diff --git a/dbTools/post.js b/dbTools/post.js
index c446baf..931f718 100644
--- a/dbTools/post.js
+++ b/dbTools/post.js
@@ -127,13 +127,26 @@ postDB = (DB)=>{
                 {profileid: {
                     $in: ids
                 }},
-                //{toProfile: {
-                //    $in: ids
-                //}}
+                {toProfile: {
+                    $in: ids
+                }}
             ]
         };
         return DB.postCols.find(query).sort({lastUpdated: -1}).limit(20).toArray().then(async (posts)=>{
             //we need to filter when toProfile is private and not part of the following array
+            let filteredPosts = [];
+            for(p in posts){
+                if(!DB.isGroupPrivate(p.profileid) && !DB.isGroupPrivate(p.toProfile)){
+                    filteredPosts.push(p);
+                }
+                if(DB.isGroupPrivate(p.profileid) && !profile[p.profileid]){
+                    continue;
+                }
+                if(DB.isGroupPrivate(p.toProfile) && !profile[p.toProfile]){
+                    continue;
+                }
+                filteredPosts.push(p);
+            }
             return posts;
         }).catch((err)=>{
             console.log(err);
diff --git a/dbTools/profile.js b/dbTools/profile.js
index 71877b7..fd3e977 100644
--- a/dbTools/profile.js
+++ b/dbTools/profile.js
@@ -148,7 +148,7 @@ userDB = (DB) => {
     DB.isGroupPrivate = async (groupid) => {
         if(userProfileCache[groupid]) return userProfileCache[groupid].isPrivate;
         let g = await DB.getGroup(groupid);
-        return g.isPrivate;
+        return g ? g.isPrivate : false;
     }
 
     DB.getGroup = async (groupid) => {