all the dir at 777 so if people know the direct link, of course they can download it, doesn't matter if they are registered user, private user or wat so ever,
if u want to protect ur file so that people can't link it directly from their site, u can use the .htaccess file, i even put some codes in it so that people can't use some software do download my whole site