I'm saving new registered user's profile picture in my Yii application's protected/data folder under a folder with his user-id.
The client (a mobile app) whenever logging in will retrieve some basic info ... among which is his profile picture.
Should I point them straight to the jpg inside protecte/data/user/pic.jpg OR should I temporarily push that picture in /tmp folder and point them to the temporary file?
You could do it straight to the file, nothing's wrong with that. If you did it in a tmp file, it would be OK, but it could accidentally delete itself.