# Profiles and Files

A Profile holds the keys, sign-ins and folders for one area of your work. Thinair Files keep every version of your Files.

## Profiles

A Profile is the wall for secrets. It holds:

* **Keys and files**: environment variables, and files laid into each login shell's home,
  such as an API key or a config file.
* **Coding agents' sign-ins**: Claude Code and Codex, each signed in as the Profile's own.
* **Folders**: the folders of Thinair Files its apps and agents reach, each read only or
  read and write.

Every app in a VM runs as one Profile, the last pick in the Apps menu. Apps on your
computer itself run as the computer's own Profile, which reaches everything there. A
Component runs in none.

Every computer starts with a Native Profile named **Personal**. Right-click the canvas and
choose **Profiles…** to open the Profiles window, where you make Profiles, add keys and
files, choose folders and sign in.

### Native and Cloud Profiles

Native Profiles stay on the computer that made them, and are not backed up. Cloud
Profiles live in Thinair Cloud and are the same on every computer you sign in on; each
Cloud account starts with a Cloud Personal of its own. An app's data on a Cloud Profile's
disk is backed up for 30 days, so what must survive a lost computer belongs in a Cloud
Profile.

### Home folders

Each Profile gets a home folder in Thinair Files, under `/profile` and named after it in
lowercase with hyphens: Side project's is `/profile/side-project`. The Profile reads and
writes it. Renaming the Profile renames its home, and you can remove or change it as any
other folder.

### Secrets stay in their Profile

Each Profile has a key of its own, and every value it holds is sealed under that key. No
tool ever answers a secret's value: only an app opened in that Profile gets it, in its
login shells. Removing a Profile removes its key. The Agent masks a Profile's values in
everything it keeps or shows, so a key that appears in its output shows as its name.

### Signing in to Claude

A Profile's Claude Code sign-in is its own, never a copy of your computer's. When an
agent needs one, it asks over its Window. You press **Sign in to Claude**, sign in by your
own hand in that Profile's Chrome, and paste the code Claude's page shows. The sign-in
lasts a year. Codex signs in with a one-time code of its own. An agent can ask for a
sign-in, and never sign in for you.

## Thinair Files

Thinair Files are your Files as Thinair keeps them, the same for every app that reaches
them.

* **Versions.** Every save keeps a new version. A version's Restore makes a new version
  from it and changes none before it.
* **Trash.** Delete puts a File in the Trash, which keeps it 30 days and then empties
  itself. Restore puts it back where it was.
* **Quick saves.** Saving a large File again sends only the parts that changed.
* **Folders follow.** A Profile's folder follows the folder itself: rename or move it,
  and the Profile still reaches it. In the Trash it reaches nothing until it is restored.

What an app or an agent does not reach does not exist for it. A write it may not make is
refused as read only.