added policy to restrict access from others users data