# Mooncake — Legal

Draft, version 10 (2026-10-13) — not yet reviewed by a lawyer. Operated by EXCEPXION PTE. LTD., Singapore. Questions: admin@excepxion.com.

Contents: [Privacy Policy](#privacy) · [Terms of Service](#terms) · [Extension and bridge licence](#extension) · [Contact](#contact)

## 1. Privacy Policy

### 1.1 Who we are

Mooncake is operated by EXCEPXION PTE. LTD., 160 Robinson Road #14-04, Singapore Business
Federation Center, Singapore 068914. For the account, sign-in, consent, usage and audit records
described in this policy we are the data controller. We are also the controller for the uses of
your content described in section 2.5 — operating, analysing and improving the service,
including training the models we run ourselves. Storing and processing the files you give us is
done on your instructions, and you can take your files out or have them erased at any time (1.8).

For any privacy question or request, contact admin@excepxion.com.

### 1.2 What we collect

| Category | Linked to you | Purpose | Where it is kept |
|---|---|---|---|
| Telegram user id and username | Yes | Sign-in; recognising you | `telegram_identities` |
| Your name, surname and email address, and the time you confirmed you are 18 or older (we store that confirmation only — never a date of birth or an age) | Yes | Your account; verifying your email; contacting you about it | `registration_profiles` |
| Email verification token (stored hashed, 24 hours) | Yes | Proving the address is yours | `email_verifications` |
| The files you upload and the folders you keep them in | Yes | The service | your workspace, `tenants/<your id>/root/`, and the dated backups we keep of files you overwrite, `tenants/<your id>/backups/` |
| Your conversations in Mooncake Chat — what you send and the replies, and in a child's chat what a tutor the child or a parent invited wrote there | Yes | The service: your chat history | Mooncake Chat's database |
| A tutor in a child's chats — which chats it was invited into, by whom and when, when it left or was removed and by whom, whether a parent let it review all of the child's chats (full review), and what it wrote: its messages to the child and its comments for Mooncake (each about one message, with the start of that message) | Yes (the child) | Showing the tutor's messages in the chat; following the tutor's guidance; the record of what a tutor said | `chat_participants`, `tutor_messages`, `tutor_assignments` |
| Workshops a parent starts for a child — the subject, the goal, the tutor; the papers and chats the tutor assessed the child from, Mooncake's draft and the tutor's assessment; the plan of sessions; which chats are the workshop's sessions; homework — what to do, when it is due, the child's homework chat and photographs of work on paper, their reading, Mooncake's proposed mark and the tutor's mark and feedback | Yes (the child) | Running the workshop; the parents seeing how it goes | `workshops`, `workshop_exams`, `workshop_assessments`, `workshop_plans`, `workshop_sessions`, `workshop_homework`, your workspace (the photographs) |
| Schools and education companies — for an organisation: its name, kind, UEN, web site, address and contact, who applied and Mooncake's decision; its people (admins, tutors, safeguarding contacts) and the invitations they were sent (an e-mail address, a link kept only as a hash); its approved computers (a name and a random browser id kept only as a hash) | Yes | Running the organisation's account; Mooncake's check of it | `organisations`, `organisation_members`, `organisation_invites`, `organisation_devices` |
| An organisation's courses and a child's enrolment — the course, its tutor and the tutors before, its plan, its sessions and homework for the group; the enrolment links sent to parents; your enrolment of a child and your approval of each tutor (with their exact text); what the tutor wrote to the whole group; the child's course workshop (as a workshop above); when the child joined and left | Yes (the child) | Running the course; the organisation's record | `courses`, `course_tutors`, `course_invites`, `enrolments`, `enrolment_tutor_approvals`, `course_sessions`, `course_homework`, `course_messages`, `workshops` |
| A sign-in on an organisation's computer — a child's session that opens the course only, which organisation, until when | Yes (the child) | Signing the child in at the organisation without your approval each time | `sessions` |
| Wellbeing flags on a child's chats — which chat, what kind of sign (unhappy, distressed, low, thinking about self-harm), how strong, when; never what the child wrote; on a course's chat, which organisation and course and when its safeguarding contacts were told | Yes (the child) | Telling the child's parent or guardian (and, for a course's chat, the organisation's safeguarding contact) | `wellbeing_flags` |
| The other parents or guardians who joined your family and your children's tutors — who invited whom, when, which children a tutor tutors, and what a parent or guardian who joined told us: their relationship to each child (mother, father, step-parent, legal guardian or other) and the name the children use for them | Yes | Letting them manage, or read, what you chose; showing the family who is who | `family_guardians`, `guardian_relationships`, `tutor_assignments` |
| Invitations you create — for a parent or guardian the e-mail address you give and a link (stored only as a hash), for a tutor a one-time code (stored only as a hash) and which children; who it is for, when it expires | Yes | Inviting a parent/guardian or a tutor | `family_invites` |
| A child's e-mail address, if you give it, and the browsers you approved for the child (a random browser id we keep only as a hash, and a label such as "Chrome on Windows") | Yes (the child) | The child's sign-in with an e-mailed link | `child_emails`, `child_devices` |
| E-mailed sign-in links — for which account, when, until when, the number the browser showed (the link itself only as a hash) | Yes | Signing you or your child in by e-mail | `email_logins` |
| Your family's Telegram group — its id and name, which of the family's parents and guardians are in it, which activity reports were sent | Yes | Posting the wellbeing alerts and the activity reports there, for the family only | `family_groups`, `family_group_members`, `family_reports` |
| The id of your private Telegram chat with the bot | Yes | Writing to you first, such as a wellbeing message about your child | `telegram_identities` |
| What Exam Buster produces for a paper — the readings of its pages, the evaluation of the answers, the review and the training plan | Yes | The service | `exam_readings`, `exam_reviews` |
| An index of those files — name, size, checksum, content type, when uploaded (never the content) | Yes | Listing your workspace quickly | `tenant_files` |
| A display name you choose | Yes | Showing it to you | `tenants` |
| Usage counts — model, timing and size of each model call made for you | Yes | Quotas, credits, operating the service | `usage_events` |
| Session tokens and one-time login codes (stored hashed), and a salted hash of the network address used at sign-in | Yes | Keeping your account secure; rate limiting | `sessions`, `login_nonces` |
| A pairing record for the browser extension, if you install it — its id, when it paired, when it was last seen, its version (never a credential of yours) | Yes | Connecting your extension to your account | `extension_pairings` |
| Your consent records — the exact statement shown to you, its version, a hash of it, when and through which channel you accepted | Yes | Proof of what you agreed to | `consent_acceptances` |
| Credit purchases and payment events, if you buy credits | Yes | Bookkeeping | `credits_ledger`, `psp_events` |
| Audit events — what the service did for you (never the content of a file, a prompt or a secret) | Yes | Accountability | `audit_log` |

We do not collect advertising identifiers, contacts, precise location, browsing history, or
third-party analytics. A workspace is yours alone: every file is stored
under a prefix that carries your account id, and database rows are filtered to your account at
the database level.

### 1.3 Your files and the AI models

Mooncake stores the files you upload. Where a feature asks a language model for help, it sends what
that one task needs to one of these:

- **Our own model, on our own hardware** — the local Mooncake Tutor in Mooncake Chat. What it is
  sent does not leave our hardware.
- **Anthropic (Claude) and OpenAI, through their APIs, paid by us** — Exam Buster sends each page
  image of a paper to the reader you choose (OpenAI or Claude) to read it, and the page texts to
  the same provider to evaluate the answers; the review against curriculum and age sends the
  learner's age, grade, curriculum, school and location (never the name) with the questions and
  answers to OpenAI; and the OpenAI tutor in Mooncake Chat sends the conversation to OpenAI - in a
  child's chat with a tutor, with the tutor's messages and comments and the tutor's name. In a
  workshop, OpenAI also drafts the child's assessment (from the papers and chats the tutor chose),
  the plan of sessions, and a proposed mark for homework (from its chat and the reading of its
  photographed pages, which are read as a paper's). A page image shows whatever is on the paper, a
  name included.

In a child's account (1.9) only our own model and OpenAI are used: a child's papers are read and
reviewed with OpenAI, and nothing from a child's account is sent to Anthropic.

We send content to those providers only to answer that request; they process it under their own
terms for API customers.

What we keep: the files you upload, your conversations in Mooncake Chat, and what Exam Buster
produces for a paper (the readings, the evaluation, the review and the training plan), all in your
account. You can delete a chat from the Chats list (a paper's own chat is not listed there).
Apart from that, the text of prompts and model replies is not stored by us: for each model call we
keep counts only. A child's messages are also read by our own model for signs
of their wellbeing (1.9); what is kept is the sign, never the words.

What is in your workspace — what you upload and what we generate for you — we may use to operate,
analyse and improve the service, including training and evaluating the models we run on our own
hardware, under the licence in 2.5. We never send your content to a third-party provider for that
provider's training.

No AI agent with tools is ever run over your files on our servers: each
model call is a plain request carrying what that one task needs, and the reply is returned to
you. If you install the optional browser extension and bridge (section 3), a task may
instead be answered by your own AI command-line tool on your own computer; we never see, store or
relay that tool's sign-in.

### 1.4 Why we process it, and on what legal basis

To provide the service you asked for — signing you in, keeping your workspace, answering the
requests you make — which is necessary to perform our agreement with you.

Where processing goes beyond that we ask first and keep the record: the consent statement you
accept at sign-up (scope `data_processing`) and your acceptance of these terms (scope `terms`).
Each acceptance stores the exact text you saw and its version; if a statement changes you are
asked again before you continue. Withdrawing consent is recorded as its own event and ends the
service for that scope.

We also process data to keep the service secure and working — hashed session and login
records, rate limiting, audit — on our legitimate interest in operating a reliable service.

Using your content to improve the service, including training the models we run ourselves
(2.5), rests on the licence you grant and on the consent statement you accept at sign-up,
which names that use.

### 1.5 Who we share it with

We do not sell your data and we do not share it for advertising.

- **Telegram** — sign-in happens through Telegram; Telegram processes your user id and the
  messages of the bot conversation under its own terms.
- **Anthropic and OpenAI** — the AI providers named in 1.3, only for the requests described there,
  through their APIs.
- **The parents, guardians and tutors you invite** — a parent or guardian who joins your family sees
  and manages everything about your children that you do; a tutor sees, read-only, the Exam Buster
  papers, readings, reviews and training plans of the children you choose, and in Mooncake Chat the
  chats of a child that the child or a parent invites it into, or all of that child's chats if you grant
  it full review. You choose them, and you can remove them at any time.
- **A school or an education company you enrol your child with** — Mooncake checks each organisation (its UEN
  and the organisation itself) before it can invite anyone. Its tutor for the course sees your child's course
  workshop - its chats, assessment, homework and marks - and writes to your child there; never your child's other chats,
  papers or profile. Its admins see the course plan and your child's record: sessions attended, homework handed in and
  confirmed marks. Its safeguarding contact is told when Mooncake sees a sign that your child may be upset in a course
  chat, and may read that chat. A new tutor for the course sees nothing until you approve them; you can take your child
  out of the course at any time.
- **Your family's Telegram group** — once you set one up, Mooncake posts your children's wellbeing alerts
  and a daily and weekly activity report there, for the family's parents and guardians only: Mooncake
  removes anyone else from it. Telegram carries the group under its own terms.
- **A payment provider (Stripe)** — only if you buy credits, and only what a card payment needs.
  Credit purchases are not offered yet; the billing service ships disabled.

Nothing else.

### 1.6 International transfers

Our infrastructure is operated by us in Singapore. What is sent to Anthropic or OpenAI (1.3) is
processed by them where they operate, which may be outside Singapore; everything else stays on our
infrastructure. If you are outside Singapore, using the service means your data is transferred to
and processed in Singapore.

Where we transfer personal data outside the jurisdiction in which it was collected, we do so
under appropriate safeguards, including standard contractual clauses where they apply.

### 1.7 How long we keep it

| Data | Kept | Then |
|---|---|---|
| Your workspace (the files you upload) and the dated backups of files you overwrite | until you delete them or erase your account; earlier object versions for 30 days | purged, all versions |
| Telegram identity, name, surname, email, 18+ confirmation | until erasure | deleted |
| Email verification tokens | 24 hours | deleted |
| An account locked because you declined a new version of these terms | 3 days | erased (1.8) |
| Sessions | 30 days, sliding | deleted |
| Login codes | 10 minutes | deleted |
| Extension pairing | until you pair again, sign out, or erase your account | deleted |
| Usage counts | until erasure | deleted |
| Wellbeing flags on a child's chats | until the child's account is erased | deleted |
| A parent/guardian's or a tutor's link to your family | until removed, or either account is erased | deleted |
| A tutor's place in a child's chats and the record of what it wrote | until the child's or the tutor's account is erased (its messages also stay in the child's chat, as long as that chat) | deleted |
| Workshops, their assessment, plan, sessions and homework (with its marks) | until the child's account is erased (a workshop is archived, never deleted, before that) | deleted |
| An organisation's record of your child's course (sessions attended, homework handed in, confirmed marks) | until your child's account is erased or the organisation closes - after your child leaves the course too | deleted |
| An organisation's account, its people (with their history) and its approved computers | until the organisation closes or the account of the person is erased; a closed organisation's name, UEN and Mooncake's decisions stay | deleted |
| Staff invitations and enrolment links | until the organisation closes (a link works once, for 14 days) | deleted |
| A sign-in on an organisation's computer | 4 hours at most, and until the browser closes | ended |
| Invitations | until your account is erased (a code or link works once, for 7 days) | deleted |
| A child's e-mail address and approved browsers | until you remove them, or the child's account is erased | deleted |
| E-mailed sign-in links | a day after they expire (a link works once, for at most 30 minutes) | deleted |
| Your family's Telegram group and its members | until you or Mooncake leave it, or the family's account is erased | deleted |
| Consent records | 2 years after erasure, with your account id removed | deleted |
| Credits ledger and payment events (when billing exists) | 10 years for bookkeeping, with your account id removed | deleted |
| Audit events | 2 years | deleted |

Retention figures are the design defaults from `docs/PRIVACY.md`; the operator confirms them
before publication.

### 1.8 Your rights

You can, at any time: download everything we hold about you as one archive (your workspace,
its backups, and your account records); correct anything by replacing your own files; withdraw a
consent you have given; and erase your account. Erasure signs you out everywhere, unpairs your
extension, removes your workspace including every earlier version of every file, deletes your
account rows, and keeps only a receipt that it happened (counts, no personal data) together with
the retention-limited records in 1.7 with your account id removed. What has already been derived
from your content in a form that no longer identifies you — model training, aggregated
statistics — is not reversed by erasure (2.6).

Where the Singapore Personal Data Protection Act applies you have rights of access and
correction; where the GDPR applies you have the rights of access, rectification, erasure,
portability, restriction, objection and withdrawal of consent. Write to admin@excepxion.com
and we will respond within 30 days. If you believe we have handled your data improperly you may
complain to your local data protection authority, or in Singapore to the Personal Data
Protection Commission.

### 1.9 Children

Mooncake accounts are held by adults: sign-up asks you to confirm you are 18 or older and stores
only that you confirmed it. An adult may add their children as learners. Each child gets a
learner account of its own: we keep the child's name, age, grade and curriculum (and school and
location if given), and the papers, files and chats they create, as for any account. A child has
no Telegram identity with us. You may give us your child's e-mail address so they can sign in with a
link we e-mail them; you approve, in Telegram, each new browser they sign in on.
You add a child only as their parent or legal guardian;
you can see their papers and chats by switching to their view, and every switch is recorded.
When you add a child you consent, as their parent or legal guardian, to their use of the AI
features in 1.3; in their account their work goes only to our own model and to OpenAI. The consent
is recorded with its exact text.

**Wellbeing.** Mooncake reads each message a child writes in Mooncake Chat with our own model, on
our own hardware, for signs that they may be unhappy, distressed, low or thinking about hurting
themselves. When it sees one it records which chat, what kind of sign, how
strong and when — never what the child wrote — and tells you in your family's Telegram group (or in the
Telegram bot until you set one up) and under Wellbeing in Mooncake; you read the chat by switching to the child. The check is automatic: it can miss a sign or
see one that is not there, and it is not a diagnosis or a substitute for care. The tutor answers a
child who seems upset kindly and points them to you and to helplines, and the child is reminded in
the chat that you are told.

**Other parents and tutors.** You can invite another parent or guardian of your children, who then
has the same rights as you over them, and tutors, who see read-only the Exam Buster papers, readings,
reviews and training plans of the children you choose — never their profile.
In Mooncake Chat, a child or a parent can invite one of the child's tutors into a chat: the tutor reads
that chat, writes to the child in it — the child sees the message, with the tutor's name — and comments
on any message, as guidance Mooncake follows in that chat; the child does not see the comments, the
parents do. A tutor can leave a chat; only a parent or guardian removes one. You can also let a tutor
read and comment on all of a child's chats (full review), without writing in them. What a tutor writes
is kept on record.

**Workshops.** You can start a workshop for a child with one of its tutors: the tutor assesses the
child (from a short check-up chat with Mooncake, the child's Exam Buster papers the tutor chooses, a
live chat with the child; Mooncake drafts the assessment, the tutor signs it off), plans the sessions
(Mooncake drafts them, the tutor approves), runs them in the child's chats - which follow the plan -
and sets homework, done in a chat where Mooncake gives hints rather than answers and/or on paper and
photographed; Mooncake reads the photographs and proposes a mark, the tutor confirms it, and only then
do the child and you see it. The child does not see the assessment, the full plan or Mooncake's
proposed marks; you see everything. You can give a workshop to another of your children: it starts
again with an assessment of that child.
**Schools and education companies.** An organisation that Mooncake has approved can e-mail you a link to enrol your
child in one of its courses. On that page you sign in (or join Mooncake), choose your child or add them, and accept a
consent that names the organisation, the course and its tutor and says exactly what its people see (§1.5). Your child
then has a workshop of the course in your family's account - its own assessment, chats, homework and marks; in group
sessions each child has their own chat and no child sees another's, while the tutor can write to the whole group. If the
course is taught on the organisation's own computers, your child signs in there with their e-mailed link without your
approval each time, to the course only, for up to 4 hours. When Mooncake sees a sign that your child may be upset in a
course chat, it tells you and the organisation's safeguarding contact. A new tutor sees nothing of your child until you
approve them. You can take your child out of a course at any time: the organisation's people lose access at once and it
keeps only its record (sessions attended, homework handed in, confirmed marks) until your child's account is erased or it
closes; the workshop and its chats stay in your family's account.
A parent or guardian joins through a link Mooncake e-mails to the address you give: it opens a page where
they sign in with Telegram, give their name, their relationship to each child and the name the children use
for them, and accept these terms. A tutor joins with a one-time code from you. Each has a Mooncake account of
their own; your acceptance and theirs are
recorded with their exact text, and any parent or guardian of the family can remove a tutor, or a
parent or guardian who joined.

**Your family's Telegram group and activity reports.** You can set up a Telegram group for your
family: Mooncake's bot asks you to pick a group you created and to make it the group's admin, invites
the family's other parents and guardians, and removes anyone else. It posts
your children's wellbeing alerts there, a report every evening of the day's activity and one every
Sunday of the week's — for each child, Exam Buster papers captured, read and reviewed and training
plans ready, the number and kind of wellbeing signs, and about how long they spent in Mooncake Chat,
estimated from when their messages were answered. Never what they wrote.

### 1.10 Security

Traffic between your browser and the service is encrypted in transit. Inside our
infrastructure, services authenticate to one another with certificates issued by our own
certificate authority, and network policy denies every connection that is not explicitly
allowed, so each component can reach only what it needs. Your workspace is encrypted at rest.
Session and login tokens are stored only as hashes. Secrets are kept in a sealed secrets store,
never in application configuration. The browser extension, if you install it, holds one
credential of its own — a pairing token bound to your sign-in and swapped daily — and never
your session.

No system is perfectly secure. If a breach affects your personal data and is likely to put you
at risk, we will notify you and the relevant authority without undue delay.

### 1.11 Changes to this policy

We may update this policy. If a change materially affects how we use your data, we will tell
you in the service or through the Telegram bot before it takes effect, and where the change
alters a consent statement you will be asked to accept the new version before you continue.
The date at the top of this page shows when it was last revised.

---

## 2. Terms of Service

### 2.1 Acceptance

These terms are an agreement between you and EXCEPXION PTE. LTD. You accept them when you
confirm the sign-up statement in the Telegram bot; that acceptance is recorded with the exact
text shown to you. If you do not accept them, do not use the service.

### 2.2 Eligibility

You must be at least 18 to hold a Mooncake account. You may add a child only if you are their
parent or legal guardian; you are responsible for their use of Mooncake. You are responsible for
complying with the law where you are.

**Children you add.** You accept these terms for each child you add, as their parent or legal
guardian, and they bind you for everything the child does on Mooncake. You are responsible and
liable for the child's use of the service and for everything they submit: every obligation these
terms place on you applies to you for them, the licence in 2.5 covers what they submit, you
indemnify us for them (2.11), and the limit of our liability (2.10) covers every claim by them or on
their behalf. A parent or guardian who joins your family accepts these terms for the children too and
is bound as you are; a tutor you add keeps what it sees confidential, uses it only to help the
children learn, and writes in a child's chat only for that.

### 2.3 Accounts

Your account is your Telegram identity: one Telegram account is one Mooncake account, and the
two cannot be separated. To register you give us your name, surname and email address, confirm
that you are 18 or older, and accept these terms; the account is not usable until you have
verified the email address from the message we send you. Keep your Telegram account secure; if
you lose access to it you lose access to Mooncake, and in this version there is no recovery
path other than the export you can take at any time. We may suspend or close an account that
breaches these terms.

When these terms change you are asked to accept the new version the next time you sign in, and
you cannot sign in until you do. If you decline, the account is locked: you are signed out
everywhere and nothing works until you accept. **If you have not accepted within 3 days of
declining, the account and everything in it are erased** as described in 1.8. You can export your
workspace before that by accepting and then erasing, or by writing to admin@excepxion.com.

### 2.4 Acceptable use

Do not: access the service by automated means other than the extension we provide; attempt to
reach another person's workspace; place another person's personal data in your workspace unless
you have their permission; upload material you have no right to hold or that is unlawful where
you are; scrape or bulk-extract our service; attempt to derive our prompts or configuration; or
interfere with the service's operation or security.

### 2.5 Your content

When you upload a file, enter text, send a message to the bot, or submit any other material
("Your Content") you grant us a worldwide, perpetual, irrevocable, non-exclusive, royalty-free
and sublicensable licence to host, store, reproduce, adapt, publish and create derived works
from it, and to use it to operate, analyse and improve the service — including training and
evaluating the models we run. If you add a child, you grant this licence, as their parent or
legal guardian, for everything the child submits; it is Your Content.

The licence also covers what the service produces from Your Content — readings, evaluations,
reviews, training plans and chat replies — and any information derived from either that does not
identify a person. It has no end date: it continues if you stop using the service and after
erasure, which removes what identifies you or your child (1.8) and nothing else. It extends to those we work with who process Your Content on our behalf. You retain ownership of Your Content. You confirm that
you have the right to submit it and that doing so does not infringe anyone else's rights.

We may remove content at our discretion. To report infringing material, contact
admin@excepxion.com.

### 2.6 What we own

Everything we generate is ours. That includes the structured records we derive from your
activity — statistics, embeddings, models and any aggregated or statistical output — together
with the service, its software, its prompts, its configuration and its brand. These are our own
works and our database rights; nothing in section 2.5 limits them. Where Your Content, or what the
service produced from it, has been aggregated or de-identified so that it no longer identifies you
or your child, the result is our data and we may retain and use it without restriction and without
time limit, including after you erase your account.

What the service produces *for you* from your own request — a reply to a prompt you sent, a
document generated from your files — is yours to use, subject to our licence in 2.5.

### 2.7 What this service is for

Mooncake is a private workspace with an AI assistant: it keeps the files you upload, answers
requests about them, and connects to an optional extension on your own computer. That is the
whole of its expertise.

Its output, where a language model produced it, can be wrong, incomplete or out of date. It is
not legal, medical, immigration, employment, tax or financial advice and must not be relied on as
such. You read what it produced, you decide, you act.

**About this aide.** Mooncake is an aide that uses generative AI. Its purpose is to drive an uplift
in learning techniques and to identify gaps so they can be filled. Its output can be incomplete or
wrong and must not be relied on as final: check it, and use your teachers, your school and your
own judgement. In a child's chats Mooncake reminds them from time to time that it is a learning
aide designed to help them focus on the gaps in their knowledge and learning.

### 2.8 AI features and credits

- **Included models** — provided as-is: the local Mooncake Tutor on our own hardware, and the
  Anthropic and OpenAI models named in 1.3, paid by us; with quotas we may change.
- **Credits** — *not offered yet.* When they are: prepaid credits, no refunds of unused credits
  except where the law requires, prices shown before you pay, payment handled by Stripe on
  Stripe's own page under Stripe's terms.
- **Bring your own AI** — you install our extension and bridge (section 3) and use your own
  AI command-line tool, signed in to your own subscription through its provider's own sign-in.
  We charge nothing for this, we never hold your provider credential, and we do not pay for,
  resell or intermediate your provider usage. Your use of that tool is governed by your
  agreement with its provider; if your provider restricts or ends it, this feature stops working
  for you and we are not responsible for that.

### 2.9 Third-party content and links

Content you bring into your workspace from elsewhere is yours to answer for. Links are provided
for convenience and we are not responsible for their content.

### 2.10 Disclaimers and limitation of liability

The service is provided "as is" and "as available". To the fullest extent permitted by law we
exclude all warranties not expressly given in these terms, and we do not warrant that the
service will be uninterrupted or error-free, or that anything it produces will be fit for a
particular purpose.

To the fullest extent permitted by law, we are not liable for indirect or consequential loss,
or for loss of profit, opportunity, data or goodwill. Our total liability arising out of or in
connection with Mooncake or these terms — to you, to any child you added, and to anyone claiming
through or on behalf of either of you, for all claims together, whatever their basis and however
many people bring them, individually or in a class, collective or representative action — is one
fixed amount of SGD 10, paid once.

Nothing in these terms excludes liability that cannot lawfully be excluded, including for death
or personal injury caused by negligence, or for fraud. If you are a consumer, your statutory
rights are unaffected.

### 2.11 Indemnity

You agree to indemnify us against claims, losses and reasonable costs arising from your breach
of these terms, your misuse of the service, or content you submit that infringes someone else's
rights or that you had no right to submit — and, for each child you add, from their use of the
service, the content they submit, and any claim brought by them or on their behalf.

### 2.12 Termination

You may stop using the service and erase your account at any time (1.8). We may suspend or
terminate your access if you breach these terms or if we discontinue the service; if we
discontinue it we will give you the opportunity to export your workspace first.

Sections 2.2 (as to children you added), 2.5, 2.6, 2.10, 2.11 and 2.13 survive termination.

### 2.13 Governing law and disputes

These terms are governed by the laws of Singapore. The courts of Singapore have exclusive
jurisdiction over any dispute arising out of or in connection with them. Every claim is brought
individually: you agree, for yourself and for any child you added, not to bring, join or take
part in a class, collective or representative action against us. If you are a consumer
resident elsewhere, this does not deprive you of the protection of mandatory consumer law in
your country of residence.

---

## 3. Extension and bridge licence

Your licence to the software that runs on your own computer — the Mooncake browser extension
and its native-messaging bridge — as distinct from the service terms above.

### 3.1 What it does

The extension pairs with your account using a one-time code shown to you while you are signed
in, keeps an outbound connection to the service, and — if you choose to use your own AI tool —
passes the text of a task to the bridge. The bridge starts your own, unmodified AI command-line
program from your PATH with every tool disabled and no access to your files, sends it that text,
and returns the reply. It runs nothing else and it runs nothing on the server's instruction other
than that program.

### 3.2 What it never does

It never reads, copies or transmits your provider sign-in (its credential files or any
`ANTHROPIC_*` / `OPENAI_*` / `CLAUDE_CODE_OAUTH_TOKEN` variable); never
modifies, wraps or replaces the provider's program; never automates a provider's website; never
touches files on your computer beyond its own folder and its own log; and never holds your
Mooncake session — only a pairing token of its own, which signing out revokes. Unpairing in the
service, or uninstalling the extension, ends its access immediately.

### 3.3 Licence

The extension and the bridge are the property of EXCEPXION PTE. LTD., all rights reserved. We
grant you a personal, non-transferable, non-exclusive licence to install and use them on
computers you own or control, with your own Mooncake account, for your own use. You may not
copy, redistribute, modify, reverse engineer or sublicense them. The licence transfers no
ownership. The provider's own program is not ours and is governed by your agreement with its
provider.

---

## 4. Contact

EXCEPXION PTE. LTD.
160 Robinson Road #14-04
Singapore Business Federation Center
Singapore 068914

Support and general enquiries: admin@excepxion.com
Privacy and data requests: admin@excepxion.com
Responsible contact: Llewellyn Vaughan

© 2026 EXCEPXION PTE. LTD. · Singapore. All rights reserved.

---

## 5. Organisation terms

These terms apply to a school or an education company (the **organisation**) that uses Mooncake, in addition to the
Terms of Service. The person who applies accepts them for the organisation and confirms they are authorised to act
for it.

### 5.1 Approval

Mooncake checks every organisation - its UEN and the organisation itself - before it can invite anyone, and may refuse
an application, or suspend or close an organisation, at any time. While it is suspended its people reach no child;
when it is closed its courses and its records are deleted and its people leave it.

### 5.2 Its people

The organisation gives roles to its people: admins (its details, people, courses, enrolment links, computers and
records), tutors (the courses they are given) and safeguarding contacts. It chooses and checks them, keeps at least
one admin, and answers for their use of Mooncake. Each joins with their own Mooncake account and accepts the staff
wording, which is kept with its exact text.

### 5.3 Children and their parents

A child takes part only when a parent or guardian enrols them, with a consent that names the organisation and says
what its people see; the parent can withdraw the child at any time, and a new tutor for a course sees nothing of a
child until a parent approves them. The organisation uses what its people see only to teach the courses the parents
enrol their children in and to keep the children safe, and keeps it confidential.

### 5.4 Safeguarding

When Mooncake sees a sign that a child may be upset in one of the organisation's course chats, it tells the child's
parents and the organisation's safeguarding contacts. The check is automatic and can be wrong; it is not a diagnosis. The message names the child, the course, the kind of
sign and the time, never what the child wrote; the safeguarding contact may read that chat.

### 5.5 The organisation's computers

A computer the organisation's admin approves signs an enrolled child in to the organisation's courses only, for up
to 4 hours and until the browser closes. Mooncake asks the admin to sign out of a computer once it is approved.

### 5.6 Its record

The organisation keeps, in Mooncake, a record of each child's course - sessions attended, homework handed in and
confirmed marks - after the child leaves, until the child's account is erased or the organisation closes.

### 5.7 Fees

Mooncake counts each organisation's use of its AI per course and child. Nothing is charged for it today.