users can only upload public items