diff --git a/backend/src/handlers/upload.rs b/backend/src/handlers/upload.rs
index b04031e..2871805 100644
--- a/backend/src/handlers/upload.rs
+++ b/backend/src/handlers/upload.rs
@@ -21,13 +21,17 @@ const MAX_CAPTION_LENGTH: usize = 2000;
 /// we trust, store, and hand to the compression pipeline — so a text-based payload
 /// (SVG/HTML/JS) can never be stored or served on-origin. Each entry maps to the
 /// server-controlled file extension we persist the original under.
+///
+/// HEIC/HEIF are deliberately excluded: the preview pipeline (`image` crate, and
+/// the bundled ffmpeg 6.1) cannot decode them, so accepting them would store files
+/// that never get a thumbnail. iOS Safari already transcodes HEIC→JPEG when a photo
+/// is selected via a file input, so this rejects only the rare HEIC-preserving
+/// upload path — with a clear error rather than a silently broken post.
 const ALLOWED_MEDIA: &[(&str, &str)] = &[
     ("image/jpeg", "jpg"),
     ("image/png", "png"),
     ("image/webp", "webp"),
     ("image/gif", "gif"),
-    ("image/heic", "heic"),
-    ("image/heif", "heif"),
     ("video/mp4", "mp4"),
     ("video/quicktime", "mov"),
     ("video/webm", "webm"),
diff --git a/frontend/src/lib/data-mode-store.ts b/frontend/src/lib/data-mode-store.ts
index 171a838..3f80fde 100644
--- a/frontend/src/lib/data-mode-store.ts
+++ b/frontend/src/lib/data-mode-store.ts
@@ -1,5 +1,7 @@
 // Per-device "Datenmodus" — Saver loads compressed previews (default), Original loads
-// the full file via the auth-gated `/api/v1/upload/{id}/original` endpoint.
+// the full file via the `/api/v1/upload/{id}/original` endpoint. That route is
+// intentionally unauthenticated (the UUID acts as the capability) so it works from
+// plain `<img src>` / `<video src>` without an Authorization header.
 //
 // Stored per-device in localStorage (not per-user) because data plans are a property
 // of the device the guest is currently holding, not their identity.