Strava is a social fitness network operated by Strava, Inc. (San Francisco; privately held, VC-backed by TCV, Sequoia Capital and others) built around GPS-tracked exercise. Its privacy policy (effective January 1, 2026) states precise device location must be granted for core features and that adult users' profiles and activities default to "Everyone" visibility, including search engine results. The policy discloses cookies, pixels, SDKs and Google Analytics for analytics and ads, and its California disclosures describe sharing with advertising publishers such as Meta for cross-context behavioral advertising, with an opt-out. Aggregated, de-identified data powers the public Global Heatmap and Strava Metro for city planners. Public-by-default data twice drew security scrutiny: the 2018 heatmap revealed military-base activity, and a 2024 Le Monde investigation traced world leaders via bodyguards' public accounts.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
15 ON FILE
COLLECTION
Strava's Global Heatmap and Strava Metro support page states that member activity data is aggregated and de-identified to power the public Global Heatmap, that "heat" is only shown once multiple users have traversed an area within the last year, and that activities not set to "Everyone" and portions hidden by map visibility settings are excluded.
Strava's Privacy Policy (effective January 1, 2026) states that users must grant permission to track their device's precise location for core features to function, and that Activity Data can include health data such as heart rate; device integrations (e.g., Garmin, Peloton, Apple Health) can add step count, sleep information, HRV, and VO2max.
Strava announced on November 16, 2020 that it had raised $110 million in a Series F financing round led by TCV and Sequoia Capital, with participation by Dragoneer Investment Group, Madrone Capital Partners, Jackson Square Ventures, and Go4it Capital; Strava, Inc. remains a privately held company with no public SEC reporting.
Strava publishes a dated, versioned privacy policy (effective January 1, 2026) and commits to posting revised policies with their effective date and to providing prominent advance notice of changes it deems material.
Strava Metro's FAQ states that data shared with urban-planning partners through the Metro platform is aggregated and de-identified consistent with GDPR and CCPA, and that the Metro dataset excludes all activities made private by members and activities from members who requested account deletion.
Strava's Privacy Policy (effective January 1, 2026) sets adult users' profiles and activities to be viewable by "Everyone" by default, including search engine results; its California disclosures state that categories of personal information may have been shared with third parties — including advertising publishers such as Meta — for cross-context behavioral advertising or analytics, with an opt-out available via a "Do Not Share My Personal Information" link and Global Privacy Control support.
In January 2018, Strava's published Global Heatmap — a data visualization of user activities — was found to reveal the location and staffing of military bases and spy outposts worldwide, after analyst Nathan Ruser noted that US bases were clearly identifiable from soldiers' exercise routes (The Guardian, January 28, 2018).
In a January 29, 2018 letter to the community responding to the heatmap incident, Strava CEO James Quarles said the heatmap respected privacy selections including the ability to opt out of heatmaps altogether, and committed to working with military and government officials on potentially sensitive data, reviewing features that could be compromised by bad actors, and simplifying privacy and safety tools.
An October 2024 investigation by French newspaper Le Monde found that the movements of world leaders including Joe Biden, Emmanuel Macron, and Vladimir Putin could be tracked via the public Strava accounts of their security agents; journalists identified 26 U.S. Secret Service agents, 12 members of France's GSPR, and six members of Russia's FSO with public accounts. The U.S. Secret Service told the newspaper it did not believe its protection was compromised (Associated Press via SecurityWeek, October 29, 2024).
A USENIX Security 2018 paper by Hassan, Hussain, and Bates analyzed 21 million posts from a popular fitness tracking service and demonstrated an attack against Endpoint Privacy Zones (the mechanism Strava calls privacy zones), finding that 95.1% of moderately active users studied were at risk of having their protected locations (e.g., home) inferred from public posts.
Strava's Privacy Policy (effective January 1, 2026) discloses the use of cookies, tracking pixels, SDKs, Google Analytics, and other third-party tracking technologies for purposes including analytics and serving ads, and a Targeted Advertising section states Strava may use cookies and other tracking technologies to support targeted advertising.