First of all, your application can basically die at any time, because it can be killed off by the Android scheduler after your app sits in the background for a while and the platform needs more memory.
That being said, storing your data in a global Application class is generally considered a bit hacky. Instead, the way you use this depends on how you are going to access the application. It's a pretty commonly accepted thing that a lot of apps keep things like their OAuth tokens in SharedPreferences (though I'm not sure exactly how kosher this is). What you might do is keep your session variable in an Application class, and then -- whenever the app dies -- simply reauthenticate. This is probably good practice anyway, as after that long someone may have picked up the phone, etc...
However, you seem to be under the impression that SharedPreferences can be read by anyone. This is incorrect, see this. Now, if you have a rooted phone, sure, then there's a way around that, but this is always going to be an issue, on a rooted phone you should basically consider that you don't really have any security at all...