Does "<app> would like to access files in your Downloads folder" give complete access to directory, or just certain files in it?

Question

I see the following (particularly with communications apps like slack and zoom):

If I had sensitive info in Downloads, say, client data for a project I'd been working on, could these applications like Zoom or Slack upload that file to their servers (or access it in any other way), or does this permission only give these applications the ability to do the following

• save files sent through that application
• upload files sent by the user through the application (for example, if I wanted to send a file from Downloads to a friend)

The notification as it stands doesn't rule out the possibility that the application will be given permission to upload anything it wants from Downloads to its servers at any time it wants. I would assume it doesn't have that permission, but we know what happens when we assume..

Answer 1

No: the permission is for unlimited access to that folder.

There's nothing to stop an app secretly uploading all your files to some server, except that people would notice and denounce the company, and there's no commercial benefit in doing it anyway.

The Documents folder is another location that has privileged access, but the trouble is that every app that can open and save files is likely to need access to it. If you create another user folder outside Documents, then it will be open to all user processes.

You can install something like Little Snitch, which will regularly worry you with information about all outgoing internet connections, and let you allow/deny them.