Dimens Logo
Dimens.

Privacy Policy

Last Updated: November 10, 2026

1. Data Controller and Scope

KHORA DESIGN LAB YAZILIM MİMARLIK İNŞAAT VE MÜHENDİSLİK ANONİM ŞİRKETİ ("Khora" or the "Company") is the data controller for the personal data processed when you use the Dimens app. Address: Gülbahçe Mah. Gülbahçe Cad. Kuluçka Merkezi Binası Sitesi No 1/4 5. İç Kapı No: 10 Urla/İzmir. Contact: info@khora.tr. This policy explains how we process your personal data and what your rights are; where your consent is required, the app asks for it separately.

2. Camera and LiDAR Data

Dimens uses your device's camera and rear LiDAR scanner to scan your space.

Data Processing: Depth data obtained from the rear LiDAR scanner through Apple's ARKit and RoomPlan is used only for real-time measurement and 3D model generation.

Storage and Sharing: This raw sensor data is NEVER SENT to the Company's servers and NEVER SHARED with third parties. The room measurements and 3D model created from this raw data, however, are uploaded to our servers (Supabase) to be stored in your account and to generate export files (DXF, etc.).

3. Analytics and Usage Data

To improve app performance and detect bugs, we may collect usage data that does not include your name or email address and is linked to a random user ID. This data may include:

  • App crash logs,
  • Frequency of features used,
  • Device model and operating system version.

Our website (dimensapp.khora.tr) uses no measurement or advertising tools. Only cookies the site needs to work (for example, your language choice) may be used.

We use Google Firebase Analytics (US) for app analytics. This data is collected only if you give permission on the consent screen in the app; permission is off by default and can be changed in Settings. We use Firebase Crashlytics (US) for crash reports; it is always on so the app keeps working properly, and your user number is added to reports only with your analytics permission.

Crash reports are processed under our legitimate interest in keeping the app reliable and improving it.

Subscriptions: Payments are handled by Apple; we do not see your card details. Your subscription status is processed through RevenueCat (US), linked to your account ID.

Project and report data: Your projects, scans, the photos you add to reports, and the PDF and export files you create are stored on our servers. Location information (EXIF) in photos is removed before upload.

Account deletion: You can delete your account in the app via Profile → Settings → Permanently Delete Account. This deletes your projects, scans, files, and profile. Deleting or deactivating your account does not cancel your subscription; you need to cancel it in your Apple Account settings. When your account is deleted, deletion of your records in Google Analytics and RevenueCat is also requested. If you deactivate your account, your data is deleted after 30 days. Content you have added to another user's or organization's project is not deleted; it is transferred to the project owner. When you use the app without signing in (as a guest), your data is kept until you delete it. If you sign in later, this data is transferred to your account. Reports for scans you delete are permanently deleted after 30 days.

4. Ads (Google AdMob)

The free plan of the app shows Google AdMob ads (Google LLC / Google Ireland Limited). There are no ads on the Pro and Teams plans. Ads do not depend on your analytics permission: choosing "Continue with essentials only" on the consent screen does not turn off ads on the free plan.

  • Banners: Shown only on the home screen, the projects list and the scan detail screen. There are no banners on the scanning, measuring, saving, PDF and export, payment or settings screens.
  • Rewarded video: Shown only if you tap "Watch an ad (+1 coin)" yourself on the purchase sheet; you earn 1 coin for it (at most 10 a day). It is optional and does not depend on the tracking permission. To verify that you watched the ad, your random user number and a single-use ticket are passed to Google; Google sends them back to our server for verification.
  • Data collected: Google's ad software may collect device identifiers, approximate location estimated from your IP address, the ads you see, ad interactions, and performance and diagnostic data.
  • Consent (EU, UK, Switzerland): Google's consent form (UMP) is shown before ads are requested. If you decline personalized ads, Google may show non-personalized or limited ads. You can change your choice with the "Ad Privacy Options" row in Settings.
  • Other countries: The app has no separate ad preferences screen; you can prevent your advertising identifier from being shared by not granting the iOS tracking permission.
  • Advertising identifier (IDFA): Can be used only if you allow it in iOS's tracking permission (App Tracking Transparency) dialog. The app has one such permission: if you grant it, both Meta and Google can use the identifier. You can withdraw it in iOS Settings → Privacy & Security → Tracking.
  • Children: The app is not directed at children.

5. Ad Measurement (Meta / Facebook)

We use the Meta SDK to measure the effectiveness of our ads on Facebook and Instagram (Meta Platforms Ireland Limited / Meta Platforms, Inc.). The SDK runs only if you choose "Accept and get started" on the consent screen or turn on "Usage Analytics" in Settings. This processing is based on your explicit consent; when you turn the permission off, sending to Meta stops.

  • Events sent: Install and app open, creating an account with Apple, saving a scan (only the event itself), starting a trial, subscribing and buying an Export Pass or a single right (logo-free PDF, DXF) (product, amount, currency, transaction number).
  • Not sent: Your name, email, account ID and the content of your scans.
  • Device data: Meta may receive device information and your IP address.
  • Advertising identifier (IDFA): Passed to Meta only if you grant the iOS tracking permission. This dialog appears once, after you save your first scan, if you gave the in-app permission. If you do not allow it, measurement is done without the advertising identifier using Apple's and Meta's aggregated methods (SKAdNetwork, Aggregated Event Measurement).

6. Scan and Report Share Links

Pro and Teams users can create a read-only link for a saved scan or report. Anyone with the link can see the content without signing in, so share it only with people you trust.

  • What is shared: A scan link shows the scan and project name, area, date, 3D model and measurements; a report link shows the report's PDF. A scan link does not show its creator's name.
  • When a link closes: You can close a link at any time. A link also closes if the content is deleted, you lose access to it or your plan ends; if your plan starts again, a link you did not close yourself opens again.
  • Open counts: The number of opens is kept per link; the identity of the person opening it is not recorded.
  • "Download the app" button: When you tap this button on the link's page, the link is copied to your device's clipboard and an irreversible digest of your IP address (HMAC; for IPv6, its /64 network) is kept in server memory for at most 1 hour. Its only purpose is to offer to paste the link when you install and open the app. No link, account or browser details are stored with the digest, and it is deleted once used.
  • Clipboard: The app reads the clipboard's content only when you tap iOS's Paste button. After a new install, to decide whether to show this offer, it looks only at the type of the data on the clipboard and whether it resembles a link, without reading the content; this information does not leave the device.

7. Service Providers

We use the following services to run the app:

  • Supabase (AWS, Sweden): Account, profile, projects, scans, reports and files.
  • Railway (Netherlands): File conversion (DXF, GLB, OBJ, STL) and share pages. Our website is also hosted on Railway.
  • Google Firebase (US): Analytics (with your permission) and Crashlytics.
  • Google AdMob and UMP: Section 4.
  • Meta: Section 5.
  • RevenueCat (US): Subscription and purchase records, linked to your account ID.
  • Apple: Sign in with Apple, App Store payments and delivery of push notifications.
  • Expo (US): Delivery of push notifications (push token and notification text).
  • Cloudflare (US): DNS service for the khora.tr domain.
  • DiceBear: Avatars and default project or organization images are loaded from api.dicebear.com. These requests carry your IP address and the image's seed value; the seed is random text, and for an organization logo it may be derived from the organization's name.

8. International Transfers

Your data is processed on servers outside Türkiye. Your account and project data run in the EU (Sweden); file conversion and share pages run in the EU (the Netherlands). The providers of these services, as well as Firebase, RevenueCat, Expo and Cloudflare, are based in the US; Google and Meta may process data in several countries, including the US.

9. Retention Periods

  • Account and content: Kept while your account is open and deleted when you delete your account. Deactivated accounts are deleted after 30 days.
  • Deleted content: Deleted projects, scans, reports and photos, and closed organizations, are permanently deleted after 30 days. Older PDF versions of a report are deleted 24 hours after a newer one.
  • IP digest: At most 1 hour, in server memory only.
  • Google Analytics: 14 months.
  • Crashlytics: 90 days. It has no per-user deletion, so records are deleted at the end of this period even if you delete your account.
  • Subscription events: Event records reaching our server from RevenueCat are deleted after 90 days. Sales records and invoices remain with Apple.
  • Coins and rights: Your coin balance, earning and spending records, the Export Passes and single rights on your scans, and rights not yet applied to a scan are kept while your account is open. When you delete your account your coin records are deleted and rights not yet applied end; rights on scans are deleted with the scan, or stay on it if the scan is handed over to another project owner.
  • Apple account digest: So that rights given once per Apple account (10 coins and the free Export Pass) are not given to the same account twice, an irreversible digest (SHA-256) of your Apple user identifier is kept with the type of right and its date. This record stays indefinitely, even if you delete your account; the link to your account number is removed on deletion and your Apple identifier itself is not stored. The basis is our legitimate interest in preventing abuse of these rights.
  • Server logs: Supabase logs are kept for 7 days and Railway logs for 30 days; they may contain your user number and IP address.
  • Export ID in branded PDFs: An invisible random ID is embedded in every page of PDFs with the Dimens logo; PDFs without the logo do not have it. Our server records this ID with your account, the report and the creation date. Its purpose is to identify which account and report produced a PDF if a copy is found elsewhere; it is not available to other users. There is no time limit on this record: when your account or the report is permanently deleted, the links are removed and only the ID and date remain.

10. Your Rights (KVKK and GDPR)

Under Article 11 of the KVKK in Türkiye and the GDPR in the EU and the UK, you have the right to:

  • Learn whether your data is processed and request information about it,
  • Learn the purpose of processing and the third parties your data is transferred to,
  • Have incomplete or incorrect data corrected, have your data deleted, and have those recipients informed,
  • Object to processing, ask for it to be restricted and (under the GDPR) ask for your data to be ported,
  • Object to a result against you arising from automated analysis and claim compensation for damage,
  • Withdraw the permission you gave: "Usage Analytics" in Settings for analytics and Meta, "Ad Privacy Options" for ads, and the iOS Tracking setting for the advertising identifier,
  • Complain to the Turkish Personal Data Protection Board or the supervisory authority in your country.

You can send your requests to the address below; requests under the KVKK are answered within 30 days at the latest.

11. Data Breach and Security Limitations

We take reasonable commercial measures (encryption, access restriction, etc.) to protect your data. However, we cannot guarantee that data transmission over the internet or electronic storage is 100% secure. The Company assumes no responsibility for unauthorized access, theft, or destruction of data beyond its legal obligations. Securing your device (passcode, Face ID, etc.) is your responsibility.

12. Changes and Contact

We reserve the right to update this policy. Changes are published on this page and the "Last Updated" date is updated; important changes are also announced in another suitable way, such as an in-app notification.

For privacy-related requests, contact: info@khora.tr