IoT applications often utilize the cloud to store and provide ubiquitousaccess to collected data. This naturally facilitates data sharingwith third-party services and other users, but bears privacy risks,due to data breaches or unauthorized trades with user data. Toaddress these concerns, we present Pilatus, a data protection platformwhere the cloud stores only encrypted data, yet is still ableto process certain queries (e.g., range, sum). More importantly,Pilatus features a novel encrypted data sharing scheme based on reencryption,with revocation capabilities and in situ key-update. Oursolution includes a suite of novel techniques that enable efficientpartially homomorphic encryption, decryption, and sharing. Wepresent performance optimizations that render these cryptographictools practical for mobile platforms. We implement a prototypeof Pilatus and evaluate it thoroughly. Our optimizations achieve aperformance gain within one order of magnitude compared to stateof-the-art realizations; mobile devices can decrypt hundreds of datapoints in a few hundred milliseconds. Moreover, we discuss practicalconsiderations through two example mobile applications (Fitbitand Ava) that run Pilatus on real-world data.