensitive Data) is a related vector — but the core failure here is data-integrity: the entitlement record does not survive the lifecycle events it must. The business consequence is straightforward: paying users who lose their subscription after a reinstall file chargebacks directly with their bank or credit card company, which harms the developer's payment standing. They also leave negative reviews and generate disproportionate support volume. ISO/IEC 25010 reliability requirements apply — a subscription entitlement is a durable system state that must survive device lifecycle events.

Call the platform entitlement refresh on every app startup — not only after a purchase. Never rely solely on a local flag that gets wiped on reinstall.

// App.tsx or your app initialization hook
useEffect(() => {
  const restoreEntitlements = async () => {
    if (isLoggedIn) {
      const customerInfo = await Purchases.getCustomerInfo();
      setIsPremium(customerInfo.entitlements.active['premium'] !== undefined);
    }
  };
  restoreEntitlements();
}, [isLoggedIn]);

For server-based entitlements, fetch subscription status from your backend (GET /api/user/subscription or equivalent) at login and on app-foreground events. Store the result in memory or a local cache that is treated as derived, not authoritative — the server or platform SDK is the source of truth.