Anytime you use a computer of unknown provenance, you are at risk. It could have a hardware keylogger, a rootkit, or sketchy SSL certificates, etc. You really have no idea. It's best to do your sensitive work on machines you trust -- in this case I should think your friend trusts you.
You actually asked two questions though: should an app remove OR encrypt local user data?
Let's start with encryption. Yes, an application should encrypt data if it is considered sensitive enough. I personally doubt that chat logs are sensitive enough, but if a program is storing credit card numbers or SSNs, then it would be reckless and irresponsible not to encrypt that information. If you believe your chat logs are truly sensitive, then you are probably the type of person that should be using whole disk encryption (WDE).
Of course, when implementing encryption, you run the risk of muffing it up. If you do manage sensitive information, please use a well-known framework rather than writing that code yourself. For example, on OS X, you can use Keychain Services to store credit card numbers and social security numbers.
Now let's consider removal. One of the growing niches in security is privacy, and we're seeing more and more now that it's not acceptable to capture information about a user without that user's permission, especially if the information capture isn't obviously required to perform whatever tasks the application is supposed to do.
In client-server applications, there have been some obvious examples of failures in this regard, such as Path uploading all of your contacts. However, even storing user data on the client side can be a major privacy breach, as seen when Apple accidentally stored GPS tracking data on user's phones. Another example of this is malware that targets bitcoin files.
In the first two cases, the central issue seems to be the unexpected and indefensible collection of information that users did not expect them to be collecting. In Path's case, they should have never collected that data in the first place. In Apple's case, they have a valid use case for recording recent GPS data, but a bug resulted in those GPS logs not being truncated properly. Apple should have been more up-front about why iOS collects that data, and they should have tested that feature more to make sure it worked right.
The bitcoin example is slightly different: in that instance, the user clearly expects that data to be saved, but does not expect that his/her data can be stolen so easily. In this case, the application managing that data should have encrypted it. It was reckless to design digital currency management software and not build encryption into the design of it.
Your question is actually very insightful. As an industry, we're still not 100% sure what the answers are to some of these questions regarding privacy and security. I believe that over time we will see more and more attention placed on the issue of encrypting or removing data collected about users.
