So the files are in data/username/files/ folder in my web server, which is an Ubuntu 16.04 server. If I put a direct ulr from web browser I can access the file even though I am not logged in to my server, I feel this is a configuration thing but I cannot find out why. E.g. I can use a url simiar to this to access the file from anywhere without logged into server, and the file is not shared:
https://example.com/data/username/file/abc.jpg
Thanks for your help!