What does a public Strava activity show?
The whole route, and a clock beside it.
Strava's own documentation is explicit about where the data travels. An activity set to Everyone can put your name, your time, the date and a link to the activity on a segment leaderboard, your name and progress on a challenge leaderboard, and your name and effort count on a Local Legend listing.
The map carries more than any of those. A GPS trace is a line with two ends, and the ends are usually doors. The pace and the elevation say how fit the athlete is; the timestamp says which hour of which day they were outside.
None of this is a leak in the security sense. It is the product working exactly as designed, for an audience the athlete pictured as other athletes.
How does a repeated route reveal a home address?
Because a start point stops being a coordinate once it repeats, and becomes a habit.
One run beginning at a street corner says almost nothing. The same corner on Tuesday, Thursday and Sunday, at roughly the same hour, across four months, says that somebody sleeps within a few doors of it. The second most repeated endpoint is usually work, and the third is a gym, a school gate or a parent's house.
The timetable is the half people forget. A profile that shows a long ride every Saturday morning is also a notice that the house is empty every Saturday morning, for a duration the activity itself states precisely.
This is the same shape of problem as a photograph carrying its coordinates, and it is worth reading the guide to photo metadata beside this one.
Which Strava settings actually hide the map?
Three, and they differ in an important way: only one of them reaches backwards.
| Setting | What it hides | Applies to |
|---|---|---|
| Hide near an address | Everything within a chosen radius of one address, up to a mile | Past and future activities |
| Hide start and end | The two ends of every activity, wherever they happen to be | Future activities only |
| Hide the entire map | The whole route, leaving the numbers | Future activities only |
Strava also states a floor that applies without you choosing anything: after your first upload, the first and last 200 metres of future activity maps are hidden by default. Editing one activity overrides the default for that activity only.
Two limits sit beside that. Hiding part of the map keeps your times off the leaderboards for segments inside the hidden portion, and Strava says map visibility is not passed to third-party services that receive your activities.
The route is the interesting part to a training partner. The two ends of it are the interesting part to everybody else.
Can a hidden start point be worked out anyway?
It could be, on the mechanism Strava used until 2018, and the work is published.
Wajih Ul Hassan, Saad Hussain and Adam Bates presented Analysis of Privacy Protections in Fitness Tracking Social Networks at USENIX Security 2018. From a month of public posts — 21 million posts by 3 million users — they found 16.5% of users running an endpoint privacy zone.
The geometry is the whole attack. A zone of fixed radius truncates every route at the circle around the protected place, so each activity contributes one point on that circle, and three such points fix both the radius and the centre.
They recovered the protected location for 84% of users with more than one such activity, rising to 95.1% for users with three or more. The paper states the mechanism was replaced after they disclosed it.
Strava's defaults, as Strava documents them
Worth reading before assuming a profile is quiet, because most of these open outwards.
| Control | Default on a new account |
|---|---|
| Profile | Everyone |
| Activities | Everyone |
| Group activities | Everyone |
| Flyby | No One |
| Training log | Private |
| Map visibility | First and last 200 metres hidden |
Those are the values Strava lists on its account defaults page, and separate defaults apply to accounts belonging to under-18s. The activity default governs new uploads only; changing it does not reach back through your history.
So the honest summary is that Strava ships open on the social controls and closed on Flyby, with a small map fix applied for everyone. Defaults move, and this one has moved before, so read the current settings page rather than an article describing what the defaults used to be.
What do leaderboards, clubs and Flyby publish?
Relationships and places that the map setting never touches.
Segment leaderboards. A public activity puts your name and time on the leaderboard of every segment you crossed. A segment is a fixed piece of road, so a leaderboard is a public list of people who regularly run one particular street.
Clubs and group activities. Club feeds carry activities set to Everyone, and Strava groups athletes automatically when they recorded an activity together, followers or not. A club membership is also a statement about where you train and who you train with.
Flyby. It shows other athletes who crossed your path, with a link through to their activity. Strava documents it as off by default and requiring both the activity and the account to be set to Everyone.
The 2018 heatmap and the military bases
The strongest evidence that aggregate fitness data is location data is an accident nobody engineered.
In November 2017 Strava Engineering published its global heatmap, built from 700 million activities and 1.4 trillion latitude and longitude points covering 16 billion kilometres. It was aggregated and carried no names.
In January 2018 analysts noticed what aggregation does in a place with no background activity. Bellingcat's interpretation guide, published on 29 January, documents bases in Afghanistan as clearly identifiable and mappable from the traces alone.
The lesson is not that Strava was careless with names. It is that a route is identifying on its own, and that anonymising the athlete does nothing to anonymise the perimeter they ran around. The same arithmetic applies to a quiet suburb, where one trace in a street is as legible as one trace in a desert.
How do you check your own Strava exposure?
Log out and look at your own profile the way a stranger does, which is the only view that answers the question.
Open your profile in a private browser window with no session. Work through the most recent activities and ask where each one starts and ends, then sort your own history by day of week and look for the repeat. If one place appears at the start of most weekday activities, that place is published.
Then check the four settings above, remembering that only the address-based option reaches backwards. Everything else protects the next upload and leaves the archive as it is.
This one is a self-check. DetectiveCheck's username lookup covers 71 platforms and Strava is not one of them, so there is no report to run here. What the username lookup answers is the neighbouring question: where else the same handle is taken.
What this check cannot tell you
Whether anyone has looked, and whether the routes you hid today are the routes somebody copied last year.
Strava does not report who viewed a public activity, so the audit above measures exposure rather than harm. Tightening the settings changes what is published from now on; it does not recall a GPX file that was exported while the activity was public.
The recovery figures quoted above describe the mechanism as it stood in 2018, on a dataset gathered then. Strava's current documentation does not describe how the hidden portion of a map is chosen, so the same technique cannot be assumed to work today, and cannot be assumed to fail either.
The wider version of this question — what a stranger with your handle can assemble — is covered in what can be found about you online.
Common questions
Can someone find my home address from Strava?
From a public profile with a repeated start point, yes. A single activity gives one coordinate, but dozens of activities beginning at the same place, at similar times each week, identify a home to within a few doors. Strava now hides the first and last 200 metres of future activity maps by default, which shortens the trail without erasing the pattern.
Does hiding the start and end of a Strava activity work?
It removes the two most sensitive points from the published map, which is a real improvement over nothing. Two limits apply: the start-and-end option covers future activities only, and researchers at USENIX Security 2018 showed that a fixed-radius zone could be reconstructed from where multiple routes stopped. Only the address-based option is documented as applying to past activities.
What is a Strava privacy zone and how big can it be?
It is an area around an address that Strava removes from your published activity maps. Strava's map visibility settings let you hide activity near an address you enter, up to a one-mile radius, and that choice applies to past as well as future activities. Alternatives are hiding the ends of every activity, or hiding the map entirely, both of which apply going forward only.
Are Strava activities public by default?
Yes. Strava's own defaults page lists a new account as Profile: Everyone, Activities: Everyone and Group Activities: Everyone, with Flyby set to No One and the training log private. Different defaults apply to accounts belonging to under-18s. Changing the activity default affects new uploads only and does not reach back through activities you have already posted.
What do Strava segment leaderboards reveal?
A segment is a fixed stretch of road or trail, and a public activity that crosses one can place your name, your time, the date and a link to the activity on that segment's leaderboard. The effect is a published list of people who regularly use one particular street, which is location information independent of whether the activity map itself is visible.
What is Strava Flyby and is it on by default?
Flyby shows athletes whose activities crossed yours, with a link through to their activity. Strava documents it as requiring both the activity's privacy control and the account's Flyby control to be set to Everyone, and lists Flyby as No One on a new account. It is the one social feature Strava ships closed rather than open.
What happened with the Strava heatmap in 2018?
Strava Engineering published a global heatmap in November 2017 built from 700 million activities and 1.4 trillion location points. In January 2018 analysts realised that in places with no civilian activity the remaining traces outlined military installations. Bellingcat's guide of 29 January 2018 documents bases in Afghanistan as identifiable and mappable from the traces.
Does DetectiveCheck search Strava?
No. Strava is not among the platforms the username lookup publishes, so there is no Strava report to run here. This article is written for the check you run on yourself, inside Strava's own settings. The username lookup answers the neighbouring question instead: which other platforms the same handle is registered on.
Should I delete my Strava account for privacy?
Usually not. The exposure comes from published start points and repeated schedules, and both are configurable. Set the address-based map hiding, which applies to your history as well as your future uploads, review the profile and group activity controls, and check your own profile logged out. Deleting is a reasonable last resort, not the first step.
