Does Android locally encrypt your fingerprint? I got myself a Nexus 6P with a fancy fingerprint scanner. So far I'm a bit reluctant to use it because I can't find any info on how Android Marshmallow stores those fingerprints. Are they hashed (as SHA2 or whatever), or are they in they stored in the clear? Is the fingerprint data kept on the device, or does it get sent up to the cloud?
Looks like the answer is in Google's Android 6.0 Compatibility Requirements, section 7.3.10:


MUST have a hardware-backed keystore implementation, and perform the fingerprint matching in a Trusted Execution Environment (TEE) or on a chip with a secure channel to the TEE.
MUST have all identifiable fingerprint data encrypted and cryptographically authenticated such that they cannot be acquired, read or altered outside of the Trusted Execution Environment (TEE) as documented in the implementation guidelines on the Android Open Source Project site [Resources, 96].
MUST prevent adding a fingerprint without first establishing a chain of trust by having the user confirm existing or add a new device credential (PIN/pattern/password) using the TEE as implemented in the Android Open Source project.
MUST NOT enable 3rd-party applications to distinguish between individual fingerprints.