Your profiles live on this disk

A profile is a whole browser directory: cookies, local storage, saved logins, history and the databases the engine writes. All of it is on this disk and none of it is uploaded by itself.

You can open that directory yourself: ~/Library/Application Support/@armanos/desktop on macOS, %APPDATA%\@armanos\desktop on Windows, ~/.config/@armanos/desktop on Linux.

• Stays here

  Cookies and site data, the profile's login pair, its one time code key, history, downloads and any fingerprint value you set by hand.

• Mirrored while you are signed in

  Settings only: name, group, scenario, fingerprint template, proxy, tags, notes and which extensions are switched on.

• Derived, never stored

  The fingerprint. Your profile builds it again at each launch from its own settings, so no ready values sit on disk unless you set one by hand. The template and generation behind it do travel.

While you are signed in the app asks your account a short question every five minutes. Your day runs from the last answer it received, not from the moment the cable came out.

A short drop in the middle of a working day therefore costs nothing at all. Past twenty four hours out of reach the app waits for one check to go through before it opens anything new.

Rename a profile with no connection, and the new name is on this disk at once. The app marks that field as not sent yet and carries on.

Only marked fields travel afterwards. A field a colleague changed on another machine still comes down, because your stale copy of it was never waiting to be sent.

• The mark is set before the request

  Your account, asked at that same moment, cannot paint over what you just typed.

• Waiting fields leave on their own

  They go up at the next start of the app, and with your next edit of that profile.

• A refusal shows on screen

  A change the account did not accept shows in a notice that names the profile and says it is not synchronised yet.

A profile's fingerprint is tied to its id, so with a new id the same accounts would see a different machine arrive. A profile born on this disk goes up to your account under the id it was born with.

Profiles made while you were signed out stay yours, go up to your account unless another account has been on this computer, and you see the count on screen.

The app remembers which account you last held these profiles under. Sign in with a different one and the first account's rows move to the recycle bin, while their cookies and saved logins stay on the disk.

Signing back in with the first account brings the rows back. Nothing travels the other way once this machine has been seen under another account: profiles you made for yourself stay yours rather than landing in an employer's account, and a held profile stays on this computer for good, because nothing sends it up later.

With no account the app opens and runs on the free floor of two profiles, with no time limit and no card. There is no day to count here, because there is nothing to ask.

What you give up is what an account provides: settings mirrored to a second machine, the lock that keeps two colleagues off one profile, and groups shared with a team.

Files that hold a secret of yours can be read by their owner alone, which means you. That is what matters when a copy leaves the folder: a backup, a synced cloud directory, an archive sent to a colleague.

On macOS and Linux those permissions are the protection. On Windows they are decided by access lists the app does not reach, and what stands there is your user account: another user cannot enter your profile folder without administrator rights.