diff --git a/app.py b/app.py
index f5b57ab..7411b65 100644
--- a/app.py
+++ b/app.py
@@ -441,15 +441,20 @@ def note_by_id(note_id):
     if is_api_request():
         return redirect(url_for("outbox_activity", item_id=note_id))
 
+    query = {}
+    # Prevent displaying direct messages on the public frontend
+    if not session.get("logged_in", False):
+        query = is_public()
+
     data = DB.activities.find_one(
-        {**in_outbox(), **by_remote_id(activity_url(note_id))}
+        {**in_outbox(), **by_remote_id(activity_url(note_id)), **query}
     )
     if not data:
         abort(404)
     if data["meta"].get("deleted", False):
         abort(410)
 
-    thread = _build_thread(data)
+    thread = _build_thread(data, query=query)
     app.logger.info(f"thread={thread!r}")
 
     raw_likes = list(
diff --git a/core/activitypub.py b/core/activitypub.py
index ef77853..9e0ffee 100644
--- a/core/activitypub.py
+++ b/core/activitypub.py
@@ -436,7 +436,14 @@ class MicroblogPubBackend(Backend):
             if obj:
                 if obj["meta"]["deleted"]:
                     raise ActivityGoneError(f"{iri} is gone")
-                return obj["meta"].get("object") or obj["activity"]["object"]
+                cached_object = obj["meta"].get("object")
+                if cached_object:
+                    return cached_object
+
+                embedded_object = obj["activity"]["object"]
+                if isinstance(embedded_object, dict):
+                    return embedded_object
+
             # TODO(tsileo): also check the REPLIES box
 
             # Check if it's cached because it's a follower
diff --git a/core/shared.py b/core/shared.py
index 2d7eb5a..3e63d66 100644
--- a/core/shared.py
+++ b/core/shared.py
@@ -140,7 +140,9 @@ def _get_ip():
     return ip, geoip
 
 
-def _build_thread(data, include_children=True):  # noqa: C901
+def _build_thread(data, include_children=True, query=None):  # noqa: C901
+    if query is None:
+        query = {}
     data["_requested"] = True
     app.logger.info(f"_build_thread({data!r})")
     root_id = data["meta"].get(
@@ -150,7 +152,12 @@ def _build_thread(data, include_children=True):  # noqa: C901
 
     replies = [data]
     for dat in find_activities(
-        {**by_object_id(root_id), **not_deleted(), **by_type(ap.ActivityType.CREATE)}
+        {
+            **by_object_id(root_id),
+            **not_deleted(),
+            **by_type(ap.ActivityType.CREATE),
+            **query,
+        }
     ):
         replies.append(dat)
 
@@ -159,12 +166,13 @@ def _build_thread(data, include_children=True):  # noqa: C901
             **flag(MetaKey.THREAD_ROOT_PARENT, root_id),
             **not_deleted(),
             **by_type(ap.ActivityType.CREATE),
+            **query,
         }
     ):
         replies.append(dat)
 
     for dat in DB.replies.find(
-        {**flag(MetaKey.THREAD_ROOT_PARENT, root_id), **not_deleted()}
+        {**flag(MetaKey.THREAD_ROOT_PARENT, root_id), **not_deleted(), **query}
     ):
         # Make a Note/Question/... looks like a Create
         dat["meta"].update(