This is expected system behavior. In-App message payloads are stored locally by the Mobile SDK once downloaded. Pausing or stopping the journey prevents new users from entering but does not revoke or delete content already cached on devices. There is no server-side recall mechanism for previously downloaded In-App messages.
Workarounds and mitigations:
1) Set an explicit expiration for In-App activities in Journey Builder to limit post-pause visibility.
2) For time-bound or sensitive content, use short expiration windows that align with offer validity.
3) If an offer must be revoked, publish a follow-up app release or configuration that prevents the in-app trigger from matching, or deploy a replacement In-App with immediate expiry to supersede cached content where applicable.
005386569

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.