diff --git a/controllers/index.js b/controllers/index.js
index b2c7917..81bd458 100644
--- a/controllers/index.js
+++ b/controllers/index.js
@@ -2,3 +2,4 @@ exports.userController = require('./userController')
 exports.authController = require('./authController')
 exports.scheduleController = require('./scheduleController')
 exports.secretsController = require('./secretsController')
+exports.shareController = require('./shareController')
diff --git a/controllers/shareController.js b/controllers/shareController.js
new file mode 100644
index 0000000..4c7ac27
--- /dev/null
+++ b/controllers/shareController.js
@@ -0,0 +1,100 @@
+const HttpStatus = require('http-status-codes')
+const {
+  mongo: { ObjectId }
+} = require('mongoose')
+
+const { idClaim } = require('../utils').constants
+
+exports.getFavorites = async (req, res) => {
+  try {
+    var user = await req.db.User.findOne({ _id: ObjectId(req.user[idClaim]) })
+    const share = await req.db.Share.findOne({ _id: ObjectId(req.query.shareId) })
+
+    if (share.ownerId === user._id || share.recivers.includes(user._id)) {
+      const user = await req.db.User.findOne({ _id: share.ownerId })
+      return res.status(HttpStatus.OK).json({
+        success: true,
+        favorites: user.favoriteCourses
+      })
+    } else {
+      return res.status(HttpStatus.UNATHORIZED).json({
+        success: false,
+        message: "you don't have rights to view this"
+      })
+    }
+  } catch (e) {
+    return res.status(HttpStatus.INTERNAL_SERVER_ERROR).json({
+      success: false,
+      message: 'Something bad hapened!'
+    })
+  }
+}
+
+exports.updateFavorites = async (req, res) => {
+  try {
+    var user = await req.db.User.findOne({ _id: ObjectId(req.user[idClaim]) })
+    let newFavoriteCourses = []
+
+    for (const course in req.body.coursesToAdd) {
+      newFavoriteCourses.push(course)
+    }
+    for (const course in user.favoriteCourses) {
+      newFavoriteCourses.push(course)
+    }
+    newFavoriteCourses = [new Set(newFavoriteCourses)]
+
+    for (const course in req.body.coursesToRemove) {
+      newFavoriteCourses.filter((item, index) => item !== course)
+    }
+
+    await req.db.User.updateOne(
+      { _id: ObjectId(req.user[idClaim]) },
+      { favorites: newFavoriteCourses }
+    )
+
+    return res.status(HttpStatus.OK).json({
+      success: true,
+      message: 'Favorite courses updated successfully'
+    })
+  } catch (e) {
+    return res.status(HttpStatus.INTERNAL_SERVER_ERROR).json({
+      success: false,
+      message: 'Something bad happened!'
+    })
+  }
+}
+
+exports.updateRecivers = async (req, res) => {
+  try {
+    var user = await req.db.User.findOne({ _id: ObjectId(req.user[idClaim]) })
+    const share = await req.db.Share.find({ ownerId: user._id })
+
+    let newRecivers = []
+
+    for (const reciverId in req.body.reciverToAdd) {
+      newRecivers.push(reciverId)
+    }
+    for (const reciverId in req.share.recivers) {
+      newRecivers.push(reciverId)
+    }
+    newRecivers = [new Set(newRecivers)]
+
+    for (const reciverId in req.body.reciverToRemove) {
+      newRecivers.filter((item, index) => item !== reciverId)
+    }
+    await req.Share.updateOne(
+      { _id: share._id },
+      { recivers: newRecivers }
+    )
+
+    return res.status(HttpStatus.OK).json({
+      success: true,
+      message: 'Share recivers updated successfully'
+    })
+  } catch (e) {
+    return res.status(HttpStatus.INTERNAL_SERVER_ERROR).json({
+      success: false,
+      message: 'Something bad happened!'
+    })
+  }
+}
diff --git a/models/index.js b/models/index.js
index 63ab59b..e7d0cce 100644
--- a/models/index.js
+++ b/models/index.js
@@ -5,6 +5,7 @@ const Year = require('./year')
 const Day = require('./day')
 const Course = require('./course')
 const Secret = require('./secret')
+const Share = require('./share')
 
 const db = {
   User,
@@ -13,7 +14,8 @@ const db = {
   Year,
   Day,
   Course,
-  Secret
+  Secret,
+  Share
 }
 
 module.exports = db
diff --git a/models/share.js b/models/share.js
new file mode 100644
index 0000000..0022cfb
--- /dev/null
+++ b/models/share.js
@@ -0,0 +1,15 @@
+const { Schema, model } = require('mongoose')
+
+const shareSchema = new Schema(
+  {
+    ownerId: {
+      type: String,
+      required: true
+    },
+    recivers: {
+      type: Array,
+      default: []
+    }
+  }
+)
+module.exports = model('share', shareSchema)
diff --git a/models/user.js b/models/user.js
index 77eb96c..1a890f1 100644
--- a/models/user.js
+++ b/models/user.js
@@ -48,6 +48,11 @@ const userSchema = new Schema(
       type: Boolean,
       default: false
     },
+    favoriteCourses:
+    {
+      type: Array,
+      default: []
+    },
     profileImage: {
       id: {
         type: String,
diff --git a/routes/index.js b/routes/index.js
index 7286c2e..3b9b1a7 100644
--- a/routes/index.js
+++ b/routes/index.js
@@ -5,6 +5,7 @@ const users = require('./users')
 const auth = require('./auth')
 const schedule = require('./schedule')
 const secrets = require('./secrets')
+const share = require('./share')
 
 const { requireAuth } = require('../middlewares')
 
@@ -15,9 +16,9 @@ router.get('/', (req, res) => {
 })
 
 router.use('/auth', auth)
-
 router.use(requireAuth())
 
+router.use('/share', share)
 router.use('/users', users)
 router.use('/schedule', schedule)
 router.use('/secrets', secrets)
diff --git a/routes/share.js b/routes/share.js
new file mode 100644
index 0000000..b60024c
--- /dev/null
+++ b/routes/share.js
@@ -0,0 +1,7 @@
+const router = require('express').Router()
+const { shareController } = require('../controllers')
+
+router.get('/', shareController.getFavorites)
+router.patch('/favoriteCourses', shareController.updateFavorites)
+router.patch('/shareRecivers', shareController.updateRecivers)
+module.exports = router