Strava Privacy Policy

Strava's 2026 Privacy Policy governs the collection, use, and sharing of personal information across its platform, mobile applications, and services, with Strava acting as a data controller or 'business' under applicable frameworks including GDPR, CCPA, and analogous state laws. The policy states that Strava collects a broad range of data including precise GPS location, health metrics (heart rate, HRV, VO2max, sleep data), biometric performance data, device identifiers, payment information, and contacts, and the terms authorize use of this information for AI and machine learning model training, advertising through third-party partners, and contribution to a publicly visible Global Heatmap. Notably, the policy asserts that health data collected from connected device integrations will not be sold or used for advertising, representing a meaningful carve-out, but the terms separately authorize use of personal information including health and location data for AI Features depending on user privacy controls, creating operational ambiguity about the boundary between these commitments. The policy engages GDPR for EEA users (citing Standard Contractual Clauses for international transfers), CCPA and related US state privacy laws (with a dedicated state notice and a separate Consumer Health Data Policy), and Washington State's My Health MY Data Act based on the Consumer Health Data Policy reference. Compliance teams should note that the breadth of data collected, the use of location and health data for AI development, and the aggregation of activity data into publicly accessible features such as the Global Heatmap may require evaluation under sensitive data provisions in multiple jurisdictions.