object scope: server-stored private, working