Even better, honestly: a large bloom filter for the data, such that the likelihood of a collision is relatively low, then send it up to the server for a check. That way there are a small number of erroneous potential hits, but the list never needs to exist on-device.