Mooncake — Legal

Draft, version 10 (2026-10-13) — not yet reviewed by a lawyer. Operated by EXCEPXION PTE. LTD., Singapore. Questions: admin@excepxion.com.

Contents: Privacy Policy · Terms of Service · Extension and bridge licence · Contact

1. Privacy Policy

1.1 Who we are

Mooncake is operated by EXCEPXION PTE. LTD., 160 Robinson Road #14-04, Singapore Business Federation Center, Singapore 068914. For the account, sign-in, consent, usage and audit records described in this policy we are the data controller. We are also the controller for the uses of your content described in section 2.5 — operating, analysing and improving the service, including training the models we run ourselves. Storing and processing the files you give us is done on your instructions, and you can take your files out or have them erased at any time (1.8).

For any privacy question or request, contact admin@excepxion.com.

1.2 What we collect

We do not collect advertising identifiers, contacts, precise location, browsing history, or third-party analytics. A workspace is yours alone: every file is stored under a prefix that carries your account id, and database rows are filtered to your account at the database level.

1.3 Your files and the AI models

Mooncake stores the files you upload. Where a feature asks a language model for help, it sends what that one task needs to one of these:

• Our own model, on our own hardware — the local Mooncake Tutor in Mooncake Chat. What it is sent does not leave our hardware.
• Anthropic (Claude) and OpenAI, through their APIs, paid by us — Exam Buster sends each page image of a paper to the reader you choose (OpenAI or Claude) to read it, and the page texts to the same provider to evaluate the answers; the review against curriculum and age sends the learner's age, grade, curriculum, school and location (never the name) with the questions and answers to OpenAI; and the OpenAI tutor in Mooncake Chat sends the conversation to OpenAI - in a child's chat with a tutor, with the tutor's messages and comments and the tutor's name. In a workshop, OpenAI also drafts the child's assessment (from the papers and chats the tutor chose), the plan of sessions, and a proposed mark for homework (from its chat and the reading of its photographed pages, which are read as a paper's). A page image shows whatever is on the paper, a name included.

In a child's account (1.9) only our own model and OpenAI are used: a child's papers are read and reviewed with OpenAI, and nothing from a child's account is sent to Anthropic.

We send content to those providers only to answer that request; they process it under their own terms for API customers.

What we keep: the files you upload, your conversations in Mooncake Chat, and what Exam Buster produces for a paper (the readings, the evaluation, the review and the training plan), all in your account. You can delete a chat from the Chats list (a paper's own chat is not listed there). Apart from that, the text of prompts and model replies is not stored by us: for each model call we keep counts only. A child's messages are also read by our own model for signs of their wellbeing (1.9); what is kept is the sign, never the words.

What is in your workspace — what you upload and what we generate for you — we may use to operate, analyse and improve the service, including training and evaluating the models we run on our own hardware, under the licence in 2.5. We never send your content to a third-party provider for that provider's training.

No AI agent with tools is ever run over your files on our servers: each model call is a plain request carrying what that one task needs, and the reply is returned to you. If you install the optional browser extension and bridge (section 3), a task may instead be answered by your own AI command-line tool on your own computer; we never see, store or relay that tool's sign-in.

1.4 Why we process it, and on what legal basis

To provide the service you asked for — signing you in, keeping your workspace, answering the requests you make — which is necessary to perform our agreement with you.

Where processing goes beyond that we ask first and keep the record: the consent statement you accept at sign-up (scope data_processing) and your acceptance of these terms (scope terms). Each acceptance stores the exact text you saw and its version; if a statement changes you are asked again before you continue. Withdrawing consent is recorded as its own event and ends the service for that scope.

We also process data to keep the service secure and working — hashed session and login records, rate limiting, audit — on our legitimate interest in operating a reliable service.

Using your content to improve the service, including training the models we run ourselves (2.5), rests on the licence you grant and on the consent statement you accept at sign-up, which names that use.

1.5 Who we share it with

We do not sell your data and we do not share it for advertising.

• Telegram — sign-in happens through Telegram; Telegram processes your user id and the messages of the bot conversation under its own terms.
• Anthropic and OpenAI — the AI providers named in 1.3, only for the requests described there, through their APIs.
• The parents, guardians and tutors you invite — a parent or guardian who joins your family sees and manages everything about your children that you do; a tutor sees, read-only, the Exam Buster papers, readings, reviews and training plans of the children you choose, and in Mooncake Chat the chats of a child that the child or a parent invites it into, or all of that child's chats if you grant it full review. You choose them, and you can remove them at any time.
• A school or an education company you enrol your child with — Mooncake checks each organisation (its UEN and the organisation itself) before it can invite anyone. Its tutor for the course sees your child's course workshop - its chats, assessment, homework and marks - and writes to your child there; never your child's other chats, papers or profile. Its admins see the course plan and your child's record: sessions attended, homework handed in and confirmed marks. Its safeguarding contact is told when Mooncake sees a sign that your child may be upset in a course chat, and may read that chat. A new tutor for the course sees nothing until you approve them; you can take your child out of the course at any time.
• Your family's Telegram group — once you set one up, Mooncake posts your children's wellbeing alerts and a daily and weekly activity report there, for the family's parents and guardians only: Mooncake removes anyone else from it. Telegram carries the group under its own terms.
• A payment provider (Stripe) — only if you buy credits, and only what a card payment needs. Credit purchases are not offered yet; the billing service ships disabled.

Nothing else.

1.6 International transfers

Our infrastructure is operated by us in Singapore. What is sent to Anthropic or OpenAI (1.3) is processed by them where they operate, which may be outside Singapore; everything else stays on our infrastructure. If you are outside Singapore, using the service means your data is transferred to and processed in Singapore.

Where we transfer personal data outside the jurisdiction in which it was collected, we do so under appropriate safeguards, including standard contractual clauses where they apply.

1.7 How long we keep it

Retention figures are the design defaults from docs/PRIVACY.md; the operator confirms them before publication.

1.8 Your rights

You can, at any time: download everything we hold about you as one archive (your workspace, its backups, and your account records); correct anything by replacing your own files; withdraw a consent you have given; and erase your account. Erasure signs you out everywhere, unpairs your extension, removes your workspace including every earlier version of every file, deletes your account rows, and keeps only a receipt that it happened (counts, no personal data) together with the retention-limited records in 1.7 with your account id removed. What has already been derived from your content in a form that no longer identifies you — model training, aggregated statistics — is not reversed by erasure (2.6).

Where the Singapore Personal Data Protection Act applies you have rights of access and correction; where the GDPR applies you have the rights of access, rectification, erasure, portability, restriction, objection and withdrawal of consent. Write to admin@excepxion.com and we will respond within 30 days. If you believe we have handled your data improperly you may complain to your local data protection authority, or in Singapore to the Personal Data Protection Commission.

1.9 Children

Mooncake accounts are held by adults: sign-up asks you to confirm you are 18 or older and stores only that you confirmed it. An adult may add their children as learners. Each child gets a learner account of its own: we keep the child's name, age, grade and curriculum (and school and location if given), and the papers, files and chats they create, as for any account. A child has no Telegram identity with us. You may give us your child's e-mail address so they can sign in with a link we e-mail them; you approve, in Telegram, each new browser they sign in on. You add a child only as their parent or legal guardian; you can see their papers and chats by switching to their view, and every switch is recorded. When you add a child you consent, as their parent or legal guardian, to their use of the AI features in 1.3; in their account their work goes only to our own model and to OpenAI. The consent is recorded with its exact text.

Wellbeing. Mooncake reads each message a child writes in Mooncake Chat with our own model, on our own hardware, for signs that they may be unhappy, distressed, low or thinking about hurting themselves. When it sees one it records which chat, what kind of sign, how strong and when — never what the child wrote — and tells you in your family's Telegram group (or in the Telegram bot until you set one up) and under Wellbeing in Mooncake; you read the chat by switching to the child. The check is automatic: it can miss a sign or see one that is not there, and it is not a diagnosis or a substitute for care. The tutor answers a child who seems upset kindly and points them to you and to helplines, and the child is reminded in the chat that you are told.

Other parents and tutors. You can invite another parent or guardian of your children, who then has the same rights as you over them, and tutors, who see read-only the Exam Buster papers, readings, reviews and training plans of the children you choose — never their profile. In Mooncake Chat, a child or a parent can invite one of the child's tutors into a chat: the tutor reads that chat, writes to the child in it — the child sees the message, with the tutor's name — and comments on any message, as guidance Mooncake follows in that chat; the child does not see the comments, the parents do. A tutor can leave a chat; only a parent or guardian removes one. You can also let a tutor read and comment on all of a child's chats (full review), without writing in them. What a tutor writes is kept on record.

Workshops. You can start a workshop for a child with one of its tutors: the tutor assesses the child (from a short check-up chat with Mooncake, the child's Exam Buster papers the tutor chooses, a live chat with the child; Mooncake drafts the assessment, the tutor signs it off), plans the sessions (Mooncake drafts them, the tutor approves), runs them in the child's chats - which follow the plan - and sets homework, done in a chat where Mooncake gives hints rather than answers and/or on paper and photographed; Mooncake reads the photographs and proposes a mark, the tutor confirms it, and only then do the child and you see it. The child does not see the assessment, the full plan or Mooncake's proposed marks; you see everything. You can give a workshop to another of your children: it starts again with an assessment of that child. Schools and education companies. An organisation that Mooncake has approved can e-mail you a link to enrol your child in one of its courses. On that page you sign in (or join Mooncake), choose your child or add them, and accept a consent that names the organisation, the course and its tutor and says exactly what its people see (§1.5). Your child then has a workshop of the course in your family's account - its own assessment, chats, homework and marks; in group sessions each child has their own chat and no child sees another's, while the tutor can write to the whole group. If the course is taught on the organisation's own computers, your child signs in there with their e-mailed link without your approval each time, to the course only, for up to 4 hours. When Mooncake sees a sign that your child may be upset in a course chat, it tells you and the organisation's safeguarding contact. A new tutor sees nothing of your child until you approve them. You can take your child out of a course at any time: the organisation's people lose access at once and it keeps only its record (sessions attended, homework handed in, confirmed marks) until your child's account is erased or it closes; the workshop and its chats stay in your family's account. A parent or guardian joins through a link Mooncake e-mails to the address you give: it opens a page where they sign in with Telegram, give their name, their relationship to each child and the name the children use for them, and accept these terms. A tutor joins with a one-time code from you. Each has a Mooncake account of their own; your acceptance and theirs are recorded with their exact text, and any parent or guardian of the family can remove a tutor, or a parent or guardian who joined.

Your family's Telegram group and activity reports. You can set up a Telegram group for your family: Mooncake's bot asks you to pick a group you created and to make it the group's admin, invites the family's other parents and guardians, and removes anyone else. It posts your children's wellbeing alerts there, a report every evening of the day's activity and one every Sunday of the week's — for each child, Exam Buster papers captured, read and reviewed and training plans ready, the number and kind of wellbeing signs, and about how long they spent in Mooncake Chat, estimated from when their messages were answered. Never what they wrote.

1.10 Security

Traffic between your browser and the service is encrypted in transit. Inside our infrastructure, services authenticate to one another with certificates issued by our own certificate authority, and network policy denies every connection that is not explicitly allowed, so each component can reach only what it needs. Your workspace is encrypted at rest. Session and login tokens are stored only as hashes. Secrets are kept in a sealed secrets store, never in application configuration. The browser extension, if you install it, holds one credential of its own — a pairing token bound to your sign-in and swapped daily — and never your session.

No system is perfectly secure. If a breach affects your personal data and is likely to put you at risk, we will notify you and the relevant authority without undue delay.

1.11 Changes to this policy

We may update this policy. If a change materially affects how we use your data, we will tell you in the service or through the Telegram bot before it takes effect, and where the change alters a consent statement you will be asked to accept the new version before you continue. The date at the top of this page shows when it was last revised.

2. Terms of Service

2.1 Acceptance

These terms are an agreement between you and EXCEPXION PTE. LTD. You accept them when you confirm the sign-up statement in the Telegram bot; that acceptance is recorded with the exact text shown to you. If you do not accept them, do not use the service.

2.2 Eligibility

You must be at least 18 to hold a Mooncake account. You may add a child only if you are their parent or legal guardian; you are responsible for their use of Mooncake. You are responsible for complying with the law where you are.

Children you add. You accept these terms for each child you add, as their parent or legal guardian, and they bind you for everything the child does on Mooncake. You are responsible and liable for the child's use of the service and for everything they submit: every obligation these terms place on you applies to you for them, the licence in 2.5 covers what they submit, you indemnify us for them (2.11), and the limit of our liability (2.10) covers every claim by them or on their behalf. A parent or guardian who joins your family accepts these terms for the children too and is bound as you are; a tutor you add keeps what it sees confidential, uses it only to help the children learn, and writes in a child's chat only for that.

2.3 Accounts

Your account is your Telegram identity: one Telegram account is one Mooncake account, and the two cannot be separated. To register you give us your name, surname and email address, confirm that you are 18 or older, and accept these terms; the account is not usable until you have verified the email address from the message we send you. Keep your Telegram account secure; if you lose access to it you lose access to Mooncake, and in this version there is no recovery path other than the export you can take at any time. We may suspend or close an account that breaches these terms.

When these terms change you are asked to accept the new version the next time you sign in, and you cannot sign in until you do. If you decline, the account is locked: you are signed out everywhere and nothing works until you accept. If you have not accepted within 3 days of declining, the account and everything in it are erased as described in 1.8. You can export your workspace before that by accepting and then erasing, or by writing to admin@excepxion.com.

2.4 Acceptable use

Do not: access the service by automated means other than the extension we provide; attempt to reach another person's workspace; place another person's personal data in your workspace unless you have their permission; upload material you have no right to hold or that is unlawful where you are; scrape or bulk-extract our service; attempt to derive our prompts or configuration; or interfere with the service's operation or security.

2.5 Your content

When you upload a file, enter text, send a message to the bot, or submit any other material ("Your Content") you grant us a worldwide, perpetual, irrevocable, non-exclusive, royalty-free and sublicensable licence to host, store, reproduce, adapt, publish and create derived works from it, and to use it to operate, analyse and improve the service — including training and evaluating the models we run. If you add a child, you grant this licence, as their parent or legal guardian, for everything the child submits; it is Your Content.

The licence also covers what the service produces from Your Content — readings, evaluations, reviews, training plans and chat replies — and any information derived from either that does not identify a person. It has no end date: it continues if you stop using the service and after erasure, which removes what identifies you or your child (1.8) and nothing else. It extends to those we work with who process Your Content on our behalf. You retain ownership of Your Content. You confirm that you have the right to submit it and that doing so does not infringe anyone else's rights.

We may remove content at our discretion. To report infringing material, contact admin@excepxion.com.

2.6 What we own

Everything we generate is ours. That includes the structured records we derive from your activity — statistics, embeddings, models and any aggregated or statistical output — together with the service, its software, its prompts, its configuration and its brand. These are our own works and our database rights; nothing in section 2.5 limits them. Where Your Content, or what the service produced from it, has been aggregated or de-identified so that it no longer identifies you or your child, the result is our data and we may retain and use it without restriction and without time limit, including after you erase your account.

What the service produces for you from your own request — a reply to a prompt you sent, a document generated from your files — is yours to use, subject to our licence in 2.5.

2.7 What this service is for

Mooncake is a private workspace with an AI assistant: it keeps the files you upload, answers requests about them, and connects to an optional extension on your own computer. That is the whole of its expertise.

Its output, where a language model produced it, can be wrong, incomplete or out of date. It is not legal, medical, immigration, employment, tax or financial advice and must not be relied on as such. You read what it produced, you decide, you act.

About this aide. Mooncake is an aide that uses generative AI. Its purpose is to drive an uplift in learning techniques and to identify gaps so they can be filled. Its output can be incomplete or wrong and must not be relied on as final: check it, and use your teachers, your school and your own judgement. In a child's chats Mooncake reminds them from time to time that it is a learning aide designed to help them focus on the gaps in their knowledge and learning.

2.8 AI features and credits

• Included models — provided as-is: the local Mooncake Tutor on our own hardware, and the Anthropic and OpenAI models named in 1.3, paid by us; with quotas we may change.
• Credits — not offered yet. When they are: prepaid credits, no refunds of unused credits except where the law requires, prices shown before you pay, payment handled by Stripe on Stripe's own page under Stripe's terms.
• Bring your own AI — you install our extension and bridge (section 3) and use your own AI command-line tool, signed in to your own subscription through its provider's own sign-in. We charge nothing for this, we never hold your provider credential, and we do not pay for, resell or intermediate your provider usage. Your use of that tool is governed by your agreement with its provider; if your provider restricts or ends it, this feature stops working for you and we are not responsible for that.

2.9 Third-party content and links

Content you bring into your workspace from elsewhere is yours to answer for. Links are provided for convenience and we are not responsible for their content.

2.10 Disclaimers and limitation of liability

The service is provided "as is" and "as available". To the fullest extent permitted by law we exclude all warranties not expressly given in these terms, and we do not warrant that the service will be uninterrupted or error-free, or that anything it produces will be fit for a particular purpose.

To the fullest extent permitted by law, we are not liable for indirect or consequential loss, or for loss of profit, opportunity, data or goodwill. Our total liability arising out of or in connection with Mooncake or these terms — to you, to any child you added, and to anyone claiming through or on behalf of either of you, for all claims together, whatever their basis and however many people bring them, individually or in a class, collective or representative action — is one fixed amount of SGD 10, paid once.

Nothing in these terms excludes liability that cannot lawfully be excluded, including for death or personal injury caused by negligence, or for fraud. If you are a consumer, your statutory rights are unaffected.

2.11 Indemnity

You agree to indemnify us against claims, losses and reasonable costs arising from your breach of these terms, your misuse of the service, or content you submit that infringes someone else's rights or that you had no right to submit — and, for each child you add, from their use of the service, the content they submit, and any claim brought by them or on their behalf.

2.12 Termination

You may stop using the service and erase your account at any time (1.8). We may suspend or terminate your access if you breach these terms or if we discontinue the service; if we discontinue it we will give you the opportunity to export your workspace first.

Sections 2.2 (as to children you added), 2.5, 2.6, 2.10, 2.11 and 2.13 survive termination.

2.13 Governing law and disputes

These terms are governed by the laws of Singapore. The courts of Singapore have exclusive jurisdiction over any dispute arising out of or in connection with them. Every claim is brought individually: you agree, for yourself and for any child you added, not to bring, join or take part in a class, collective or representative action against us. If you are a consumer resident elsewhere, this does not deprive you of the protection of mandatory consumer law in your country of residence.

3. Extension and bridge licence

Your licence to the software that runs on your own computer — the Mooncake browser extension and its native-messaging bridge — as distinct from the service terms above.

3.1 What it does

The extension pairs with your account using a one-time code shown to you while you are signed in, keeps an outbound connection to the service, and — if you choose to use your own AI tool — passes the text of a task to the bridge. The bridge starts your own, unmodified AI command-line program from your PATH with every tool disabled and no access to your files, sends it that text, and returns the reply. It runs nothing else and it runs nothing on the server's instruction other than that program.

3.2 What it never does

It never reads, copies or transmits your provider sign-in (its credential files or any ANTHROPIC_* / OPENAI_* / CLAUDE_CODE_OAUTH_TOKEN variable); never modifies, wraps or replaces the provider's program; never automates a provider's website; never touches files on your computer beyond its own folder and its own log; and never holds your Mooncake session — only a pairing token of its own, which signing out revokes. Unpairing in the service, or uninstalling the extension, ends its access immediately.

3.3 Licence

The extension and the bridge are the property of EXCEPXION PTE. LTD., all rights reserved. We grant you a personal, non-transferable, non-exclusive licence to install and use them on computers you own or control, with your own Mooncake account, for your own use. You may not copy, redistribute, modify, reverse engineer or sublicense them. The licence transfers no ownership. The provider's own program is not ours and is governed by your agreement with its provider.

4. Contact

EXCEPXION PTE. LTD. 160 Robinson Road #14-04 Singapore Business Federation Center Singapore 068914

Support and general enquiries: admin@excepxion.com Privacy and data requests: admin@excepxion.com Responsible contact: Llewellyn Vaughan

© 2026 EXCEPXION PTE. LTD. · Singapore. All rights reserved.

5. Organisation terms

These terms apply to a school or an education company (the organisation) that uses Mooncake, in addition to the Terms of Service. The person who applies accepts them for the organisation and confirms they are authorised to act for it.

5.1 Approval

Mooncake checks every organisation - its UEN and the organisation itself - before it can invite anyone, and may refuse an application, or suspend or close an organisation, at any time. While it is suspended its people reach no child; when it is closed its courses and its records are deleted and its people leave it.

5.2 Its people

The organisation gives roles to its people: admins (its details, people, courses, enrolment links, computers and records), tutors (the courses they are given) and safeguarding contacts. It chooses and checks them, keeps at least one admin, and answers for their use of Mooncake. Each joins with their own Mooncake account and accepts the staff wording, which is kept with its exact text.

5.3 Children and their parents

A child takes part only when a parent or guardian enrols them, with a consent that names the organisation and says what its people see; the parent can withdraw the child at any time, and a new tutor for a course sees nothing of a child until a parent approves them. The organisation uses what its people see only to teach the courses the parents enrol their children in and to keep the children safe, and keeps it confidential.

5.4 Safeguarding

When Mooncake sees a sign that a child may be upset in one of the organisation's course chats, it tells the child's parents and the organisation's safeguarding contacts. The check is automatic and can be wrong; it is not a diagnosis. The message names the child, the course, the kind of sign and the time, never what the child wrote; the safeguarding contact may read that chat.

5.5 The organisation's computers

A computer the organisation's admin approves signs an enrolled child in to the organisation's courses only, for up to 4 hours and until the browser closes. Mooncake asks the admin to sign out of a computer once it is approved.

5.6 Its record

The organisation keeps, in Mooncake, a record of each child's course - sessions attended, homework handed in and confirmed marks - after the child leaves, until the child's account is erased or the organisation closes.

5.7 Fees

Mooncake counts each organisation's use of its AI per course and child. Nothing is charged for it today.