> Should I encrypt the data, and only the application know how to encrypt /decrypt
>(with drawback in performance)?

Doesn't matter. Couple of days with debugger and malevolent user will
have decryption key and algorithm.
Alternatively a simple application which control your application can
extract all data from your DB using your official interface.

> But for desktop application that I distribute with the database, the data could be read.

No way to protect such applications.

SY, SD.