file upload (still private)