Strava

Is Strava safe?

Yes, once you change the defaults. The risk with Strava is not hackers: we found no breach of its user data. The risk is that a new adult account shows your profile and activities, maps included, to "Everyone", including people who are not logged in and search engines. A habit of running from your front door at 6 am is exactly the kind of detail a stalker wants. We score Strava 59/100, close to Google Maps at 60 and well above Life360 at 46.

Can people see where I live on Strava?

They could, and Strava has narrowed the gap rather than closed it. On new accounts, the first and last 200 metres of every map are hidden by default once you upload your first activity. You can widen that to up to a mile around a set address, or hide the whole map. But Strava's own help page warns that hiding part of a map "does not mean it would be impossible for someone to deduce a hidden location using additional information". Start times, segment leaderboards, photos and group activities can all give you away.

Defaults also do not reach backwards. If you switch your activities to "Followers", the setting applies to future uploads only. Older public runs stay public until you edit them.

Under-18 accounts created since September 2021 are treated differently. Their activities are visible to followers only, new followers need approval, 400 metres are hidden at each end of a map, and messaging is switched off.

The heatmap and the bodyguards

Strava's Global Heatmap shows where users have been active over the past year. In January 2018 a student noticed that it outlined military bases in Afghanistan, Iraq, Somalia and Syria, traced by soldiers jogging with fitness trackers. Strava's then chief executive, James Quarles, promised simpler privacy settings and a review of features "originally designed for athlete motivation". The heatmap stayed online.

Strava now says the heatmap uses only activities set to "Everyone", leaves out portions hidden by map settings, needs several users in an area before showing heat, and excludes under-18s. You can opt out under Product Improvements in your privacy controls.

The underlying problem came back in October 2024. Le Monde found public Strava accounts of 26 US Secret Service agents, 12 members of the French president's security group and 6 officers of Russia's FSO, enough to track the movements of Joe Biden, Donald Trump, Emmanuel Macron and Vladimir Putin. One agent's runs revealed the San Francisco hotel where Biden stayed for talks with Xi Jinping in 2023, according to the Associated Press. None of this needed a hack. It was all public data.

What data Strava collects

Strava is a social network built around precise location and health data. Apple's label lists purchases and identifiers as used to track you across other companies' apps and websites, and links precise location, health and fitness data, contacts and search history to your account. The privacy policy says Strava uses cookies for targeted advertising, which US users can opt out of, and licenses de-identified, aggregated data to city planners through Strava Metro. The policy says heart rate and other health data from connected devices are not sold or used for advertising, although Apple's label lists health and fitness data among the data Strava may use for its own marketing.

Trust took a knock in June 2025, when Strava ran a two-day test that showed workout names, pacing notes and coaching comments synced from Garmin, Runna and TrainingPeaks on users' activities without telling them first. Strava called it a short-lived test, ended it on 4 June and said it had no plans to revisit it.

How to set up Strava safely

1. In Privacy Controls, set Profile Page and Activities to "Followers", then change older public activities, which keep their old setting.
2. Under Map Visibility, add your home and work addresses and hide a wide area around each, not just the 200-metre default.
3. Set Group Activities to "Followers" or "No One" and check the Flyby controls, so strangers cannot see who you ran with.
4. Turn off Global Heatmap and Metro contributions under Product Improvements if you train near home or sensitive sites.
5. Vary your routes and start times, and do not post a run while you are still out.
6. Review who follows you and block anyone you do not know.

How we scored it

The regulatory record (90) is Strava's strongest factor, with no fines found. Privacy (42) is its weakest, because adult defaults are public and the App Store label shows ad tracking on top of precise location. Security (62) reflects a clean breach record but no app-based two-step login that we could find.