What data is encrypted with secondary profile pin (and not)?

Moscato

I have looked at the FAQ and searched the forum, but I am still not sure what this means:

Sensitive data is stored in user profiles. User profiles each have their own unique, randomly generated disk encryption key and their own unique key encryption key is used to encrypt it. The owner profile is special and is used to store sensitive system-wide operating system data.

And:

The OS derives a password token from the profile's lock method credential using scrypt. This is used as the main input for key derivation.

What is « sensitive data » exactly (is that a standard Android term)? What happens to regular files that are just written by apps to the filesystem, or copied via usb, with no additional encryption? Are they encrypted using the global (owner’s) key, meaning they are not at rest until reboot, or the profile-specific key?

Maybe a naive question, but how does one store a file and make it « sensitive data »?

Thanks a lot!

Carlos-Anso

Moscato
When in any given user profile that users encryption keys are required to access any of that users app data and any files you save to the devices storage if that user, which can be accessed through the bundled Files app.

Moscato

Carlos-Anso thanks a lot!

Si in that context, “sensitive data” (in the FAQ) means all user data?

Moscato

Carlos-Anso thanks a lot!

So in that context, “sensitive data” (in the FAQ https://grapheneos.org/faq#encryption) actually means all user data?

There is also:

or the global encryption key for non-sensitive data stored outside of profiles

What kind of data would that be for example?

de0u

Moscato There is also:

or the global encryption key for non-sensitive data stored outside of profiles

What kind of data would that be for example?

Anything that works before first unlock (BFU). For example, since the device will connect to a cellular network right after a reboot, the settings related to cellular networks are stored using "device credentials" instead of user credentials: https://developer.android.com/privacy-and-security/direct-boot