Security and privacy at K&L Fit

This is a translation provided for convenience. The Portuguese version prevails in case of any divergence, and Brazilian law applies.

Last updated: October 29, 2026

This page shows, without jargon, how K&L Fit protects your account and your data. The full rules on how data is used are in the Privacy Policy.

Connection

• The app only works over HTTPS (TLS 1.2 or 1.3), with HSTS: anyone who types http:// is taken to the secure version, and the browser refuses to open K&L Fit without encryption.
• We use security headers (Content-Security-Policy, clickjacking protection and others) that limit where the app can load code and data from.

Your password and your sign-in

• Your password is never stored as you typed it. We only keep an irreversible hash (PBKDF2-SHA256 with a unique salt per account and a secret key kept outside the database). Not even the team can see your password.
• Sign-in, sign-up and password recovery attempts are limited per IP, which makes guessing attacks harder.
• Continue with Google: sign-in happens on Google's own page; K&L Fit never sees your Google password. The return to the app uses a single-use code that is valid for 2 minutes.
• Access expires in 15 minutes and is renewed automatically while you use the app. When you change or reset your password, sessions open on other devices are ended.

Who on the team can access what

• The administrative dashboard requires two-step verification (a code in an authenticator app) to open.
• Every access to the dashboard is logged (who, what, when and from which IP) for 6 months.
• The dashboard shows sign-up, plan, subscription and usage statistics. It has no screen for reading the chat or for viewing body photos.

Payments

• The card number and security code are entered in the form of Stripe, which is certified at the highest level of the card security standard (PCI DSS Level 1). This data does not go through K&L Fit's servers.
• The access keys to services such as Stripe are stored encrypted (AES-256-GCM) in the database.

Photos

• Before upload, your phone itself resizes the photo and removes the location and other data the camera saves with it.
• Photos are kept in private, encrypted storage (Backblaze). There is no public link: each photo is only delivered through the app, after checking that whoever is asking has permission to see it.
• Body photos (Body log) are seen only by you: not by friends, not by your trainer, and not by the team through the dashboard.

Chat and notifications

• Chat only exists between a trainer and a client with an active connection, or between a client and a trainer they looked up in the portfolio. Either of them can end a portfolio conversation.
• Notifications on your phone travel end-to-end encrypted: the services from Apple, Google and others that deliver them cannot read the content.

Artificial intelligence

• In "Create workout with AI", we send the provider only the text you typed and the list of exercises. Name, e-mail, age and history are not sent.

Backups

• The database can be restored to any moment in the last 30 days, which protects against failures and mistakes.

You're in control

• Export data: in your Profile, download a copy of everything in your account.
• Delete account: in your Profile, at any time. Photos stop being accessible immediately; the rest of the data is deleted or anonymized within the periods set out in the Privacy Policy.
• End a connection, block and hide from search: all in the app, without having to ask anyone.

Public tests

Anyone can repeat these tests:

Found a flaw?

Write to contato@klfit.app with the subject "Segurança" (Security), describing how to reproduce the problem. We reply within 5 business days. We ask that you do not access other people's data, do not disrupt the app, and give us time to fix the issue before disclosing it. Anyone who acts this way, in good faith, will not be the target of any action on our part. We do not have a bounty program yet.

The same contact is published at /.well-known/security.txt, in the standard format (RFC 9116).