Gmail and Google account isolation

I keep work Gmail in a local profile that is only that Google account. Personal Gmail stays out. YouTube uploads stay on the Google identity that already owns the channel. I will not write a Gmail warmup protocol.

The useful caveat: Google account pickers leak. One Chromium folder can hold many Google logins at once. Isolation only works if you refuse to add the extra account "just this once." How accounts get linked. Cookie jars are not optional.

What I split

Multiple accounts on one PC is the parent split. Authorized accounts only. MaskWright 0.1: Windows 10/11, per-profile user-data-dir. profiles.json is encrypted. Chromium user data is not. No seats. Bring your own HTTP or SOCKS5 if that Workspace already requires an exit.

YouTube and ads follow Google, not hope

If Studio and Gmail are one Google login, they may have to share a folder. That is Google's model. Do not invent a second Gmail as a costume. Use Brand Accounts and official managers when the channel is a brand.

X ads, Discord, and Telegram are not Google. Keep them out. X Ads Manager isolation. Discord brand and community rooms. Telegram brand channels. Unofficial helpers: X API versus unofficial helpers.

Access

Workspace admin invites. Google Group permissions. YouTube managers. Not cookie dumps. Not a mailed user-data-dir. 2FA on a device the person holds.

How I set a work Gmail profile

Empty cookies. Official accounts.google.com sign-in. Confirm the picker shows one identity. Disable "sign in to other accounts" habits. Close the profile when mail is done. Downloads of CSVs leave the profile tray.

I skip warmup, aged Gmail shops, and "fresh inboxes." Those chapters are farm-adjacent.

On a real Windows desk

Work Gmail is acme-google. I sign in once. I watch the picker. If Google offers "use across Chrome," I treat that as a threat to isolation, not a convenience. This is a MaskWright profile, not the everyday system Chrome I shop with.

Drive files that are client work live in Drive, not duplicated into user-data-dir. Downloads of CSVs leave the tray. I do not add personal Gmail to send one forward. I forward from the personal profile, or I use Workspace sharing.

YouTube uploads that belong to this Google identity can live here. Client B's Workspace cannot. X ads cannot. Discord cannot.

2FA is a hardware key or phone I hold. Recovery codes sit in the password manager, not in a txt file in the profile folder. Contractors get Workspace invites, not a cookie export.

FAQ

Chrome already has profiles. Why MaskWright?

Chrome profiles can be enough for personal versus one work. I use MaskWright when I also need per-profile proxies, a chosen Chromium core, and several client Workspaces that must not share extensions.

Can I add personal Gmail to the work profile to forward something?

That is how clusters start. Forward from the personal profile, or use Workspace sharing. Do not add the account.

Does isolation hide a Workspace from Google?

No. Google still sees the account. Isolation stops your other clients' cookies from sitting in the same store.

Cloud Gmail?

Then the vendor sees mail. I keep work mail on local disk. Compare local versus cloud.

Can I add a client Workspace "just to grab one Doc"?

That is how clusters start. Open the client profile, or use a share link in the profile that already holds that Workspace.

One Google identity per folder unless Google already tied those products together. Invite people. Do not warm up extra Gmails.

I skip aged-Gmail shops, adding personal mail to work, and cookie exports as staff kits. I watch the picker. I keep Drive files in Drive. Recovery codes sit in the password manager, not in the profile folder.

I treat "Sign in with Google" on random SaaS tabs as a cluster risk. If the SaaS is work, it belongs in this Workspace profile. If it is personal, it belongs in personal Google. I do not grant the work profile a new OAuth identity "for five minutes."

More notes sit under Social media. Download MaskWright for the Windows launcher.