Strava
Strava, Inc. · Wearable / Fitness Tracker
Staff Reviewed — a person at DeSpy reviewed this rating.
Index
Strava records precise GPS tracks of your runs and rides, building a detailed map of where you live, work out and travel, plus timestamps, pace and heart-rate data. Its social features expose more than most users realize: the global Heatmap aggregates everyone's routes, the Flyby feature shows other athletes who were near you (with names, photos and routes), and segment leaderboards publicize your regular paths. Default-public sharing has repeatedly turned individual movement data into a public dataset.
Why this rating
Deductions: precise, continuous location is the core data and is highly sensitive (-15); several exposure features (Heatmap, Flyby) historically defaulted to public/opt-out rather than opt-in (-10); privacy-setting complexity and vague aggregate-data language (-7); unilateral terms changes (-5). Granular privacy controls now exist, but the burden remains on the user to lock them down.
What it is
- GPS / location
- Requires a cloud account
- Manufacturer
- Strava, Inc.
- Category
- Wearable / Fitness Tracker
- Model years
- 2009-present
- Market status
- Current
- Companion app
- Strava
The evidence 3
Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.
-
Strava's 2017 global Heatmap, aggregating a billion activities, inadvertently revealed the perimeters, internal layouts and patrol routes of secret military bases in Afghanistan, Iraq, Syria and Somalia.
Why it matters here: Demonstrates how this service's default aggregation of GPS tracks can expose sensitive locations of its users at scale.
-
The Flyby feature reveals the identity, photo and route (effectively the home area) of nearby athletes, a design repeatedly flagged as a stalking vector.
Why it matters here: Directly documents a stalking/deanonymization risk built into this service's social features.
-
2023 research showed the updated Heatmap could still be used to identify individual users' home addresses from their activity starting points.
Why it matters here: Shows the location-exposure problem persists years after the 2018 military-base incident.
Are you the maker? Respond to this finding
Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.
Think something here is wrong?
Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.
Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.