CBP believes it has the right to files saved locally on your device itself. However explicitly cloud-hosted data (that is not stored on the device) is supposed to be off-limits, as I understand it.

And keep in mind that American citizens cannot be denied entry to the country for refusing to unlock or hand over their devices. They might hold you for a little while, but they cannot stop you.