# Browser downloads, privacy and multiple profiles > With several browser profiles, one shared Downloads folder mixes every profile's files and outlives them. Mosaic gives each profile its own folder instead. Source: https://mosaicbrowser.com/blog/downloads-are-evidence ## A downloaded file is evidence of its profile With several browser profiles, one shared Downloads folder mixes every profile's files and outlives them. Mosaic gives each profile its own folder instead. ![Every profile's files in its own folder, beside a screenshot: mosaic storage settings: each profile downloads into its own folder](https://mosaicbrowser.com/covers/downloads-are-evidence.webp) If you browse with several profiles, cookies and history are kept apart, but downloads usually are not: every profile saves into the same Downloads folder. That folder mixes the files of every profile, sits in the search index and outlives the profile that made them. On 7 October 2026 we changed Mosaic so each profile saves into its own folder, and we had argued for the opposite only a few weeks earlier. ## The argument for one folder The first version of Mosaic did nothing special, so Chromium did what it does with a fresh data directory. It put the Downloads folder inside the profile's own `--user-data-dir`, which meant every profile wrote to `profile-data//Downloads`. Nobody could find those folders. Each one was named by a UUID, buried in Application Support, and different for every profile. Downloading into the home folder had its own cost on macOS: it raised the system prompt asking for access to the Downloads folder. So we moved everything to one shared folder, `~/Downloads` or whatever the operator chose, and wrote the reasoning down. Separation is the point for cookies, history and storage, because a site must not see across them. For a file the operator asked the browser to hand back, separation is the opposite of the point. One folder, like any browser. That was right about convenience. It said nothing about anything else. ## Browser downloads and privacy across multiple profiles The files a profile saves are the invoice from that shop, the export from that ad account, the screenshot from that research session. Each one is evidence of the profile that saved it. In `~/Downloads` they sat together with every other profile's files, in the first place anybody or anything looks. Spotlight indexed them. Whatever backs up or syncs the home folder took copies. And they outlived the profile by years. Purging a profile in Mosaic destroyed its cookies, its history, its launcher and its fingerprint, and left its documents in `~/Downloads` for good. We spend real effort making sure two profiles share no cookie, no exit and no inherited setting. A folder holding both profiles' paperwork undid some of that on the operator's own disk, where no website ever looks but a person might. The request that started the change was blunt: downloads should go "inside a Mosaic folder, hidden from the normal device … easy to delete, all in the settings". Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Local first](https://mosaicbrowser.com/features/local-first) ## Four properties, not one We kept both modes and made the per-profile one the default. It does four separate things: 1. **Out of the home folder.** Each profile writes into its own folder inside Mosaic's data directory. Because the app is writing inside its own directory, the macOS prompt for the Downloads folder no longer appears. 2. **Out of the search index.** One `.metadata_never_index` file at the root of the store keeps Spotlight away from every folder under it, including ones made later. A marker per profile would be one more thing to forget. 3. **Deleted with the profile.** When a profile is purged, its downloads go in the same step as its browser data. That happens in `purgeProfile`, the one function every destructive path goes through, so a new way to delete a profile cannot forget the files. 4. **Emptied on demand.** Settings › Storage › Downloads lists each profile with its file count and size, and empties one profile or all of them. The REST API has `GET /downloads` and `POST /downloads/clear`, and MCP has `list_downloads` and `clear_downloads`. ![Mosaic storage settings: each profile downloads into its own folder](https://mosaicbrowser.com/shots/downloads.png) *Settings › Storage: one folder per profile, and what each holds* A folder the browser can write to but never reads from is only a hiding place, so the file picker comes along too. Chromium keeps three remembered folders: one for downloads, one for Save page as, and `selectfile.last_directory` for where a Choose file dialog opens. Mosaic sets all three to the profile's folder, so uploading the invoice you just saved starts in the right place. That is where the picker *starts*. Chromium moves the preference when you browse somewhere else, and Mosaic writes it again at the next launch, so nothing stops you reaching your Desktop. ## Why we did not call it encrypted The request said "encrypted folder … or something", and we read the honest half of that as "hidden". Chromium writes each download with its own file handle. Nothing in Mosaic sits between the network and the disk, so we cannot encrypt the bytes on the way in. The only real options are a mounted disk image or a filesystem layer, and both fail closed whenever they are not mounted: a download errors, or a file picker opens on nothing. That is a worse product than a folder that is simply out of the way. So the settings card says it in bold: **This is not encryption**. Mosaic's store and cookie jars are encrypted on disk; downloads are not, and FileVault is the answer for the whole disk. ## A wipe has to be asked for by name Emptying downloads deletes files from the disk. They do not go to a trash, and nothing restores them. We once lost 586 profiles to a cleanup that read an empty scope as "everything", so `POST /downloads/clear` with an empty body is a `400`. It takes a list of profile ids, or `all: true` said out loud. `all: true` is also the only way to remove orphaned folders, whose profiles are gone. In the settings table those rows read "Deleted profile" with the first characters of the id, because nothing else in the app will ever name them. The same rule runs through [trashing a running profile](https://mosaicbrowser.com/blog/trash-closes-the-browser): what a profile leaves behind is part of the profile. The rest of what stays on your computer, and what never leaves it, is on [local first](https://mosaicbrowser.com/features/local-first). The [Widevine certificate](https://mosaicbrowser.com/blog/widevine-device-certificate) is the same lesson from the other side: one value shared by every profile on a machine, which a site could read. ## Questions ### Do browser profiles keep their downloads separate? Usually not. Profiles split cookies and history, but a browser's default is one Downloads folder that every profile saves into. In Mosaic each profile saves into its own folder by default, and one shared folder is an option. ### Where does Mosaic put a profile's downloads? In a folder for that profile inside Mosaic's own data directory, not in your home folder. The whole store carries a .metadata_never_index marker so Spotlight leaves it alone, and the profile's file picker opens there. ### Are Mosaic downloads encrypted? No. The browser writes the file itself, so Mosaic cannot sit between the network and the disk. What you get is isolation, no search index, and a wipe that removes the files. For encryption at rest, use FileVault. ### Can I go back to one shared Downloads folder? Yes. Settings › Storage › Downloads has two choices, Each profile's own folder and One shared folder. Shared is the old behaviour, unchanged, and you can pick which folder it uses. ## Related [Trashing a profile closes its browser, at every door](https://mosaicbrowser.com/blog/trash-closes-the-browser): Delete a running profile in Mosaic and its browser closes first. If the browser will not close, the profile stays on the list, with its Stop button. [Local first: your profiles stay on your computer](https://mosaicbrowser.com/features/local-first): Mosaic has no cloud copy of your profiles. Profiles, cookies and proxies stay on your computer, encrypted on disk, with app lock, daily backups and a trash. [What cloud sync costs an anti-detect browser](https://mosaicbrowser.com/blog/cloud-sync-tradeoffs): Cloud sync puts every logged-in session you run in one vendor's database. Mosaic keeps profiles on your disk instead, and pays for it in three ways. [Widevine device certificate privacy: one key for every profile](https://mosaicbrowser.com/blog/widevine-device-certificate): Widevine device certificate privacy needs a Google-signed browser. Without it, the first licence message is 1704 bytes where Chrome sends 2.     ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.