Garmin Connect

Is Garmin Connect safe?

For most people, yes. Garmin Connect holds some of the most personal data a phone app can collect: heart rate, sleep, stress, weight and GPS tracks of where you run and ride. Garmin's own annual report lists heart rates, sleeping patterns, GPS-based location and activity patterns among the user data it holds. What it does not appear to do is feed that data to advertisers. Neither Apple's privacy label nor Google Play's data safety section shows any tracking or sharing with other companies, which is rare for a free app with more than 50 million Android installs.

We score Garmin Connect 70/100. That puts it well above Strava at 59, which shares activities with everyone by default and uses purchase data for ad tracking, and a little ahead of Flo at 66. The main reason it is not higher is security.

What data does Garmin Connect collect?

Apple's label splits Garmin's data into two groups. Linked to your identity: health and fitness data, your email address, contacts, support messages and a user ID. Collected but not linked to you: precise and coarse location, usage data and crash diagnostics. Nothing appears under "Data Used to Track You".

The Google Play listing tells a similar story. Garmin says the app shares no data with other companies, that health and fitness information is optional, and that data is encrypted in transit.

Garmin's privacy policy, last updated in January 2026, fills in the rest. Activity data is set to private by default, partner apps such as Strava or MyFitnessPal only connect with your consent, and a self-service Account Management Center lets you access, export, correct or delete your data at any time. The policy keeps data for as long as the account is active, without set retention periods.

The business model helps. Garmin makes its money from watches and bike computers, plus a paid Garmin Connect+ tier with extra insights, not from ads. That does not make the data risk-free. Detailed health and location histories are valuable to anyone who gets hold of them, which is why the 2020 attack matters.

The 2020 ransomware attack

On 23 July 2020, a cyber-attack encrypted some of Garmin's systems. Garmin said website functions, customer support, customer-facing apps and company communications were interrupted, and the flyGarmin aviation service also went down. Services took several days to come back. Garmin said there was "no indication that any customer data, including payment information from Garmin Pay, was accessed, lost or stolen", and that its devices kept working.

Security researchers linked the attack to WastedLocker ransomware. Reports at the time said the attackers asked for $10 million and that Garmin had obtained a decryption key. Garmin never confirmed either point.

The attack did not lead to a known data leak, so it weighs less than a breach would. It does show that Garmin's internal systems were reachable, and that one attack could cut off a service millions rely on.

How secure is a Garmin account?

Garmin offers two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, but the second step is a code sent by email or, according to its privacy policy, by text message. Users have asked for authenticator apps and security keys, and as of 2025 they were still waiting. A code is better than a password alone, but anyone who takes over your email account or phone number gets both factors.

There is a quirk for ECG users. Garmin requires two-step login for its ECG app, and once it is on, users on Garmin's own forum and the5krunner report that it cannot be switched off. Garmin staff said in the forum that they were investigating. If you sign in on several devices, expect to wait for email codes.

We found no public bug bounty for Garmin on HackerOne or Bugcrowd, which puts it behind companies such as Flo and Google that pay researchers to report flaws.

How to use Garmin Connect safely

1. Turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary in your Garmin account settings, and protect the email account that receives the codes with an authenticator app or passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary.
2. Set your profile and activities to private or connections only, and check older activities too.
3. If you start runs or rides at home, keep those maps private, or start recording a little way from your door.
4. Review which partner apps, such as Strava, can read your Garmin data, and disconnect the ones you no longer use.
5. Be wary of emails asking you to "verify" your Garmin account. Sign in through the app instead of a link.

How we scored it

The regulatory record (87) is Garmin Connect's strongest factor, with no fines found, and privacy (72) is high for a health app because neither store label shows ad tracking and activities start out private. Security (60) is the weakest, because of the 2020 ransomware attack, two-step login limited to email or text codes and no public bug bounty. Transparency and control (73) gains from self-service export and deletion but loses points for open-ended retention.