Strava is a fitness-tracking app launched in 2009 with around 100 million users by 2026. Tracks runs, rides, and other workouts with GPS, plus social features (followers, kudos, segments). The Global Heatmap aggregates anonymized workout data into a public visualization showing where Strava users exercise; the granularity is high enough that individual routes and times are inferable, particularly in low-density areas where one user’s pattern is the dominant signal.
What it means in practice
The 2018 Strava heatmap controversy exposed US military forward operating base layouts: aggregated workout data revealed running tracks inside otherwise unmapped facilities in Iraq, Syria, Afghanistan, and Niger. The same architecture applies at individual scale. A target’s Strava history shows their daily routine: where they live (the cluster around morning runs from a specific starting point), where they work (the lunch-time runs from the office), the schools their kids attend (the after-school routes), the houses of friends and lovers (anomalous routes with non-routine starting points). The privacy controls exist (Strava Privacy Zones hide a configurable radius around designated points, Privacy Settings limit data visible to followers vs the public), but most users do not configure them, and the heatmap aggregation is opt-out rather than opt-in for the data contribution.
Who uses the data, and against whom
Used adversarially by: stalkers reconstructing daily routines, doxxers identifying home addresses through running starting points, military adversaries using the heatmap for facility identification, and (in documented cases) divorce private investigators correlating workouts with location patterns to support custody arguments. Used legitimately by: researchers studying urban running patterns, city planners using the heatmap to design bike infrastructure, individual users tracking their own progress. The Predaxia editorial frame: Strava is a privacy-relevant surveillance vector for any user with a daily routine that includes outdoor exercise, particularly military families during deployment, journalists with home-address sensitivity, and high-conflict-divorce parents whose movements may be discovery material.
What you can change today
Three settings, ten minutes. First, Strava Privacy Zones: Settings, Privacy Controls, Privacy Zones, add zones around your home, your office, your kids’ schools (the zone hides a 200m to 1km radius around the marked point on the public-visible map). Second, default activity privacy: Settings, Privacy Controls, Activities, set to “Followers” or “Only You” rather than “Everyone”; this controls who sees future workouts. Third, opt out of the Global Heatmap contribution: Settings, Privacy Controls, Aggregated Data Usage, turn off Heatmap Contribution. For high-target users: consider whether Strava is the right tool at all; the social-fitness use case may not be worth the cumulative data exposure for users in sensitive professions or situations.