Strava
Strava, Inc. · Wearable / Fitness Tracker
✓ Reviewed
Index
Strava records precise GPS tracks of your runs and rides, building a detailed map of where you live, work out and travel, plus timestamps, pace and heart-rate data. Its social features expose more than most users realize: the global Heatmap aggregates everyone's routes, the Flyby feature shows other athletes who were near you (with names, photos and routes), and segment leaderboards publicize your regular paths. Default-public sharing has repeatedly turned individual movement data into a public dataset.
Why this rating
Deductions: precise, continuous location is the core data and is highly sensitive (-15); several exposure features (Heatmap, Flyby) historically defaulted to public/opt-out rather than opt-in (-10); privacy-setting complexity and vague aggregate-data language (-7); unilateral terms changes (-5). Granular privacy controls now exist, but the burden remains on the user to lock them down.
What it is
- GPS / location
- Requires a cloud account
- Manufacturer
- Strava, Inc.
- Category
- Wearable / Fitness Tracker
- Model years
- 2009-present
- Market status
- Current
- Companion app
- Strava
The evidence 3
Independent research, regulatory action, lawsuits, breaches and journalism about this device — the "what actually happens" axis. Each links to its source.
-
Strava's 2017 global Heatmap, aggregating a billion activities, inadvertently revealed the perimeters, internal layouts and patrol routes of secret military bases in Afghanistan, Iraq, Syria and Somalia.
Why it matters here: Demonstrates how this service's default aggregation of GPS tracks can expose sensitive locations of its users at scale.
-
The Flyby feature reveals the identity, photo and route (effectively the home area) of nearby athletes, a design repeatedly flagged as a stalking vector.
Why it matters here: Directly documents a stalking/deanonymization risk built into this service's social features.
-
2023 research showed the updated Heatmap could still be used to identify individual users' home addresses from their activity starting points.
Why it matters here: Shows the location-exposure problem persists years after the 2018 military-base incident.
Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.