Last updated 23 October 2026

Privacy policy

Ok Donkey is a mobile app that reminds you until a task is marked done. This notice says what we hold, why, and where it lives.

The controller is Mesamigos Ltd, 128 City Road, London, EC1V 2NX, United Kingdom, company number 15765239. Email hello@mesamigos.com.

Data minimisation

We keep only what the reminder needs. We do not run advertising, and we do not sell personal data.

• Your email address, so we can sign you in.
• A one-time sign-in code, stored only as a salted hash. It expires after 10 minutes. We keep the hash for 24 hours so we can count wrong tries: after ten wrong codes in a day, sign-in for that email closes until the day is over. We never store a password.
• A sign-in token on your phone, valid for 30 days. It holds your account id and email.
• Events: title, an optional shared photo, schedule, time zone, repeat rule, grace period, how often the alarm rings again, and who is nagged first. When a reminder is handed on, we note who handed it on and to whom.
• Who is on an event, whether they are the lead, and when they were invited.
• When an occurrence is marked done or skipped, and how many seconds after the reminder that was. The timing is used only to nag whoever usually finishes first, when that option is on.
• A push token and the platform (iOS or Android), and only if this phone is registered for a remote reminder. The push token is the identifier Apple or Google gives this app on this phone so a notification can reach it. It is the only identifier tied to your phone, and it is used only to deliver reminders.
• What the alarm did on your phone: that it rang, was snoozed, or opened the app, with the event and the time. It is shown in that event’s log, so the people on it can see that the alarm reached you.
• A short phone health report, kept with the push token: the Ok Donkey version, the system version (for example “Android 15”), whether each alarm permission is on, and when the phone last checked in. It answers “why did it not ring?” without asking you. It holds no device model, serial number, or hardware identifier.
• When you last opened the app, so we can email you if reminders are coming up but your phone has not been seen for 14 days.
• The time zone your phone is set to, such as Europe/Brussels, and when it last changed. It keeps reminders on the right clock when you travel or share with someone in another time zone. The zone itself stays private. When your clock differs from a reminder’s, the people on that reminder see when it rings for you, such as “03:00”. We also keep your home time zone, and your holiday dates when you pause your reminders; the people on your reminders see that you are away and the day you are back.
• Your Smart time zone choice (Ask, Keep or Follow). When you choose to keep your reminders on the clock you left, the two zones involved, so the app does not ask again on that trip. When someone joins a reminder from a zone where it would ring at night for them, the owner is asked once, and we keep the two zones, the owner’s answer, and when. When everyone on a shared reminder is away at once, a note of that stretch, so the owner is told once.
• Whether you want the optional weekly email. It is off until you turn it on.
• When you speak a reminder: the text your phone made from your voice, so the title, time and people can be filled in. The sound itself never leaves the phone. The text is processed by Amazon Bedrock in the European Union and is not stored. We keep only a count of how often you used it, to set a fair limit.
• A phone number, only if you add one for text messages or for break-silent calls. No call is placed until a calling provider is agreed in writing. The number is deleted when the account is deleted or when you clear it.

What we do not collect

• No password or payment card.
• No GPS or other location. The only place-like thing we keep is a time zone, such as Europe/Brussels, on each event and the one your phone is set to.
• No address book. Invites are an email address you type. The app does not read your contacts.
• No advertising identifier, device serial number or hardware identifier, device model, analytics profile, or third-party tracking SDK. The push token above is the only identifier tied to a phone.
• No fingerprinting. The app does not read other apps, your contacts, or anything outside Ok Donkey.

If you type health or other sensitive details into a title, or add a photo showing them, we store that so the reminder can be shown to you and to the people on that event. We do not ask for it, and we do not use it for anything else. Write and share only what those people need.

Why we use it

• To show times on the right clock, ask an owner before a reminder rings at night for someone on another clock, and pause your reminders while you are away. The lawful basis is the contract for the app.
• To run the account and the events you create, including the sign-in code and showing an event to the people on it. The lawful basis is the contract for the app.
• To keep the service secure. Short operational logs may be created by the hosting platform. When a sign-in code is requested, the IP address is kept for at most an hour, to limit guessing. The lawful basis is our legitimate interest in running a reliable service. We do not use those logs to profile you.
• To keep alarms working. The phone health report, the alarm log, and delivery records let us see whether reminders reach phones. We look at them as totals, such as how many alarms were delivered or which app versions are in use, and we open one account’s records only to answer a question from you or to fix a fault. There is no analytics or tracking service, and nothing is sent outside our own EU servers for this. The lawful basis is our legitimate interest in a reminder that works.
• We do not run marketing campaigns, and we do not sell your data.

Where it is stored

The API runs on Amazon Web Services in the European Union, in region eu-central-1 (Frankfurt, Germany). Account and event data is stored in PostgreSQL in the European Union. The deploy is refused if it targets any other AWS region, so this service is not placed outside the EU.

The connection to the API uses TLS. Storage at rest uses the encryption provided for that EU database.

Mesamigos Ltd is established in the United Kingdom. The UK is covered by a European Commission adequacy decision, so EU personal data can be handled by us on that basis.

The sign-in code is emailed with Amazon Simple Email Service in eu-central-1. Your own email provider then receives the message. In production the code is not written to our logs. Only the hash is stored.

Who else sees it

People you add to an event can see its title, photo, schedule, and whether it is still open, done, or skipped, including who marked it. In the event’s log they can also see when the alarm rang on each person’s phone, and how quickly each person usually finishes. If your phone cannot get notifications from Ok Donkey, the people on your events see that you only hear by email.

When your clock differs from a reminder’s, the people on it see the clock time it rings for you, such as “03:00”, never the time zone itself. The owner may be asked whether to keep a time that would ring at night for you. The people on your reminders also see when you are on holiday and the day you are back. Emails about a reminder show its time on the recipient’s own clock.

Amazon Web Services processes the data in Frankfurt to host the API, the database, delivery of the sign-in email, and operational logs. API logs are kept for 14 days in the same region.

A reminder on your own phone is scheduled on the device. It does not leave the phone to fire. When a remote reminder is sent to someone else, Google Firebase Cloud Messaging delivers it, and on iPhone Apple Push Notification service carries it the last step. Those services are operated from the United States. They receive a device token and a short reminder, not your account record and not your email. There is no separate advertising or analytics vendor.

How long we keep it

• The sign-in code hash is kept for 24 hours after it is made, then removed. It is also removed when the account is deleted.
• The sign-in token on the phone lasts 30 days.
• Account, event, and completion data is kept until the account is deleted.
• Your time zone, home zone, Smart time zone choice, kept trips, and the owner’s time zone answers are kept until the account is deleted. Only your latest holiday is kept. A note that everyone on a reminder was away is removed with the reminder.
• The alarm log is kept for 24 months, like History, or until the account is deleted.
• The phone health report is replaced each time the phone checks in, and is removed with the push token or the account.
• Records of the emails we send are kept for 14 days. The record that a welcome note went out is kept so it is not sent twice, and the record of a “can’t reach your phone” email is kept for 31 days for the same reason. These emails include the one a backup gets the first time they are nudged or handed a reminder: the event, the time, and a short timeline of what happened.
• API logs are kept for 14 days.

Deleting the account removes your email, the events you own and any photo on them, your place on other people’s events, any device token and its health report, your time zones, holiday dates and time zone choices, and your alarm log. Done and Skip marks you made on other people’s events stay, without your name or email, so those times stay closed. They show as “Deleted account”.

You can delete the account in the app, or by emailing hello@mesamigos.com.

Your rights

If you are in the UK or the EEA you can ask for access, correction, deletion, restriction, or a portable copy, and you can object to a use based on legitimate interests. Email hello@mesamigos.com from the address on the account, or write to the postal address above. We reply within one month.

You can complain to the Information Commissioner’s Office (ico.org.uk), because we are established in the UK. If you live in the EEA you can also complain to the authority in your country. In Belgium that is the Gegevensbeschermingsautoriteit / Autorité de protection des données (gegevensbeschermingsautoriteit.be).

Security and children

Sign-in uses a one-time code rather than a reusable password. The code is hashed before it is stored. The session token is signed. Database access is limited to the API. We do our best to protect your data, but no system is perfectly secure, and we cannot guarantee that it will never be lost, exposed, or misused.

Ok Donkey is not directed at children. You need to be at least 16 to create an account. If we learn an account is for a child under 16, we will delete it.

Changes

If this notice changes, we update the date at the top and publish the new version on this page and in the app.

Mesamigos Ltd, 128 City Road, London, EC1V 2NX, United Kingdom. hello@mesamigos.com.