Privacy Policy

This policy explains how Rekabytes Enterprise (“we”, “us”) handles personal data when you use Mokara (the “Service”) at mokara.reka-bytes.my, and what happens to your data if you or your team run Mokara on your own infrastructure.

The Service is provided by Rekabytes Enterprise, registered as 202503277241 (IP0614333-M), which is a business registered in Malaysia under the Registration of Businesses Act 1956, which is not a separate legal person. Personal-data requests are handled by the operator directly rather than by a nominated data protection officer, and the correspondence address is not printed on this page — Contact and complaints states what we will provide instead.

It is written to satisfy the notice requirement in the Malaysian Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 and brought into force in phases from 1 April 2025 (the “PDPA”), and to be usable alongside the EU GDPR, the UK GDPR, and the other frameworks listed in Statements for specific regions.

1.1Two ways to run Mokara

• Hosted by us. We operate the Service for you. We are the data controller for the personal data described here, and you are a data subject (and, if you create a workspace for other people, a joint controller in substance — see Who can see your data).
• Self-hosted by you. Mokara ships as Docker images and is designed to be run on your own server. In that case we have no access to your database, no visibility into your traffic, and no role at all: you become the sole data controller, and this document doubles as the reference you can hand to your own users, your IT department, or your regulator to explain what the software records. Nothing in a self-hosted installation phones home.

This policy does not cover third-party services you reach through links we publish, or the practices of a team that runs its own instance under a different policy.

• We do not ask for your email address. Mokara accounts are a username, an optional display name and a password. There is no email field, no phone number, no payment instrument and no identity document anywhere in the schema.
• One cookie. A single first-party, httpOnly session cookie keeps you signed in. It is strictly necessary, which is why there is no consent banner — see the Cookie Policy.
• No trackers at all. No analytics scripts, no advertising pixels, no social plugins, no third-party CDN, no fingerprinting. Even the webfonts are self-hosted, so loading a page does not contact anyone else’s server.
• No client-side storage. We do not use localStorage, sessionStorage or IndexedDB. Closing the tab clears nothing you need to worry about, because nothing was written.
• We never sell or share personal data for advertising, and we do not rent it, index it, or feed it to a third-party model.
• Your teammates can see your work. That is the product. Status changes, deadline edits and comments are attributed to you by design — read Who can see your data before you invite anyone.

Everything we hold falls into four buckets. We do not collect anything beyond them, and the “where it lives” column is the actual database table behind each item.

3.1Account information you give us

3.2Work you and your team create

The content you type is your business data — and where it names or describes a person, it is that person’s personal data too. This is the part you control, and the part we will not look at unless you ask us to help.

• Workspaces and teams: a name (up to 50 characters), a URL slug, whether it is a personal workspace or a team, its owner, and its membership list with roles.
• Projects and KPIs: names, a colour, an archived flag, and KPI ownership and weight.
• Tasks: title, free-text description, status, priority, due date, an “needs attention” flag, and which project and KPIs the task is bound to.
• Comments: the text you post (up to 2,000 characters) and the thread structure of replies.

3.3History we record automatically

Mokara writes an event row when your work changes state, because the analytics and progress views are built from real transitions rather than guesses:

• One row per task status change, recording the task, the actor and the moment (task_events). The date a task first moved to “in progress” is how we know when work started.
• One row per deadline change, recording the previous date, the new date and the actor (task_due_changes). This is what draws the “deadline moved” marks on the heatmap.
• Invitation records: who invited which username to which team, whether it is pending, accepted or declined, and when it expired (seven days after creation by default).

These are personal data in the PDPA sense to the extent they describe an identifiable person’s work pattern. They are visible to the teammates in that container and nowhere else. We do not use them for anything except the views you can see yourself.

3.4Technical information

See Server logs. In short: request metadata (method, path, status code, duration, the authenticated username, and the error code for failures). No IP address, no raw user-agent string, no device identifier and no geolocation is captured by Mokara itself.

The only device information kept is for the signed-in devices list in Settings: one server-side record per active session holding a coarse device label derived from your browser’s user-agent (for example “Firefox on Windows” — the browser family and operating system, never the raw header, and no unique device identifier), plus the times the session was issued and last seen. It is kept until the session expires or you revoke it — revoking it is what signing a device out means.

3.5Information from other sources

None. There is no social login, no email-verification provider, no address or company enrichment service, and no advertising network. We do not receive data about you from anyone else, and we do not combine data across installations.

It is easier to trust a policy that names what is missing, so: email address, phone number, postal address, date of birth, government or tax identifiers, payment card data, precise geolocation, contacts, calendar, files, camera or microphone, browsing history outside this Service, advertising identifiers, device fingerprints, and behavioural profiles of you as a person.

The ambient background animation on our landing page runs entirely in your browser’s graphics processor; pointer position is used locally for parallax and is never transmitted or stored.

Under the PDPA, personal data may only be processed for a purpose the data subject was notified of, and normally with consent. Under the GDPR we must also name a lawful basis. The table does both.

We do not send marketing email, so there is no marketing basis to state — not because we respect your inbox, but because we never asked for it. If that ever changes, this section will change first and consent will be opt-in.

Mokara sets exactly one cookie, mokara_token (prefixed __Host- in production), which holds a signed session token so the Service knows you are already logged in. It is httpOnly (invisible to JavaScript on the page), SameSite=Lax, scoped to this site, marked Secure in production, and expires after seven days. Logging out deletes it immediately.

Because that cookie is strictly necessary to provide the feature you asked for, it is exempt from the consent requirement in the EU ePrivacy Directive (Article 5(3)) and the UK PECR, and no Malaysian law imposes a separate cookie consent — the PDPA treats any personal data in a cookie like any other personal data. Full details, including how to block it, are in the Cookie Policy.

Every API request produces one log line so that a failure can be explained:

That line contains the method, the path, the response status, how long the request took, the username of the caller if they were signed in, and the error code plus message if the request failed. Logs are written to the application’s standard output and live with the container or platform running it; they are rotated with it and are not loaded into the database, not searchable by other users, and not exposed in any product view. The application does not record IP addresses or user-agent strings. If the Service is placed behind a reverse proxy, load balancer or hosting platform, that layer may log IP addresses and user-agent strings for its own security and abuse-prevention purposes, under the operator’s configuration.

This is the most important section in this policy, because Mokara is a collaboration tool and visibility is not an accident — it is the product.

Your personal workspace becomes a team automatically the moment somebody accepts an invitation to it. That conversion is deliberate and cannot be reversed in the current version, so treat an accepted invitation as the point where your board became shared.

Team membership is capped at three people per team, which bounds the audience for anything you post in one.

We disclose personal data only in the following circumstances:

1. People you choose. Members of a container you belong to, as described in section 8. This is disclosure by design, and it is you who invites them.
2. Our service providers. The hosting provider that runs the server and database for the hosted Service, and the providers we use to build and publish the software. They process data on our instructions under confidentiality obligations, and the list is in Third-party services and sub-processors.
3. Legal and governmental requests. Where we are required or permitted by law — including the exemptions in the PDPA for the prevention and detection of crime, legal proceedings, and the essential interests of Malaysia — or by a valid court or regulatory order in another country. We narrow overbroad requests where we can, and we tell you about a request unless we are legally prohibited from doing so, so that you can challenge it yourself.
4. A successor. If all or part of our business is sold, merged or restructured, customer data may transfer with it, subject to the promises in this policy, and we will notify you.

We do not sell, rent, trade or broadcast personal data, and we do not share it with advertising, analytics or data-broking companies. In CCPA/CPRA terms: we do not “sell” or “share” personal data, and we have no reason to respond to a Global Privacy Control signal because nothing is tracked across sites.

The hosted Service runs in hosting region, and the database does not replicate to other regions on its own.

10.1Malaysia

Section 12 of the PDPA restricts transferring personal data outside Malaysia. Since the 2024 amendments, a transfer is permitted where the destination jurisdiction has a law substantially similar to the PDPA, or otherwise ensures an adequate level of protection. We keep the hosted Service inside a single approved region; if a transfer ever becomes necessary we will either rely on one of those grounds or tell you where your data would go before it happens.

10.2Europe, the UK and Switzerland

Where GDPR or UK GDPR applies and personal data leaves the EEA or UK, we do so only under a valid transfer mechanism: an adequacy decision, or the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) with the UK Addendum and the Swiss Addendum as applicable, supported by a transfer risk assessment. No data leaves the region by default, so in normal use of the Service this is a safeguard, not a routine event.

10.3Self-hosted installations

Your installation stores data wherever you put it, and the transfer analysis is yours to make. Because the software performs no outbound calls, hosting it in Malaysia (or any country you choose) genuinely contains the data.

The PDPA’s retention principle says personal data must not be kept longer than necessary for the purpose it was collected for. Here is how we apply that:

11.1Deleting your account

There is currently no self-service “delete my account” button in the product. Deletion is carried out on request: ask us using the contact in Contact and complaints, from a session where you are signed in (or have your workspace owner confirm it), and we will remove your account. Because your content belongs to the containers it sits in, deleting your account removes your membership and your ownership; tasks and comments in a team are retained for the team unless you delete them first, with authorship shown as removed rather than rewritten.

Backups: deletion is immediate in the live database, and becomes permanent in backups after backup retention period. We do not restore a backup to bring deleted personal data back.

Measures actually implemented in the software:

• Passwords are never stored or recoverable. bcrypt with a cost factor of 10. There is no “email me my password” path in the product because there is no password to email — which also means there is no self-service password reset, and that is a real trade-off we are being straight with you about (see section 11.1 for how to get an account reset).
• Sessions are hard to steal. The token cookie is httpOnly, SameSite=Lax and Secure in production; the token itself is an HS256 JWT signed with a server-side secret, so its contents cannot be forged by a client.
• Every request is authorised server-side. Membership is checked on each team-scoped endpoint before data is read, and write permissions are enforced for edit and delete. Access checks run before existence checks so the API never leaks which identifiers exist.
• Input is validated at the edge. Every request body is parsed against a strict schema with explicit field lists and length caps; unknown fields are rejected. Database access goes through an ORM with parameterised queries.
• Least privilege. The application connects with a database role that can only touch the tables it needs; secrets are environment variables and are never committed to the repository.
• TLS. In production the Service is served over HTTPS, so credentials and content are encrypted in transit. Only the certificate and hosting configuration are ours to promise — if you self-host, that requirement moves to you.

If personal data is lost, stolen, disclosed or accessed without authorisation, we will investigate, contain the incident, and assess whether it is likely to be detrimental to any individual.

• Malaysia. Where a breach is likely to cause harm, we notify the Personal Data Protection Commissioner in line with the breach-notification requirements introduced by the 2024 amendments and the 2025 regulations — without undue delay and, as those requirements currently specify, within 72 hours of becoming aware — and we notify affected data subjects as soon as practicable.
• EU and UK. Where GDPR or UK GDPR applies, we notify the competent supervisory authority within 72 hours (Article 33) and affected individuals without undue delay where the breach is likely to result in a high risk to their rights (Article 34).
• Everywhere else. We follow the notification rules of the affected jurisdiction, and we will tell you what happened either way.

For a self-hosted installation you are the controller and you hold the obligation; we will cooperate on any vulnerability disclosure and publish fixes in a release.

Write to [email protected] — the route is spelled out in Contact and complaints. Because accounts have no email address, we identify requests by the account itself — send it while signed in, or have your workspace owner confirm it — and we will not fulfil a request that we cannot tie to a real account. We respond within 21 days for a PDPA access request and within one month where GDPR or UK GDPR applies; complex requests may take longer, and we will tell you. There is no fee for a reasonable request.

Practical note on correction and deletion inside a team: your teammates’ view of a shared task is their data too. We will not rewrite history to make a collaborative record misleading — we remove your personal identifiers and let the container owner delete the item.

Mokara is made in Malaysia and the PDPA is the framework it is written against. We do not set out to sell to anyone abroad, but the software is self-hostable and the Service is reachable from anywhere, so the following records where additional rights apply to you. Where one of these frameworks binds us, it adds to this policy; it never subtracts from it.

15.1Malaysia — Personal Data Protection Act 2010 (Act 709)

This is our baseline. The PDPA’s Protection Principles (Part II — general, notice and choice, disclosure, access, retention, security, integrity and restrictions on transfer) govern our processing; the amendments in force from 2025 renamed the “data user” to the data controller, added biometric data to sensitive personal data, strengthened penalties, and introduced the breach-notification duties described in section 13. Your Part III rights (access, amendment, withdrawal of consent, and complaint to the Commissioner) are in section 14. We do not process sensitive personal data as defined by the PDPA — health, biometric, religious or political data, or data on criminal convictions — for any feature of the Service; if you type it into a task, that is your decision and it is not something we knowingly process.

15.2EU, EEA and United Kingdom — GDPR and UK GDPR

• Controller: the operator named in section 1. Where the Service is offered to you in the EEA or UK, this policy states our identity, purposes, lawful bases, retention, rights and complaint route as required by Articles 13 and 14.
• Rights of access, rectification, erasure, restriction, objection and portability under Articles 15 to 20; objection to processing on legitimate-interest grounds under Article 21; the right to lodge a complaint with your supervisory authority under Article 77.
• No automated decision-making producing legal or similarly significant effects (Article 22) — see section 17.
• If you are in the EEA or UK and want to reach a local representative, use the contact in section 20.

15.3United States — state privacy laws

To the extent the California Consumer Privacy Act as amended by the CPRA, or a comparable state law (Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others), applies: we collect the categories of personal information listed in section 3, we disclose them for a business purpose only as described in section 9, we do not sell or share personal information, we do not process sensitive personal information for feature purposes, and we do not retain information beyond section 11. You have the right to know, correct, delete, and opt out of sale or sharing (nothing to opt out of), and the right not to be discriminated against for exercising any of them. Our browser-based systems do not recognise Global Privacy Control signals because they perform no cross-site tracking to begin with.

15.4Asia-Pacific and other jurisdictions

If the law of your country gives you a right this policy does not name, tell us and we will honour it, and then fix this page.

The Service is a work-management tool for adults and is not directed at children. We do not knowingly collect personal data from anyone under 18 (or the age of digital consent in your country, if higher). If we learn that a child’s account exists, we will delete it — please report it to us. A team that adds a minor as a member is responsible for that decision, and the visibility rules in section 8 apply with full force.

We do not build behavioural profiles of you, and we do not make decisions about you by automated means with legal or similarly significant effect. The KPI weights, progress percentages and heatmap in the product are arithmetic over work that members themselves recorded, shown only to the members of that container. They are not a performance-scoring system, they do not leave the team, and no employment decision is automated from them.

A caution for teams, though, which we would rather state here than leave unsaid: an employer that runs a shared board can see when a member started, moved or completed work. If you use Mokara for people management, tell your team that the board is visible, and keep the conversation honest. There is no covert monitoring mode, and there never will be.

These are the only services the hosted instance touches, and the only ones that could ever see your data through us. There is no analytics provider and no error-reporting service, which is why they are absent from this list.

Deliberately absent: Google Fonts or any font CDN (typefaces are self-hosted), Google Analytics or Plausible or any other measurement script, Sentry or any other error collection service, and any social plugin. If we ever add one, this section gains a row and you get notice first.

We may update this policy as the Service and the law change. The date at the top of the page is when it last changed; for material changes — a new category of data, a new purpose, a new sub-processor, a change to the visibility model — we will give notice in the product and, where practicable, at least 14 days before it takes effect. Continuing to use the Service after a change takes effect means the new policy applies to you. Older versions are available on request.

20.1Complaining to us first

Tell us what you want — write to [email protected]. Access, correction, deletion, a copy of your data, or an objection to a specific processing activity. We would rather fix it than have you escalate it, and we answer every request that we can attribute to an account. Note the deliberate asymmetry: you can write to us from wherever you like, but because we hold no email address for your account, we cannot reach you outside the product — so a decision or notice about your request is something you read by signing in.

20.2Complaining to a regulator

• Malaysia: the Personal Data Protection Commissioner (Pesuruhjaya Perlindungan Data Peribadi), Jabatan Perlindungan Data Peribadi, under the PDPA. You may lodge a complaint directly, and this policy’s notice is given under that Act.
• EU/EEA: your national data protection supervisory authority, or the European Data Protection Board if you prefer a route through us.
• UK: the Information Commissioner’s Office.
• Australia: the Office of the Australian Information Commissioner, after raising it with us.
• Elsewhere: your country’s data protection authority — we will tell you which one applies if you ask.

The terms that govern your use of the Service are in the Terms of Use, and what we store on your device is in the Cookie Policy.