Skip to main content
There are three distinct layers, and they are easy to confuse.

​
1. While you build

Your project’s preview URL carries a unique access token (?auth=<token>). Without the full URL, the preview shows a login wall. It is not indexed by search engines and cannot be guessed. Anyone you send the full link to can open it. That is the point: it is how you show work in progress to a colleague or a client. It is not a private-to-you URL.

​
2. The Private toggle

Marking a project Private in Project Settings stops it from being published by accident. The Publish Modal then shows a lock and “This project is private” instead of deploying. It changes nothing about the preview link, which stays shareable by whoever holds it.

​
3. Once published

Publishing puts the project on a public URL. By default, anyone with that URL can open it. To publish an app and still control who gets in, use HelloLeo AI: require sign-in, and scope each user to their own data. That is the setup for a customer portal, where the app is publicly reachable but each visitor only ever sees their own records.

​
Summary

If your app shows real business data, publishing without access rules exposes it. Set up sign-in in the HelloLeo AI section before you publish.