Strava
Strava collects extensive personal data including precise GPS routes and health metrics, shares it with advertisers, law enforcement, and commercial partners, and can sell it to third parties if the company changes hands — all under a privacy policy it can rewrite at any time without your explicit consent. If Strava causes you harm, your ability to fight back is severely restricted: disputes go to private arbitration, class actions are banned, you have only one year to act, and the most money you can ever recover is $50. The company can use your name and photos in paid advertisements for free, keeps ownership of public routes and segments you create even after you leave, and trains its AI systems on your personal data. A few user-friendly features exist, like the ability to export your data and opt out of non-essential cookies, but the overall legal framework heavily favors Strava at the expense of user rights and recourse.
Last analyzed
Heads up: this analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original document before you agree — see our Terms.
Clause-by-clause breakdown
Every clause we flagged in Strava's agreement, with what it means for you.
Disputes must go to private arbitration; class actions are banned.
“NOTICE REGARDING DISPUTE RESOLUTION: THESE TERMS CONTAIN PROVISIONS THAT GOVERN HOW DISPUTES BETWEEN YOU AND STRAVA ARE RESOLVED, INCLUDING AN AGREEMENT TO ARBITRATE, WHICH WILL—UNLESS YOU RESIDE IN THE EU OR JURISDICTIONS WHERE PROHIBITED—WITH LIMITED EXCEPTION, REQUIRE YOU TO SUBMIT CLAIMS YOU HAVE AGAINST US TO BINDING AND FINAL ARBITRATION AND LIMIT YOU TO CLAIMS AGAINST STRAVA ON AN INDIVIDUAL BASIS, UNLESS YOU OPT-OUT IN ACCORDANCE WITH THE INSTRUCTIONS BELOW.”
Quoted verbatim from the agreement What this means: If you're outside the EU, Strava requires you to resolve disputes through private arbitration rather than in court, and you cannot join a class-action lawsuit against them. This means you give up the right to have a judge or jury hear your case, and you cannot band together with other users to sue Strava collectively. An opt-out is mentioned but the instructions are not reproduced in the provided documents.
What you can do: Look for the opt-out instructions in the full Terms of Service and submit your opt-out in writing as soon as you sign up, before any dispute arises.
Strava can use your name and photos in paid ads for free.
“You grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly perform and display any of your Content and any name, username or likeness that you post on or in connection with the Services in all media formats and channels now known or later developed, without compensation to you. This includes permission to use your profile name, profile photo, and information about your activities, including your use of third-party products, services, or devices, in ads, offers and other commercial contexts. For example, we may show your Strava followers that you use a certain device, product, or service available from a third party that has paid us to display its ads on Strava.”
Quoted verbatim from the agreement What this means: Strava can use your name, profile photo, and activity data in paid advertisements without paying you. A third-party brand can pay Strava to show your followers that you use their product, effectively turning you into an unpaid endorser. This license covers all current and future media formats worldwide.
What you can do: Review your privacy controls in the app to limit what activity data and profile information is publicly visible, which reduces what Strava can use in commercial contexts.
Public routes and segments stay with Strava forever after you leave.
“For your public routes and segments, clubs that you have created, and posts you've made to support channels, the license will be perpetual (indefinite) in nature, and we may continue to store and use such information after your account is deleted.”
Quoted verbatim from the agreement What this means: Even if you delete your Strava account, Strava keeps and can continue using your public routes, segments, clubs you created, and support posts forever. This data is not removed when you leave the platform. The license for this content never expires.
What you can do: Before deleting your account, manually delete or make private any routes, segments, or clubs you do not want Strava to retain and use indefinitely.
Strava can change its privacy policy anytime; continued use means you agree.
“Strava reserves the right to modify this Policy at any time. If we make changes to this Policy, we will post the revised policy and its effective date on our website. If we make changes we deem to be material, we will provide prominent, advance notice. If you object to any changes to this Policy, you should stop using the Services and delete your account.”
Quoted verbatim from the agreement What this means: Strava can change its privacy policy whenever it wants. For non-material changes, simply posting the update online is enough — your continued use of the service counts as acceptance. Even for material changes, the only remedy offered if you disagree is to stop using Strava and delete your account.
What you can do: Watch for policy update emails or check the effective date on the Privacy Policy page periodically; if you disagree with a change, you must delete your account to avoid being bound by it.
Strava can share your data with police or governments worldwide at its discretion.
“We may preserve and share your information with third parties, including law enforcement, public or governmental agencies, or private litigants, within or outside your country of residence, if we determine that the law compels or reasonably requires such disclosure. This may include responding to court orders, warrants, subpoenas, or other legal or regulatory process, or disclosures that are otherwise permitted by law. We may also retain, preserve or disclose your information if we determine it is reasonably necessary or appropriate to: (1) prevent death, serious bodily injury, or other significant harm; (2) address issues of national security or other issues of public importance; (3) prevent or detect violations of our Terms or fraud or abuse of Strava or its users; or (4) protect our operations or our property or other legal rights, including in connection with actual or potential litigation.”
Quoted verbatim from the agreement What this means: Strava can share your data with law enforcement, government agencies, or private parties in any country — not just your own — based on its own judgment that disclosure is 'reasonably necessary.' The scope extends beyond court orders to include broad self-defined categories like 'national security' or protecting Strava's own legal rights. Precise GPS location and health data could be included.
What you can do: Be aware that your precise location and health data may be disclosed to authorities or private litigants; consider using privacy controls to limit the sensitivity of data you share on the platform.
You have only one year to file any legal claim against Strava.
“You agree that any claim you may have arising out of or related to your relationship with Strava, these Terms, or the Services must be filed within one year after such claim arose; otherwise, your claim will be permanently barred.”
Quoted verbatim from the agreement What this means: Strava shortens the legal window to file a claim against them to just one year. In many US states, the standard statute of limitations for contract or consumer claims is two to four years. This compressed deadline can cause users to unknowingly lose their legal rights before they even realize they have a claim.
What you can do: If you believe Strava has harmed you, consult a lawyer promptly — do not wait. The one-year clock starts from when the issue arose, not when you discovered it.
Strava's maximum payout to you is just $50.
“STRAVA'S MAXIMUM AGGREGATE LIABILITY TO YOU PURSUANT TO THESE TERMS SHALL NOT EXCEED THE GREATER OF EITHER (A) FIFTY DOLLARS ($50), OR (B) THE AMOUNT OF FEES PAID BY YOU TO STRAVA IN THE 12-MONTHS PRIOR TO THE DATE OF THE CLAIM.”
Quoted verbatim from the agreement What this means: No matter how badly Strava's failures harm you — including data breaches exposing your precise GPS location history, health data, or personal information — the most they will ever pay you is $50 or your last 12 months of subscription fees. For free users, this cap is literally $50. This is disproportionately low given the sensitive nature of the data Strava holds.
What you can do: Understand that your financial recourse against Strava is severely limited. Consider whether the data you share with Strava is worth the risk given this cap.
Your data transfers to any buyer if Strava is sold or goes bankrupt.
“If Strava becomes involved in a business combination, acquisition, securities offering, bankruptcy, reorganization, dissolution, or other similar transaction, we may share or transfer your information in connection with such transaction.”
Quoted verbatim from the agreement What this means: If Strava is sold, merges with another company, or goes bankrupt, your personal data — including precise GPS routes, health data, and activity history — can be transferred to the new owner. The new owner is not required to follow Strava's current privacy policy. You have no opt-out right for this transfer.
What you can do: There is no direct action to prevent this; if Strava is acquired, monitor communications about any privacy policy changes from the new entity and consider deleting your account if the new owner's policies are unacceptable.
Strava uses your personal data to train its AI models.
“We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified information for AI Features where possible for their purpose. Learn more about your choices to contribute to Strava's development of AI Features.”
Quoted verbatim from the agreement What this means: Strava uses your data to train its AI and machine learning models, including models run by third-party service providers. While it says it prefers aggregated or de-identified data 'where possible,' this leaves room for identifiable personal data to be used when Strava decides it's necessary. A separate opt-out choice is mentioned but not detailed in the provided text.
What you can do: Look for the 'AI Features' privacy control in your Strava settings and opt out of contributing your data to AI training if you prefer not to.
Strava sells aggregated data from your activities to commercial partners.
“We may also license or share deidentified or aggregated information with third parties for purposes such as to improve walking, running or riding in cities via Strava Metro or to help our partners understand more about users, including the people who use their products and services.”
Quoted verbatim from the agreement What this means: Strava sells or licenses aggregated data derived from your activities to third-party partners, including commercial partners who want to understand their customers. While the data is described as 'deidentified,' aggregated location and activity data from fitness apps has been shown in research to be re-identifiable, especially for users with unique routes.
What you can do: Use the privacy controls to set your activities to 'Only You' or 'Followers' visibility, which may reduce the data contributed to aggregated datasets like Strava Metro.
Core features require sharing your precise GPS location with Strava.
“For our core features to function (e.g., GPS activity tracking, routes, segments), you must grant us permission through your device to track your device's precise location. You can stop sharing precise location at any time with your device settings.”
Quoted verbatim from the agreement What this means: Using Strava's core features requires granting access to your precise GPS location. This data is used to generate routes, match segments, and power community features like the Global Heatmap. Your precise location — including where you live, work, and regularly exercise — is collected and stored.
What you can do: You can revoke location permission in your device settings at any time, though this will disable GPS tracking and related core features.
Your GPS routes are public and searchable by default.
“Subject to your privacy controls, your information, including parts of your profile, username, photos/videos, information and content you share (including precise location, such as where you run or ride), users you follow and who follow you, clubs you belong to on Strava, your Activity Data, the devices you use, your online status, and kudos and comments you give and receive may be viewable on Strava or to non-registered users. If you are 18 years or older, certain information, including your profile and your activities, is set by default to be viewable by 'Everyone.' 'Everyone' includes Strava users and the public, including search engine results.”
Quoted verbatim from the agreement What this means: By default, your profile and activities — including precise GPS routes — are public and indexed by search engines. This means anyone on the internet can see where you run or ride without needing a Strava account. You must actively change your privacy settings to restrict this.
What you can do: Go to your Strava privacy settings and change your default activity visibility from 'Everyone' to 'Followers' or 'Only You,' and enable privacy zones around your home and workplace.
Any ideas or feedback you send Strava belong to them forever.
“You may have the ability to provide comments, feedback, suggestions, ideas, original or creative materials, and other communications regarding the Services and the information and services we make available through the Services (collectively, 'Feedback'). If you provide Feedback, you grant Strava a worldwide, non-exclusive, transferable, assignable, sub-licensable, perpetual, irrevocable, royalty-free license to copy, distribute, create derivative works of, publicly display, and perform and otherwise exploit such Feedback and to use, make, have made, sell, offer for sale, import, and export products and services based on such Feedback.”
Quoted verbatim from the agreement What this means: Any feedback, suggestions, or ideas you send to Strava — including bug reports or feature requests — become Strava's to use forever, for free, in any way they choose, including building and selling products based on your ideas. You cannot revoke this license and receive no compensation.
What you can do: Be aware that any suggestions or ideas you share with Strava become theirs permanently; if you have a commercially valuable idea, do not share it through Strava's feedback channels.
Strava keeps your data as long as it decides it needs to.
“We retain information as long as needed to provide the Services, subject to our legal obligations. We generally keep information associated with your account until you delete it or we no longer need the information to provide the Services. In making these determinations, we consider the amount, nature, and sensitivity of the personal information, the purposes for which we process it, whether we can achieve those purposes through other means, and applicable legal requirements. Restrict or Delete: You may have the right to restrict or delete personal information. You can restrict or delete much of your information through your account, such as deleting content like photos or videos you have posted, removing individual activities from view, deleting individual activities, or deleting your account. To delete your account, follow the instructions provided here. Once deleted, we cannot reinstate your data, including your account, activities, and place on leaderboards. Following deletion of your account, it may take up to 45 days to delete your personal information and system logs from our systems. We do not have control over content you have shared directly or publicly with others, such as photos or videos on other social media platforms, or that others may have copied. Public segments and routes will also remain available. Search engine results may also display your public profile until the search engine refreshes its cache.”
Quoted verbatim from the agreement What this means: Strava does not commit to a specific maximum retention period for your data. Data is kept as long as Strava decides it needs it, which is a vague standard. After account deletion, it may take up to 45 days to remove personal information and system logs, but some data (public routes, segments) is kept indefinitely.
What you can do: Submit a formal deletion request through your account settings and follow up if you do not receive confirmation within 45 days.
Strava shares your data with third-party ad networks for targeting.
“Targeted Advertising: We advertise our Services through third parties, and may use cookies and”
Quoted verbatim from the agreement What this means: The Privacy Policy references targeted advertising using cookies and third-party services, though the document appears to be cut off before the full details are provided. The Cookie Policy confirms that 'targeting cookies are used to provide relevant ads by remembering your activity on the websites you visit' and that Strava 'may share your information with third parties for these purposes.' This means your browsing and activity data is shared with advertising partners.
What you can do: Use the cookie preference manager on Strava's website to disable targeting cookies. You can also use opt-out tools from the Digital Advertising Alliance or European Interactive Digital Advertising Alliance if you are in the EEA.
Strava collects your precise GPS location and detailed health data.
“Location Information: We collect or infer location information when you sign up for and use the Services. For our core features to function (e.g., GPS activity tracking, routes, segments), you must grant us permission through your device to track your device's precise location. You can stop sharing precise location at any time with your device settings. Activity Data: We collect Activity Data directly or through third-party integrations you configure. "Activity Data" is information about the activities you record or upload to Strava, such as equipment usage, date, time, distance, speed, pace, perceived exertion, power, cadence, and geolocation information. Activity Data can also include health data, such as heart rate, if you choose to provide it. You accept all safety, security, and other risks associated with the use of any Strava or third-party geolocation features, tools, and technology, including when recording or sharing GPS-based activities via the Services, using Strava Beacon, or using other map- or location-based features on the Services. These risks may be greater depending on your circumstances, e.g., if you work in a sensitive job or position of trust. To the maximum extent permitted by law, Strava is not responsible for any such risks. You agree to use any such geolocation features, tools, and technology in a way that is safe, secure, and responsible, in accordance with your circumstances and applicable laws. Nothing in this section takes away from any other sections in these Terms where we disclaim warranties and limit or exclude liability. You can learn more about how we use geolocation information in our Privacy Policy.”
Quoted verbatim from the agreement What this means: Strava collects your precise GPS location continuously during activities, along with detailed health metrics like heart rate, HRV, and VO2max from connected devices. This creates a detailed picture of where you go, when, and how your body responds. The Terms also note that geolocation risks 'may be greater depending on your circumstances, e.g., if you work in a sensitive job or position of trust.'
What you can do: Use Strava's privacy controls to hide your start and end points (the 'Privacy Zone' feature) and set activities to private or followers-only. Disable precise location access in your device settings when not actively recording.
Strava can transfer your content rights to other companies.
“You grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly perform and display any of your Content and any name, username or likeness that you post on or in connection with the Services in all media formats and channels now known or later developed, without compensation to you.”
Quoted verbatim from the agreement What this means: The license Strava takes over your content is transferable and sub-licensable, meaning Strava can pass your content and likeness rights to other companies or partners without asking you. This is a very broad grant that goes well beyond what is needed to simply operate the service.
What you can do: Be mindful of what content you post publicly. Setting activities and profile information to private limits the scope of content Strava can license and redistribute.
Strava promises not to sell or use your health data for ads.
“Connected Devices and Apps: We collect information (including Activity Data) from devices and apps you choose to connect to Strava, such as your Garmin device, Peloton account, or Apple Health app. This could include, for example, step count, sleep information, heart rate, HRV, or VO2max. If we collect health information from these integrations (such as heart rate), we will not sell or use it for advertising or other similar purposes; we do not disclose it to third parties without your prior consent; and we will only use it for the specific purposes described in this Policy.”
Quoted verbatim from the agreement What this means: Strava explicitly commits not to sell health data (like heart rate, HRV, VO2max, sleep) collected from connected devices, and not to use it for advertising. This is a meaningful user protection that goes beyond what many services offer for sensitive health information.
You can download all your activity data directly from your account.
“Access and Portability: You may have the right to know, and request access to, the personal information we collect, use, share, or otherwise process about you. You can access much of your information by logging into your account. To download your data, including your activity files, follow the instructions here.”
Quoted verbatim from the agreement What this means: Strava provides a self-service data download tool that lets you export your activity files and personal data directly from your account. This is a meaningful user right that allows you to take your data to another service.
What you can do: Use the data download feature in your account settings to export your activity files and personal data at any time.
You can disable non-essential tracking cookies at any time.
“You can manage your cookie preferences at any time, including to disable or revoke consent for cookies not categorized as essential, by changing your cookie preferences. In addition: Your mobile device may have privacy settings that allow you to limit the use of advertising identifiers to personalize ads based on your interests. Some online tools, such as the Digital Advertising Alliance's Browser Check, may allow you to choose how cookies are used throughout the web based on your device and browser. Residents of the EEA, UK and Switzerland may opt-out of online behavioral advertising served by the European Interactive Digital Advertising Alliance's participating member organizations by visiting https://www.youronlinechoices.eu/ or through your mobile device settings, where available, and the DAA's AppChoices mobile application opt-out offering here: https://youradchoices.com/appchoices.”
Quoted verbatim from the agreement What this means: Strava provides a cookie preference manager that lets you disable non-essential cookies, including targeting and performance cookies, at any time. This is a meaningful control that goes beyond the legal minimum in many jurisdictions. EEA, UK, and Swiss users also have access to additional opt-out tools for behavioral advertising.
What you can do: Visit Strava's cookie preference manager (accessible via the Cookie Policy page) and disable targeting and functional cookies if you do not want your browsing behavior tracked for advertising purposes.
Frequently asked questions
Is Strava's Terms & Conditions agreement fair?
- BeforeYouClick grades Strava E on an A–E scale, where A is the fairest. Its agreement contains 7 critical clauses, 10 warnings and 3 good practices.
What are the biggest problems with Strava's terms?
- The most serious clauses we flagged are: Forced Arbitration and Class Action Ban, Your Identity Used in Ads Without Pay and Perpetual License on Public Routes and Segments.
How long does it take to read Strava's terms?
- Strava's agreement takes about 54 minutes to read in full, across 20 clauses we reviewed. The summary on this page covers the same ground in under a minute.
When was Strava's agreement last analyzed?
- We last read Strava's Terms & Conditions on August 1, 2026. Companies change their terms without notice, so check the original document for the current version.
Is this analysis legal advice?
- No. This analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original agreement before you agree to it.
More agreements to read
- PosteoProductivityGrade A
- Mullvad VPNSecurityGrade A
- MurenaSecurityGrade B
- TutaProductivityGrade B
- NordVPNSecurityGrade B
- TelegramMessagingGrade C