Terms of Use

These Terms of Use (the “Terms”) are a legal agreement between you and Rekabytes Enterprise (“we”, “us”) covering your use of Mokara at mokara.reka-bytes.my — the task board, its API, its marketing site and any feature we add (together, the “Service”). They are made under the Malaysian Contracts Act 1950.

The operator is Rekabytes Enterprise, registered as 202503277241 (IP0614333-M), which is a business registered in Malaysia under the Registration of Businesses Act 1956, which is not a separate legal person. References to “we” and “us” mean that party — nothing here is designed to hide who is answerable to you.

By using the Service you accept these Terms. You do that in one of three ways:

• creating an account, which is agreement to the whole of this document;
• signing in to an account, which continues that agreement;
• or simply using anything in the Service, which means these Terms apply from that moment.

1.1Who may use the Service

You must be at least 18 and able to form a binding contract. If you use the Service on behalf of an employer, client or other organisation, you confirm you have authority to bind that organisation, and “you” in these Terms includes it.

1.2What these Terms do not cover

• Personal data. How we handle it is in the Privacy Policy, which is part of these Terms by reference. Where the two disagree about personal data, the Privacy Policy wins.
• Self-hosting the software. Running our container images or source on your own infrastructure is governed by Self-hosting below, plus whatever open-source or commercial licence ships with the release you downloaded.
• Third-party terms. A team that runs its own instance may publish its own policy; ours does not bind that instance’s users.

Mokara is a shared task board for small teams: tasks with statuses, priorities and due dates; projects; personal KPIs with per-task weights; threaded comments; analytics; and invitation-based teams capped at three members per team. It runs as a web application with a REST API behind it.

It is not, and will not become, any of the following:

• file storage or a document-management system — there is no upload capability at all
• email, chat or a notification service — no email is sent, ever
• a records system for sensitive personal data about other people
• an infrastructure host for your own applications
• a guaranteed-availability service — see section 11

We may add, change or withdraw features. Withdrawing something that is materially load-bearing for you is a decision we will announce, not discover for you.

An account is a username, an optional display name and a password. Usernames are three to twenty characters, limited to lowercase letters, digits and underscores, and unique without regard to case — they are how teammates find and invite you, so treat the username as public inside your teams.

3.1One account, one person

• Every human gets their own account. Shared or group logins are not permitted, because activity is attributed to an account by design: the event history in the Service shows who moved a task and who posted a comment, and a shared credential destroys that.
• You are responsible for everything done under your account while you hold it, and for telling us promptly if you believe it has been used without your permission.
• Keep your password and your signed-in devices safe. Passwords are stored only as a bcrypt hash and we cannot read them — which means we cannot reset one for you without a manual request.

3.2Account requests and verification

Because there is no email address on file, we identify you by the account itself. Requests about an account should come from a signed-in session on that account, or be confirmed by the owner of a workspace the account belongs to. That is a limitation and a protection at the same time.

The container for work is a workspace (private to you) or a team (shared by its members). This section allocates responsibility, because in a collaboration tool the users, not the operator, control who sees what.

4.1A personal workspace becomes a team permanently

Your workspace converts from private to team the moment someone accepts an invitation to it. An invitation sent but never accepted changes nothing. The conversion cannot be reversed in the current version, so do not invite anyone into a workspace containing something you would not want a colleague to read.

4.2Invitations

• Only a leader may invite, and each team is capped at three members.
• An invitation names an existing username; it expires seven days after it is sent.
• Do not invite accounts you do not know. An invitation is a statement that you want that person inside the container.
• Accepting an invitation puts you in that container’s visibility model: everything in it becomes readable by its members, including your attributed activity there.

Use the Service lawfully, and in a way that does not damage it for other people.

5.1You agree not to

• use the Service for any unlawful purpose, or in a way that infringes someone’s rights or breaches a contract or court order you are subject to;
• post content that is obscene, indecent, threatening, hateful, defamatory, or otherwise prohibited — in Malaysia, including under the Communications and Multimedia Act 1998 (section 233) and the Penal Code;
• store or transmit sensitive personal data about other people without a lawful basis and their knowledge (health, biometric, religious or political data, or criminal convictions, as defined by the PDPA);
• gain unauthorised access to the Service or another account, or attempt to — including scanning, probing or testing without our written permission, which is an offence under the Computer Crimes Act 1997;
• introduce malware, or reverse-engineer, decompile or disassemble the hosted Service to obtain its source, except where a licence or applicable law expressly permits it;
• overload or impair the Service: no automated scraping, bulk creation, load testing, or API use designed to circumvent a limit such as the three-member team cap;
• resell, sublicense or provide a hosted gateway to the Service as a competing product without our written agreement;
• impersonate anyone, create accounts for other people without their instruction, or evade a suspension or restriction;
• abuse the report, invitation or deletion mechanisms, or submit knowingly false requests under the Privacy Policy.

5.2Rate limits and technical measures

We apply technical limits so the Service stays usable — input validation with strict field lists and length caps, per-container membership checks on every request, and the container size cap. Limits may change without individual notice. We may throttle or stop traffic that looks like abuse; if we do it to you by mistake, tell us and we will fix it.

Tasks, descriptions, comments, project names, KPI names and everything else you type is your content. You keep all of it. Nothing in these Terms transfers ownership to us, and we claim no rights in your work beyond the narrow licence below.

6.1The licence you give us

You grant us a non-exclusive, worldwide, royalty-free licence, limited to the period you use the Service, to host, store, transmit, display to your authorised teammates, back up and — only where technically necessary — format or cache your content, for the sole purpose of operating the Service for you. We may also aggregate non-identifying statistics about usage to understand capacity and feature adoption. We will not publish your content, use it to train a model for another customer, or sell it.

6.2What you warrant

• you own or have the rights to the content you post;
• posting it does not breach these Terms, another person’s confidentiality, or any law;
• where your content includes personal data about other people, you have a lawful basis for processing it and have told them about it.

6.3Moderation and removal

We do not monitor content as a matter of course — which is the same promise from the other side of the fence as section 4. We may suspend access to, or remove, content we reasonably believe is unlawful, that puts the Service or other users at risk, or that we are required to remove by a court or regulator. Where we are allowed to, we tell you what and why, and you can ask us to review it. For content inside a team, the ordinary first move is to ask the leader or the author — we are not the referee of your team’s board.

6.4Back up what matters

You are responsible for your own copies of anything you cannot afford to lose. The Service has no export feature in the current version; if you need one, ask us and we will provide your data in a machine-readable form (that is also a right you can invoke, see the Privacy Policy).

If you send us ideas, bug reports, feature requests or criticism, you grant us a perpetual, irrevocable, royalty-free licence to use them in the product without attribution or payment, and you warrant you may. We will not identify you as a source without asking, and we do not promise to act on anything — but bug reports with a reproducible step get priority, because they help everyone.

The Service — its name, marks, interface, design system, layout, code and documentation — is owned by us or our licensors and protected by the Copyright Act 1987 (Malaysia) and equivalent laws elsewhere. These Terms give you a right to use it, not a right in it.

• Do not copy, imitate or use our marks or product name in a way that suggests affiliation or endorsement.
• Do not register a domain, app-store listing or repository name that impersonates the Service.
• You may quote and link to our documentation and marketing pages, with attribution.

Third-party components shipped inside the images (React, Next.js, Hono, Prisma, Postgres and the rest) stay under their own licences, and those licences’ notices travel with the build.

Mokara is built to be run by its users. If you deploy our images or source on infrastructure you control, then:

1. you are the operator. You run the servers, you hold the database, and in data-protection terms you are the controller. We have no access to it and no visibility into it.
2. our privacy policy describes your obligations to your users, not ours. Use it as the basis for your own notice — that is what it is written for — but publish it under your name, and complete the parts about hosting, retention and contact details with your facts.
3. you must secure it yourself. HTTPS behind your proxy, AUTH_SECRET set to a real value, a database role with least privilege, and the CORS_ALLOWED_ORIGINS allow-list configured rather than left open.
4. the software licence governs the code. Whatever licence accompanies the release you obtain — see the release notes or the repository — sets what you may modify, redistribute or offer as a service. These Terms govern the hosted Service, and the licence governs the software; if they conflict about the software, the licence controls.
5. updates and fixes. We publish releases; we do not maintain your deployment, run your migrations, or accept liability for your installation.

The hosted Service is currently free to use, so no fee terms apply today. If we introduce paid plans, they will be governed by an added section in these Terms (or a separate order form), and the price, billing period, renewal and refund mechanics published at the time of purchase will apply. Each party bears its own taxes; where a fee exists, prices exclude applicable sales, service or similar tax unless stated otherwise.

Free does not mean unmanaged: the acceptable-use rules in section 5 and the liability position in section 13 apply to a free account exactly as they apply to a paid one.

11.1No service level agreement

We aim to keep the Service up and we operate it with backups, but we do not promise an uptime percentage, an incident-response time, or that any particular feature will remain. Planned maintenance may make it unavailable. Self-hosted instances are entirely your reliability story.

11.2Support

Support is best-effort, without charge unless a paid plan says otherwise — write to [email protected]. We will respond to security reports seriously and to data requests within the periods promised in the Privacy Policy.

11.3Warranty disclaimer

12.1By you

Stop using the Service at any time, and ask us to delete your account as described in the Privacy Policy. Termination ends your licence to use the Service but does not undo the agreement that your content sat in a shared container.

12.2By us

We may warn, restrict, suspend or terminate access — including a whole container — if you breach these Terms, if we must do so to comply with law or a lawful order, if your use creates a security, legal or operational risk for us or other users, or if the Service is discontinued. Where it is reasonable and lawful to do so we give notice first and the chance to put it right, and we tell you what happens to your data. We will not suspend you because someone complained without a reason we can act on.

12.3On termination

Sections 6 (your content, as far as it covers what already happened), 7, 8, 13, 14, 15, 16 and 17 survive termination, along with any payment obligation you accrued before it.

If you use the Service in a business context, or you add other people’s personal data to it, you agree to hold us harmless against third-party claims, losses and reasonable legal costs arising from your content, your use of the Service in breach of these Terms, your breach of a duty owed to another person, your failure to have a lawful basis for personal data you put into a container, or your own installation of the self-hosted software. We will tell you about a claim, and you may not settle one in a way that binds us without our consent. This does not apply to the extent a claim results from our own unlawful conduct.

14.1What we are not liable for

To the fullest extent permitted by law, we are not liable for loss of profits, revenue, goodwill, business opportunities or data, or for indirect, incidental, special or consequential loss, however caused and whether in contract, tort (including negligence), breach of statutory duty or otherwise, even if we were told it might happen.

14.2Our cap

Our total liability for everything arising out of these Terms or your use of the Service is limited to the greater of the fees you paid us in the twelve months before the event giving rise to the claim, or RM 500 (or the equivalent in your local currency for a non-Malaysian user).

14.3What is never excluded

Nothing in these Terms excludes or limits liability for:

• death or personal injury caused by our negligence;
• fraud, fraudulent misrepresentation or wilful misconduct;
• breach of a statutory duty that cannot be excluded — including, where applicable, the Malaysian Civil Law Act 1956 and the Consumer Protection Act 1999, the Unfair Contract Terms protections in the UK and EU, and the Australian Consumer Law;
• any other liability that cannot lawfully be limited or excluded in your jurisdiction.

If a court or regulator decides any part of this section is unenforceable against you, the rest stands and we are liable only to the extent this section permits.

These Terms are governed by the laws of Malaysia, and the parties submit to the exclusive jurisdiction of the courts of Malaysia.

15.1Try to sort it out first

1. Raise it with us in writing — [email protected]. Most problems here are fixed in a day.
2. If we cannot agree within 30 days, the parties will attempt mediation in good faith — in Malaysia, for example through the Asian International Arbitration Centre — before either starts proceedings.
3. Failing that, the Malaysian courts decide, except that a dispute within the jurisdiction limits of a small-claims or tribunal forum (in Malaysia, the Tribunal for Consumer Claims) may still be brought there.

15.2If you are outside Malaysia

You may still rely on the mandatory consumer and data-protection protections of the country where you habitually live, and nothing in this section takes them away. Where a regulator or court in your country has unavoidable jurisdiction over a claim against you, a Malaysian judgment remains enforceable as a debt in accordance with the applicable law.

We may revise these Terms as the Service and the law change. The version in force is the one published at this URL on the day you use the Service, and the “last updated” date at the top tells you when it moved. For changes that materially reduce your rights or increase your obligations, we will give notice in the product and, where practicable, at least 14 days before they take effect. If you do not agree with a change, stop using the Service — continuing to use it means you accept the revised Terms. We will keep prior versions available on request so you can see what applied to you at the time.

• Entire agreement. These Terms, together with the Privacy Policy and Cookie Policy, are the whole agreement about the Service and supersede anything said before you accepted them.
• Severability. If a provision is invalid or unenforceable, it is read down as far as needed to make it lawful, and everything else continues.
• No waiver. Our not enforcing something once is not a waiver, and does not stop us enforcing it later.
• Assignment. You may not assign these Terms without our consent; we may assign them in connection with a merger, reorganisation or sale of the business, subject to the notice commitment in the Privacy Policy.
• No third-party beneficiaries. These Terms are between you and us. A teammate is not a party to your agreement with us, even though they benefit from your not posting their secrets.
• Force majeure. We are not liable for failure caused by events beyond our reasonable control — network outages, upstream provider failures, natural events, strikes, war, government action, or a certificate authority doing something unexpected — and we will use reasonable efforts to resume.
• Notices. Notices to us go to the contact below; notices to you may be given in the product or at the contact details you provide. There are none to provide, because there is no email field: in-product notice is the channel.
• Language. These Terms are drawn up in English. Any translation is for convenience; the English text prevails.
• Individual claims. To the extent permitted by applicable law, disputes are brought on an individual basis and not on behalf of a class. This clause is written for jurisdictions where that is enforceable; where it is not, it does not apply to you and has no effect.

Questions about these Terms, a report about misuse, or a request about your data:

The Privacy Policy explains what we record and how to get it removed; the Cookie Policy explains the one cookie we set.