DiagBimmer BMW & MINI TOOLS

DiagBimmer Privacy Policy

Last updated: 2026-10-05
Effective date: 2026-05-20 (changes in version 1.1 apply from 2026-10-05; see "Changes" at the end)
Version: 1.1

This Privacy Policy explains how DiagBimmer: BMW & Mini Tools ("DiagBimmer", "we", "our", "us") collects, uses, and protects information when you install or use the mobile application (the "App"). It is intended to satisfy the requirements of, among others, the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR and Data Protection Act 2018, the Türkiye Personal Data Protection Law No. 6698 ("KVKK"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the U.S. Children's Online Privacy Protection Act ("COPPA"), the Apple App Store Review Guidelines (esp. section 5.1) and the Apple Privacy Manifest framework, and the Google Play User Data Policy and Data Safety section.

Data controller

For the purposes of GDPR, KVKK, and equivalent laws, the data controller of any personal data processed via the App is:

Yener Unsal
Ritim İstanbul AVM, Cevizli Mah. Zühal Cad. A Blok No:46 İç Kapı No:50, 34846 Maltepe / İstanbul, Türkiye
Privacy contact: yenerunsal@yahoo.com

If we are required to designate an EU/UK representative under Article 27 GDPR or a KVKK representative under Article 5(2) of KVKK, we will list that representative below before EU/UK/Türkiye distribution.

1. Summary

2. Categories of data we process

a) Stored locally on your device

Category Example Source Storage
Adapter identifier Bluetooth address (Android) or system-assigned Bluetooth identifier (iOS); network address of a Wi-Fi adapter or, with ENET, of the vehicle's gateway; vendor, product and serial number of a USB adapter Adapter pairing and connection App sandbox
Vehicle identification number (VIN) The VIN of vehicles you connect to, with the settings you chose for each vehicle Read from your vehicle when you connect App sandbox
Vehicle profile choice "F30 320i" Your selection App sandbox
Purchase entitlement Premium-unlocked flag, signed token Apple / Google receipt verification App sandbox (on iOS, the iOS Keychain; see below)
Diagnostic trouble codes (DTCs) "P0301 — cylinder 1 misfire" Your vehicle's ECUs (read by you) RAM during a scan; cleared when you leave the fault-code screen. A fault-code report you create (it includes the VIN) stays in the App's cache directory until the system clears it or you uninstall the App. While the detailed diagnostic log is on, the vehicle's answers are also kept in it, encrypted (see below)
Live-data recording The values the live graph records while you run it (engine speed, vehicle speed, coolant and intake-air temperature, engine load, throttle position) and when they were recorded Your vehicle, when you start the graph App cache directory, together with any CSV copy you export, until the system clears it or you uninstall the App
User preferences Language, theme, units, opt-ins Your settings App sandbox
Diagnostic log The time of each entry (a copy you share also states the date, time and your device's time-zone offset when it was prepared); App version; phone make, model and OS version; screens opened and buttons tapped; status and error messages shown on screen; when the App goes to the background and comes back; connection attempts and their results, with the adapter's name or local network address (with ENET, the vehicle gateway's) and its self-reported identification (chip, firmware version, manufacturer, device identifier); the vehicle's model series (e.g. "G20"); the title of confirmation dialogs the App shows and your answer; when you confirm a vehicle function, the ignition state, engine speed and battery voltage the App last read; vehicle equipment the App detected; results of service functions, purchases and restores (including the store's error code and message and whether Premium is active); results of clearing fault codes, with the short names of the control units involved (for example "DME"); while the live-data screen is open, statistics on how many readings were made and how long they took; error types and, if the App crashes, a note of it; the fault code, if the App could not open a web search for it; technical warnings from the App's software components Generated by the App while you use it App cache directory: the current launch of the App and the last earlier launch that reached your screen, with the records of any starts after it that did not (see §4). VINs, Bluetooth addresses and raw vehicle data are masked or left out
Detailed diagnostic log (only when switched on, for troubleshooting, with a password we give you; the password does not let anyone read the log) Everything the App logs while the mode is on: its communication with your vehicle and adapter (except the Hex Terminal's own connection), including the VIN and raw vehicle data; full error texts; the Bluetooth, Wi-Fi and Ethernet addresses of adapters; and the names and identifiers of Bluetooth devices found nearby or paired with your phone. These may be yours or other people's, and their names often include their owner's name Generated by the App App cache directory, encrypted before it is stored (see §12); it cannot be read on the device. Deleted when you tap "Turn off" next to "Detailed diagnostic log is on" in Settings (this ends only the detailed mode, not the App); if the App closes while the mode is on, see §4

Apart from the operating-system log described below, this data resides in the operating system's app sandbox (Apple iOS Data Container / Android private app storage) and is removed when you uninstall the App, with two exceptions. On iOS the Premium purchase record is kept in the iOS Keychain, which iOS may keep after the App is deleted. And if device backup is switched on, your iCloud or Google backup may include the App's settings (for example the VIN and adapter identifiers), which come back when the App is restored from that backup, for example on a new phone. We do not transmit this data to our servers. The diagnostic log, fault-code reports and live-data recordings are kept in the App's cache directory, which is excluded from iCloud and Android backups and which iOS and Android may clear on their own when storage runs low.

The same diagnostic-log lines (not those of the detailed log) are also written to the operating system's own log (Android logcat, iOS device log). Other apps on your phone cannot read it, but it can be viewed with developer tools from a computer connected to your unlocked phone (for example the Console app on a Mac), and it is included in a system bug report if you create one. The operating system decides how long it keeps these lines; uninstalling the App does not remove them. If the App ever crashes on an error it did not handle, the crash report in this log may hold that error's full text, which can include data exchanged with your vehicle; that report is written by the .NET runtime built into the App, not by its diagnostic log. The same text may also reach the crash reports Apple or Google pass us (see §5).

b) Sent off your device — only with your action or consent

Category When Recipient Why
Apple/Google IAP receipt When you tap "Unlock Premium" Apple App Store / Google Play Verify your purchase and unlock Premium
Files you export via the system share sheet When you tap "Share" / "Save" The destination app or service you choose At your direction
Diagnostic log you choose to share When you tap "Share diagnostic log" (Connect → Adapter settings) The app, service or person you choose, for example our support e-mail To let us analyse a problem you report. Apart from any detailed part, the file is plain text that anyone who receives it can read. A detailed part is included if the detailed log was used on this device in the last few days and was not switched off with "Turn off" (for example because the App closed while it was on), even if the mode is now off; it is encrypted and only we (the developer and data controller) can read it
Fault code you look up When you tap the search icon next to a fault code Google, through your default browser To look the code up, at your direction

c) Data we do NOT process

d) When you contact us

Category When Recipient Why
Your e-mail address, the name shown in your e-mail, your message and its attachments (for example a diagnostic log) When you e-mail us Us, through our e-mail provider (see §5) To answer your request, including analysing a diagnostic log and fixing the fault it shows in the App; where necessary, to establish, exercise or defend a legal claim about the problem you reported (see §4)

3. Purposes of processing and legal bases

Purpose Categories of data GDPR / UK GDPR Art. 6 KVKK Art. 5 / 6 CCPA business purpose
Providing core App functionality Adapter identifier, VIN and the settings you chose for each vehicle, vehicle profile, DTCs, fault-code reports and live-data recordings you create, user preferences Art. 6(1)(b) — performance of contract Art. 5(2)(c) — necessary for performance of contract Performing services
Verifying your purchase IAP receipt Art. 6(1)(b) — contract Art. 5(2)(c) Performing services
Keeping a diagnostic log on your device to troubleshoot connection and vehicle-communication problems Diagnostic log Art. 6(1)(f) — our legitimate interest in finding and fixing faults in the App (you can object, see §7) Art. 5(2)(f) — legitimate interest Debugging
Recording the detailed diagnostic log, which you switch on for a support case Detailed diagnostic log Art. 6(1)(b) — performance of contract (handling your support request); for the names and identifiers of Bluetooth devices that may belong to other people: Art. 6(1)(f) — our legitimate interest in finding and fixing the problem Art. 5(2)(c) — necessary for performance of contract; for Bluetooth devices that may belong to other people: Art. 5(2)(f) — legitimate interest Debugging
Analysing a diagnostic log you send us with a support request Diagnostic log, detailed diagnostic log; your e-mail address and message Art. 6(1)(b) — performance of contract (handling your request under the Terms of Use); for the names and identifiers of Bluetooth devices that may belong to other people: Art. 6(1)(f) — our legitimate interest in finding and fixing the problem Art. 5(2)(c) — necessary for performance of contract; for Bluetooth devices that may belong to other people: Art. 5(2)(f) — legitimate interest Debugging
Complying with legal obligations As required Art. 6(1)(c) Art. 5(2)(a) Legal compliance
Defending legal claims Logs of relevant events Art. 6(1)(f) — legitimate interest Art. 5(2)(e) — establishing, exercising or protecting a right Legal compliance

4. Data retention

Data Retention
Locally stored data on your device (unless a row below says otherwise) Until you uninstall the App or, on Android, clear its storage via Settings → Apps → DiagBimmer → Storage; on iOS only deleting the App removes it. For the exceptions, see §2a
Diagnostic log on your device The current launch of the App and the last earlier launch that reached your screen. Here a launch is the time from when the App starts until you or the system close it, and it can last for days. Every time the App starts, the records of older launches are deleted; a start that does not reach your screen (for example a start in the background to restore a Bluetooth connection on iOS, or Android restarting the App's foreground service) does not delete that earlier launch, and its own records are added after it, up to a size limit. The App has no option to delete the log. You can delete it in two ways: by uninstalling the App (on iOS, "Offload App" does not delete its data, it keeps it) or, on Android, by first tapping Settings → Apps → DiagBimmer → "Force stop" and then Storage → "Clear cache" (menu names differ slightly between phones), without opening the App in between. Stopping it first is needed because a running App still holds the current launch's lines in its memory and goes on writing new ones; only moving the App to the background is not enough
Detailed diagnostic log on your device Until you tap "Turn off" (see §2a). Detailed mode ends by itself when the App is fully closed, but what it recorded stays. These records cannot be deleted from within the App and are included, still encrypted, in any diagnostic log you share. They are deleted automatically the first time the App starts more than 3 days after the last entry. Uninstalling the App or, on Android, clearing its cache deletes them earlier
Copy of a log prepared for sharing Until the App next starts. A later share replaces it with a new copy; tapping "Turn off" (see §2a) while the detailed log is on or, on Android, clearing the App's cache deletes it earlier
Diagnostic lines in the operating system's log As long as the operating system keeps them; not removed by uninstalling the App
E-mails you send us, any diagnostic logs attached to them and any decrypted copy we make For as long as needed to handle your request, and no longer than 12 months after it is closed, unless we need them to establish, exercise or defend a legal claim about the problem you reported (see "Records required to defend legal claims" below)
IAP receipt records held by Apple / Google Per Apple / Google's own retention policies
Records required to defend legal claims Up to the applicable statute of limitations
KVKK records of processing At least the period required by KVKK Regulation on Erasure, Destruction or Anonymisation

5. Recipients and third-party processors

We engage the following processors. Apple and Google act under their developer agreements; our e-mail provider handles our inbox under its standard terms of service.

Processor Purpose Location Safeguard for international transfer
Apple Inc. In-App Purchase processing, App Store distribution United States EU Standard Contractual Clauses (Module 1), Apple App Store EULA, Apple Privacy Policy
Google LLC In-App Purchase processing, Google Play distribution United States EU Standard Contractual Clauses, Google Play Developer DPA
Yahoo (the Yahoo company that provides our yahoo.com mailbox) Hosting our support and privacy inbox: messages and attachments you send us, such as diagnostic logs United States and other countries where the provider operates The provider's standard terms of service; the transfer is necessary to handle the request you send us (Art. 49(1)(b) GDPR, Art. 9(6)(b) KVKK)

Apple and Google may also pass us crash reports about the App if you have allowed your device to share them (iOS: "Share With App Developers"; Android: "Usage & diagnostics"); they do so under their own privacy policies. Such a report may include the text of the error that ended the App, which can include data exchanged with your vehicle (see §2a).

We do not sell or share personal information with data brokers, advertisers, or any other third party for advertising or profiling purposes.

6. International transfers

Apart from purchase verification with the store, the App itself does not send personal data anywhere. If you e-mail us (for example with a diagnostic log), we handle your message in Türkiye, and our e-mail provider stores it on servers that may be outside your country, including in the United States, because the transfer is necessary to handle the request you send us (Art. 49(1)(b) GDPR, Art. 9(6)(b) KVKK). Apple/Google IAP receipt verification is handled directly by the store provider under those companies' own transfer mechanisms.

7. Your rights

You have the rights described below. We will respond within the time limits required by applicable law (generally 30 days under GDPR/UK GDPR, 30 days under KVKK, 45 days under CCPA/CPRA, with one extension where permitted).

a) Rights under GDPR / UK GDPR (Articles 15–22)

The diagnostic log and other data kept only on your device are not available to us, so you exercise these rights for them yourself. To see the diagnostic log, send it to yourself (Connect → Adapter settings → Share diagnostic log, for example to your own e-mail address); its detailed part, if any, is encrypted and cannot be read on the device. To erase it, follow §4. The App cannot delete the copy of its lines in the operating system's log (see §2a); the operating system removes it over time. The App has no setting that stops the normal diagnostic log; if you object to it, the way to stop it is to stop using the App and uninstall it (see §4). The log does not reach us unless you share it with us. For diagnostic logs you have sent us, including an encrypted detailed part, write to us: we will give you a copy of the personal data in them, leaving out information about other people such as the names of their Bluetooth devices, or delete them.

To exercise any of these rights, contact yenerunsal@yahoo.com.

b) Rights under KVKK (Article 11)

Veri sahibi sıfatıyla şu haklara sahipsiniz:

KVKK kapsamındaki başvurularınızı yenerunsal@yahoo.com üzerinden veya yukarıdaki posta adresine "Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ" hükümlerine uygun şekilde gönderebilirsiniz.

c) Rights under CCPA / CPRA (California residents)

You have the right to:

We will not require you to create an account to make a verifiable consumer request. You may designate an authorized agent. To submit a request, email yenerunsal@yahoo.com. We will verify your identity using a reasonable method and respond within 45 days (extendable by another 45 days where necessary).

d) Rights under other U.S. state privacy laws

Equivalent rights apply under the Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, Texas Data Privacy and Security Act, Oregon Consumer Privacy Act, Montana Consumer Data Privacy Act, and similar state laws. Contact yenerunsal@yahoo.com.

e) Rights under Brazil's LGPD, Australia's Privacy Act, Canada's PIPEDA

Equivalent access, correction, deletion, and complaint rights apply. Contact yenerunsal@yahoo.com.

8. Children's privacy

9. Mobile-app permissions

The App requests the following platform permissions. Runtime permissions are asked for through the operating system's own prompt when the App first needs them (on iOS the prompt shows our explanation). If you decline the Bluetooth permission, the App explains what it is for and how to allow it in Settings.

Permission Why we need it When requested Optional?
Bluetooth (iOS NSBluetoothAlwaysUsageDescription; Android 12 and later BLUETOOTH_SCAN declared neverForLocation and BLUETOOTH_CONNECT; Android 8–11 BLUETOOTH, BLUETOOTH_ADMIN and location, see below) Discover and connect to your Bluetooth Low Energy or Bluetooth Classic OBD-II adapter When the Connect screen first searches for adapters (it starts searching as soon as it opens) Required for Bluetooth adapters
Local Network (iOS NSLocalNetworkUsageDescription) Find Wi-Fi and ENET OBD-II adapters on the network your phone is connected to The same first search, which also looks for Wi-Fi and ENET adapters Required for Wi-Fi/ENET adapters; BLE works without it
Network (Android INTERNET, ACCESS_NETWORK_STATE, CHANGE_NETWORK_STATE) Talk to a Wi-Fi/ENET adapter over the local network and pin the session to that network; verify an in-app purchase with the store. No server of ours is contacted. Granted at install (no prompt) Required for Wi-Fi/ENET adapters and purchases
Notifications (Android 13 and later, POST_NOTIFICATIONS) Show the ongoing notification of the foreground service that keeps a long session (for example a fault-code scan, live data or a recording) alive while the App is in the background First long session Recommended; if you decline, the App runs the session without the foreground service, so the session may stop when the App goes to the background
Foreground service — connected device (Android FOREGROUND_SERVICE, FOREGROUND_SERVICE_CONNECTED_DEVICE) Keep the adapter session running while the screen is off or the App is in the background Automatically with a long session (on Android 13 and later, only if you allowed notifications) Required for background sessions
USB (Android USB host) Use a USB OBD-II adapter plugged into the phone When the adapter is plugged in Required for USB adapters

The App also declares Android's WAKE_LOCK permission, which is granted at install without a prompt; the current version of the App does not use it.

Sharing or saving a file from the App (a diagnostic log, a fault-code report or a live-data recording) uses the system share sheet and needs no permission; the App does not see where you save or send it.

On iOS and on Android 12 and later we request no location permission: Android Bluetooth scans are declared neverForLocation. On Android 8–11 the system requires the location permission (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION) for any Bluetooth scan, so the App asks for it there, together with the Bluetooth permission; it does not read or store GPS or any other location.

We do not access your camera, microphone, contacts, calendar, health, fitness, sensors beyond Bluetooth, precise GPS, or any system identifier that could re-identify you.

10. Apple App Tracking Transparency (ATT)

We do not track you across apps or websites owned by other companies, and we do not present an ATT permission prompt. The App's privacy label in App Store Connect is "Data Not Collected": the App itself sends us no data, and a diagnostic log reaches us only if you send it to us through an app of your own choice.

11. Apple Privacy Manifest and Google Play Data Safety

12. Security

We apply the security measures appropriate to the sensitivity of the limited data we process:

No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

13. Personal data breach notification

If we become aware of a personal-data breach affecting you, we will notify the competent supervisory authority within 72 hours in accordance with Article 33 GDPR (and equivalent KVKK / U.S. state breach-notification timelines), and we will notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms (Article 34 GDPR).

14. Cookies and similar technologies

The App does not use cookies. It does not embed analytics web views or third-party trackers. Our website, diagbimmer.com, where this policy is also published, sets no cookies; it loads its fonts from Google Fonts, so your browser sends your IP address to Google when you open a page. Like most web servers, the server that hosts the site may record technical access data (IP address, date and time, the page requested and the browser type) in its logs for security and operation; we do not use these records to identify visitors, and the server deletes them after a limited period through its routine log rotation.

15. Do Not Track

The App does not respond to browser "Do Not Track" signals because the App is not a web browser and does not perform cross-site tracking. Global Privacy Control signals received by any companion website will be honoured.

16. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date and the version at the top show the latest revision, and each change is summarised under "Changes" at the end of this page. We will announce a material change in the App's release notes before it takes effect. Continued use of the App after a change constitutes acceptance of the new policy. Where the law requires renewed consent, we will request it.

17. Contact

Topic Contact
Privacy / data subject requests yenerunsal@yahoo.com
KVKK başvuruları yenerunsal@yahoo.com
Türkiye veri sorumlusu Yener Unsal, Ritim İstanbul AVM, Cevizli Mah. Zühal Cad. A Blok No:46 İç Kapı No:50, 34846 Maltepe / İstanbul, Türkiye
General yenerunsal@yahoo.com

Changes