Nostr: How do I control who can access files I share?

Treat a public media URL as public unless the host provides real access controls or you encrypt the file before upload.

Short answer

Treat a public media URL as public unless the host provides real access controls or you encrypt the file before upload. A private-looking Nostr post does not automatically make an external image or document private. Check the media host's terms, link behavior, and deletion options. If a file must remain confidential, encrypt it and share the decryption key through an appropriate secure channel.

Sources

NIP-94: File metadata, NIP-17: Private messages.