I don't think there is a solution as yet, but phones nowadays already have full disk encryption, i.e. the bits stored on the "disk" are garbled, and they have t

I don't think there is a solution as yet, but phones nowadays already have full disk encryption, i.e. the bits stored on the "disk" are garbled, and they have to be read through the decryption layer that transforms the gabled bytes to my_butt.jpg (And well, it also encrypts that image the IM app wants to save, before writing it to disk). The decryption layer gets initialized with a key during the boot process of the phone (after you've entered your password and unlocked the key) and remains active until the phone is shut down. One way of using the above would be to allow "logout" of the main user and login of an e.g. repair user, on logout the decryption key would be erased from memory, and this way the repair user has no access to my_butt.jpg . Actually Android already has the concept of multiple users, and each user has their own data storage, so the can open their own Facebook or Tinder and have the phone be loading their personal profile. Not sure about things stored on disk, though, and AFAIK if a user can be root then s/he can read all the files on the mounted encrypted disk. So, the repair user would not have access to my_butt.jpg, but maybe they need access to an installed app? I guess 1 solution would be to have apps installed on a separate partition to data. Android has a system partition (I'm not familiar with iOS), so if the repair user just needs internal apps, that should be accessible from the system partition.