# Images in private app **URL:** \ **Category:** Questions\ **Created:** [February 5, 2017, 8:01pm UTC](https://forum.bubble.io/t/images-in-private-app/10246 "2017-02-05T20:01:12Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![recrutbox](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@recrutbox](https://forum.bubble.io/u/recrutbox)\ **Post date:** [February 5, 2017, 8:01pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/1 "2017-02-05T20:01:12Z")
Hi, I have a private app, closed with a password and it seems like when I upload images, the images are publicly accessible, could you please confirm me this @emmanuel ? And is there a way to limit their visibility publicly ? Thanks! ---
**Author:** ![fayewatson](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/fayewatson/32/2686_2.png) [@fayewatson](https://forum.bubble.io/u/fayewatson)\ **Post date:** [February 6, 2017, 12:53am UTC](https://forum.bubble.io/t/images-in-private-app/10246/2 "2017-02-06T00:53:46Z")
Hi @recrutbox, did you set the images to only be visible to logged in Users? Also, do you have any privacy roles in place where only logged in Users can view that image field? ---
**Author:** ![recrutbox](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@recrutbox](https://forum.bubble.io/u/recrutbox)\ **Post date:** [February 6, 2017, 2:28pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/3 "2017-02-06T14:28:53Z")
Hi @fayewatson, I realise I have to clarify a bit more my point: I was not refering to pages inside the app: when I upload an image (whether it’s a public or private app), I can see an url assigned by Bubble. For instance, in this example page: [https://app0test.bubbleapps.io/version-test/image](https://app0test.bubbleapps.io/version-test/image) the url assigned is: [//s3.amazonaws.com/appforest\_uf/f1486390527751x516647380776703360/Koala.jpg](https://s3.amazonaws.com/appforest_uf/f1486390527751x516647380776703360/Koala.jpg) and so, the image is publicly accessible no matter my app or page is limited in access. ![](https://us1.discourse-cdn.com/bubble/original/2X/0/0e5bac6f7e1930f6911a39f4652f6a00ca84ad71.png) ---
**Author:** ![fayewatson](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/fayewatson/32/2686_2.png) [@fayewatson](https://forum.bubble.io/u/fayewatson)\ **Post date:** [February 6, 2017, 11:21pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/4 "2017-02-06T23:21:45Z")
Ohh, right. I’m not sure if there is a way to prevent that when using the image element. If you want to ensure that certain images can’t be viewed at all with the link, I believe you can use a group element and have the background style be the image. Then if you are allowing people to download those images, you could have a download button which lets them download the image on-click, but never opens in a new tab. ---
**Author:** ![emmanuel](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/emmanuel/32/27657_2.png) [@emmanuel](https://forum.bubble.io/u/emmanuel)\ **Post date:** [February 7, 2017, 4:39pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/5 "2017-02-07T16:39:30Z")
@fayewatson is right, it’s about having some privacy rules for attachment set up. This is an advanced feature, but possible. Then it will only be visible if the thing attached to it is visible to the current user. ---
**Author:** ![fayewatson](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/fayewatson/32/2686_2.png) [@fayewatson](https://forum.bubble.io/u/fayewatson)\ **Post date:** [February 7, 2017, 5:17pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/6 "2017-02-07T17:17:57Z")
For example if you would prefer that only Users who are logged in can view an image, you could set up a privacy role similar to this: ![](https://us1.discourse-cdn.com/bubble/original/2X/d/ddbfcf3e185a06f0088fe7aa1c9424ea111f49f1.png) Here, only logged-in Users can view the Photo, Created Date, Modified Date, Created By fields within the “Listing” data type (though this could be any data type of course). Then “Everyone Else” cannot view those fields or find them in searches. (Privacy Roles are accessed by going to Data → Privacy → “Define A New Role”) ---
**Author:** ![recrutbox](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@recrutbox](https://forum.bubble.io/u/recrutbox)\ **Post date:** [February 7, 2017, 8:33pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/7 "2017-02-07T20:33:10Z")
First, thank you for explaining in detail your reply @fayewatson I tested your solution and it works well for pages inside Bubble but even with these privacy rules, the images are still accessible through url links where Bubble stores the uploaded pictures (for instance: [//s3.amazonaws.com/appforest\_uf/f1486390527751x516647380776703360/Koala.jpg](https://s3.amazonaws.com/appforest_uf/f1486390527751x516647380776703360/Koala.jpg)). Is there another way to limit this access? @emmanuel I precise my goal here is to limit access to images of my private app, to keep them confidential until the app launch. ---
**Author:** ![emmanuel](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/emmanuel/32/27657_2.png) [@emmanuel](https://forum.bubble.io/u/emmanuel)\ **Post date:** [February 7, 2017, 9:47pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/8 "2017-02-07T21:47:37Z")
Can you share some screenshot of your setting of the Image uploader? ---
**Author:** ![recrutbox](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@recrutbox](https://forum.bubble.io/u/recrutbox)\ **Post date:** [February 7, 2017, 10:49pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/9 "2017-02-07T22:49:19Z")
Yes, here is all the settings ![](https://us1.discourse-cdn.com/bubble/original/2X/8/803334f56fb771b7fc9f82edff76d1de9f57a3a1.png) ---
**Author:** ![emmanuel](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/emmanuel/32/27657_2.png) [@emmanuel](https://forum.bubble.io/u/emmanuel)\ **Post date:** [February 8, 2017, 12:27am UTC](https://forum.bubble.io/t/images-in-private-app/10246/10 "2017-02-08T00:27:25Z")
You want to create the pic first, and then attach the image to the pic. since your privacy rule applies to the pic. ---
**Author:** ![recrutbox](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@recrutbox](https://forum.bubble.io/u/recrutbox)\ **Post date:** [February 8, 2017, 11:48am UTC](https://forum.bubble.io/t/images-in-private-app/10246/11 "2017-02-08T11:48:54Z")
Yes, when the button is clicked, I create the pic and attach the image to it, via the picture uploader value, so I don’t understand what your answer is, sorry? ---
**Author:** ![emmanuel](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/emmanuel/32/27657_2.png) [@emmanuel](https://forum.bubble.io/u/emmanuel)\ **Post date:** [February 8, 2017, 3:07pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/12 "2017-02-08T15:07:47Z")
So since a file is attached to a thing when it’s uploaded, the thing has to get created before the image is uploaded. So you can change your logic a little bit, with the thing created beforehand. ---
**Author:** ![recrutbox](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@recrutbox](https://forum.bubble.io/u/recrutbox)\ **Post date:** [February 8, 2017, 6:09pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/13 "2017-02-08T18:09:44Z")
Ok, I just applied your suggestion: I first created the thing with a different event and then I made changes to this thing when the button is clicked in order to attach the image to the thing, but I don’t see any difference on the result: the image indeed follows the privacy rule on the Bubble page but if I right click on the image to copy the link, I can still see the image, whether I’m logged in or not to Bubble. ---
**Author:** ![emmanuel](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/emmanuel/32/27657_2.png) [@emmanuel](https://forum.bubble.io/u/emmanuel)\ **Post date:** [February 8, 2017, 6:52pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/14 "2017-02-08T18:52:12Z")
Can you share a link to your app in the editor? ---
**Author:** ![recrutbox](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@recrutbox](https://forum.bubble.io/u/recrutbox)\ **Post date:** [February 9, 2017, 2:36pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/15 "2017-02-09T14:36:10Z")
Yes, here is the link: [https://bubble.io/page?type=page&name=image&id=app0test&tab=tabs-1](https://bubble.io/page?type=page&name=image&id=app0test&tab=tabs-1) ---
**Author:** ![emmanuel](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/emmanuel/32/27657_2.png) [@emmanuel](https://forum.bubble.io/u/emmanuel)\ **Post date:** [February 9, 2017, 9:48pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/16 "2017-02-09T21:48:50Z")
You’re not attaching the image to the pic, but to the current user. Look at your privacy rule, it’s not on the user, but the pic. See what I did (you also need to set the pic somewhere so that the file uploader knows which pic we’re talking about, which is why i display data in the group). Now this [image](https://app0test.bubbleapps.io/version-test/fileupload/f1486676865578x989631174597889100/BeBubblePro_logo.jpg) is protected. ---
**Author:** ![recrutbox](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@recrutbox](https://forum.bubble.io/u/recrutbox)\ **Post date:** [February 9, 2017, 10:56pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/17 "2017-02-09T22:56:52Z")
Ok, now I understand my mistake, I attached the image to the current user, it seemed wrong indeed but I couldn’t find other option. Thanks for your help, I wouldn’t have found how to make it work by myself! ---
**Author:** ![rushabh](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/rushabh/32/14144_2.png) [@rushabh](https://forum.bubble.io/u/rushabh)\ **Post date:** [October 20, 2017, 7:45pm UTC](https://forum.bubble.io/t/images-in-private-app/10246/18 "2017-10-20T19:45:55Z")
I got stuck on this for hours as well. Ended up creating the private object on page load. ---
**Author:** ![omarajoor](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/omarajoor/32/24816_2.png) [@omarajoor](https://forum.bubble.io/u/omarajoor)\ **Post date:** [July 13, 2020, 8:46am UTC](https://forum.bubble.io/t/images-in-private-app/10246/19 "2020-07-13T08:46:42Z")
I’m having hard time implementing this. > [@Privacy rules NEED HELP](http://forum.bubble.io/t/privacy-rules-need-help/101524): > > so im having a stubborn issue with the privacy rule. I’m trying to deny access the photo to the public. [https://d1muf25xaso8hp.cloudfront.net/https%3A%2F%2Fs3.amazonaws.com%2Fappforest\_uf%2Ff1594043663073x243466690226511460%2FEmployee-id-5-CRC.jpg?w=384&h=384&auto=compress&dpr=1&fit=max](https://d1muf25xaso8hp.cloudfront.net/https%3A%2F%2Fs3.amazonaws.com%2Fappforest_uf%2Ff1594043663073x243466690226511460%2FEmployee-id-5-CRC.jpg?w=384&h=384&auto=compress&dpr=1&fit=max) This picture gets into the database after the user uploads a photo and this element has “makes this thing private” and “attach file to” = current user. so what I’m trying to achieve is not having that photo pub… ---
**Author:** ![nemanja.rilakovic](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@nemanja.rilakovic](https://forum.bubble.io/u/nemanja.rilakovic)\ **Post date:** [November 8, 2021, 5:06am UTC](https://forum.bubble.io/t/images-in-private-app/10246/20 "2021-11-08T05:06:27Z")
Same here, has anyone got an example of the solution? 😃 [Next page](https://forum.bubble.io/t/images-in-private-app/10246.md?page=2)