Strava retains your personal information for as long as your account is active and for a period after account deletion, with some data retained longer to comply with legal obligations or resolve disputes.
Data retained after account deletion means your location and health information may persist on Strava's systems even after you believe you have removed your data.
Indefinite or extended post-deletion data retention raises GDPR Article 5(1)(e) storage limitation compliance risks and conflicts with CCPA deletion rights if not adequately scoped. Retention schedules should be reviewed for proportionality and documented in data processing records.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Strava collects highly sensitive personal data including precise GPS routes, heart rate, sleep data, and other health metrics, which may be used to train AI/ML models and contribute to publicly accessible features like the Global Heatmap. Health data from connected devices will not be sold or used for advertising, but activity data can be shared in aggregated or de-identified form and used for AI development. You can adjust your privacy and visibility controls in the Strava app under Settings > Privacy Controls to limit how your data is shared and used.