Sign out
Signing out of the mobile app does more than just hide the data — it deliberately scrubs the local session so the next person opening the app can’t pick up where you left off.
In this guide:
- Sign out from Settings
- What gets cleared
- What persists
Step 1: Sign out
Two ways:
- Settings tab → Sign out at the bottom of the page.
- Drawer → Profile footer → Sign out (right next to your avatar).
A confirmation dialog asks if you’re sure (this is a destructive-ish action — your session tokens are about to be deleted).
Tap Sign out.
What gets cleared
The app:
- Deletes the access token from
expo-secure-store(Keychain on iOS, Keystore on Android). - Clears the React Query cache (no stale data lingers).
- Clears Zustand stores (auth state, user info, network state, theme — wait, theme persists).
- Calls Hilal Auth’s logout endpoint, which invalidates the session server-side.
- Returns you to the sign-in screen.
What persists
- Theme preference (dark / light) — remains on the device.
- Notification permission — granted by the OS; not touched by sign-out.
- Saved notes / drafts in the backend — your account’s data isn’t touched (signing out doesn’t delete data; it just signs you out).
Sign out from one device but stay signed in elsewhere
The mobile sign-out only affects the current device. If you also have Hilal open on the web or another mobile device, those sessions continue. To sign out everywhere, use Hilal Auth’s “sign out of all devices” option on the web profile.
What if your phone is lost?
Sign out from Hilal Auth on the web → “Sign out of all devices.” This invalidates every session including the lost phone’s. Within seconds of the lost phone trying any API call, it’ll be redirected to sign-in.
For higher security, also enable biometric unlock on your phone (coming soon to the app, but the OS-level protection is already there).
Troubleshooting
- Sign-out dialog doesn’t appear. Force-quit and reopen, then try again.
- Stuck on “signing out…” Check the network. If offline, sign-out completes locally but doesn’t invalidate server-side until you’re back online.
- Bounced back to dashboard after sign-out. A token-refresh raced your sign-out. Force-quit, reopen, try again.