I'm building a Mac app that syncs the user's documents down from a third-party cloud service. When you set it up, it will sync all your documents down to the local hard disc, at which point you can access it in Finder.
For the purpose of this question, you can imagine I'm building a third-party Dropbox client. I'm not, but it's a good enough approximation for this question. The key points are that I don't control the cloud service, and that the data is accessed through Finder once synced down.
Suppose, at a later point, the server rejects the OAuth token / saved password, and the user is unable to supply a password that works. After a certain number of attempts or a certain amount of time passing, should I delete all the synced documents to prevent misuse?
Scenario 1: An attacker guesses a user's password, and uses that to log in to the cloud service through my app and accesses the user's documents. The user comes to know and changes his password/revokes auth tokens. At this point, the user would want his documents to be deleted from the attacker's hard disc. Or if the user sells / gives away / lends his laptop to someone, forgetting to log out in my app, and he realises it later and changes his password/revokes auth tokens, he would again want the already synced documents to be deleted from the laptop's hard disc.
Scenario 2: A hacker takes over the account and locks the user out. Or the cloud provider makes a mistake and locks the user out of his account. Then the user would want a backup of his data on his local hard disc, as opposed to losing access to his precious data.
If I delete all existing synced documents, I've failed the user in scenario 2. If I don't delete all synced data, I've failed the user in scenario 1.
Is there a best practice for this? A general guideline on what clients to cloud services should do if the user can no longer log in?
Note that I can't keep the data on the Mac's hard disc but deny access, since the user accesses the data through Finder, not through my app. The choices are to delete or not delete the data.