diff --git a/dbTools/post.js b/dbTools/post.js
index 906ef02..3f033e2 100644
--- a/dbTools/post.js
+++ b/dbTools/post.js
@@ -246,16 +246,22 @@ postDB = (DB)=>{
         });
     }
 
-    DB.getMediaTagPostOfUser = (profileId, mediaTag = "@image:", limit = 20) => {
-        if(!DB.ObjectID.isValid(profileId)) return [];
+    DB.getMediaTagPostOfUser = async (profileId, viewerProfileId, mediaTag = "@image:", limit = 30) => {
+        if(!DB.ObjectID.isValid(profileId) || !DB.ObjectID.isValid(profileId)) return [];
+        const profile = await DB.getProfile(viewerProfileId);
         let profileid = DB.ObjectID(profileId);
         let query = {
-            profileid,
+            $or: [
+                {profileid: profileid},
+                {toProfile: profileid}
+            ],
             content: {
                 "$regex": mediaTag
             }
         }
-        return DB.postCols.find(query).sort({_id: -1}).limit(limit).toArray().catch((err)=>{
+        return DB.postCols.find(query).sort({_id: -1}).limit(limit).toArray().then(async (posts)=>{
+            return await filterPrivateGroups(posts, profile);
+        }).catch((err)=>{
             console.log(err);
             return false;
         });
diff --git a/routes/post.js b/routes/post.js
index 6fa9670..262fbda 100644
--- a/routes/post.js
+++ b/routes/post.js
@@ -103,7 +103,8 @@ DB.getDB.then((DB) => {
 
     router.get("/usr/:id/images", async (req, res) => {
         const profileid = req.params.id;
-        const posts = await DB.getMediaTagPostOfUser(profileid);
+        const viewerProfileId = getProfileId(req);
+        const posts = await DB.getMediaTagPostOfUser(profileid, viewerProfileId);
         return res.json({
             status: "ok",
             posts
@@ -112,7 +113,8 @@ DB.getDB.then((DB) => {
 
     router.get("/usr/:id/embedded", async (req, res) => {
         const profileid = req.params.id;
-        const posts = await DB.getMediaTagPostOfUser(profileid, "@iframe:");
+        const viewerProfileId = getProfileId(req);
+        const posts = await DB.getMediaTagPostOfUser(profileid, viewerProfileId, "@iframe:");
         return res.json({
             status: "ok",
             posts
@@ -121,7 +123,8 @@ DB.getDB.then((DB) => {
 
     router.get("/usr/:id/media", async (req, res) => {
         const profileid = req.params.id;
-        const posts = await DB.getMediaTagPostOfUser(profileid, "@youtube:|@vimeo:|@hls:");
+        const viewerProfileId = getProfileId(req);
+        const posts = await DB.getMediaTagPostOfUser(profileid, viewerProfileId, "@youtube:|@vimeo:|@hls:");
         return res.json({
             status: "ok",
             posts
@@ -247,7 +250,7 @@ DB.getDB.then((DB) => {
 
     router.get("/images", async (req, res) => {
         const profileid = getProfileId(req);
-        const posts = await DB.getMediaTagPostOfUser(profileid);
+        const posts = await DB.getMediaTagPostOfUser(profileid, profileid);
         return res.json({
             status: "ok",
             posts
@@ -256,7 +259,7 @@ DB.getDB.then((DB) => {
 
     router.get("/embedded", async (req, res) => {
         const profileid = getProfileId(req);
-        const posts = await DB.getMediaTagPostOfUser(profileid, "@iframe:");
+        const posts = await DB.getMediaTagPostOfUser(profileid, profileid, "@iframe:");
         return res.json({
             status: "ok",
             posts
@@ -265,7 +268,7 @@ DB.getDB.then((DB) => {
 
     router.get("/media", async (req, res) => {
         const profileid = getProfileId(req);
-        const posts = await DB.getMediaTagPostOfUser(profileid, "@youtube:|@vimeo:|@hls:");
+        const posts = await DB.getMediaTagPostOfUser(profileid, profileid, "@youtube:|@vimeo:|@hls:");
         return res.json({
             status: "ok",
             posts