Strava: Run, Bike, Hike

"We collect information (including Activity Data) from devices and apps you choose to connect to Strava, such as your Garmin device, Peloton account, or Apple Health app. This could include, for example, step count, sleep information, heart rate, HRV, or VO2max. We collect technical information from the browser, computer, or mobile device used to access the Services. This includes device and network information, log files, and analytics information."

Strava collects extensive device data including health metrics like heart rate, HRV, VO2max, and sleep information from connected devices, plus broad technical device information from browsers and mobile devices.

"We collect or infer location information when you sign up for and use the Services. For our core features to function (e.g., GPS activity tracking, routes, segments), you must grant us permission through your device to track your device's precise location. We also use your live location data, which you may choose to share with other users, such as when using Strava Beacon."

Strava requires precise device location tracking for core functionality and collects live location data. Location information is also used for advertising, shared publicly by default, and used to generate global heatmaps.

"Strava reserves the right to modify this Policy at any time. If we make changes to this Policy, we will post the revised policy and its effective date on our website. If you object to any changes to this Policy, you should stop using the Services and delete your account."

Strava can change its privacy policy unilaterally at any time, and users who disagree have no recourse other than deleting their account and leaving the platform.

"We collect, use, and disclose information through the use of cookies, tracking pixels, SDKs, Google Analytics, and other third-party tracking technologies for security and authentication, to understand and improve your experience, perform analytics, inform and serve relevant ads. We may share your information with third parties to support, improve, promote, and secure the Services."

Strava embeds third-party SDKs, tracking pixels, Google Analytics, and other technologies that collect data directly from users' devices, and shares information broadly with service providers, partners, and advertising networks.

"We retain information as long as needed to provide the Services, subject to our legal obligations. We generally keep information associated with your account until you delete it or we no longer need the information to provide the Services. Following deletion of your account, it may take up to 45 days to delete your personal information and system logs from our systems."

Strava's retention policy is vague — data is kept indefinitely until the user actively deletes their account, with no defined maximum retention period. Even after deletion, data may persist for 45 days.

"We collect, use, and disclose information through the use of cookies, tracking pixels, SDKs, Google Analytics, and other third-party tracking technologies. We may collect information about you from our corporate family of companies, including our affiliates and subsidiaries. You can sign up and log in to the Services using accounts with other businesses, such as Google or Apple ("Third-Party Accounts"). If you access the Services through Third-Party Accounts, we will collect information such as your name, email address, profile information, and preferences."

Strava tracks users across devices and services using cookies, pixels, SDKs, and data from third-party accounts and corporate affiliates, enabling cross-service profile building.

"Following deletion of your account, it may take up to 45 days to delete your personal information and system logs from our systems. We do not have control over content you have shared directly or publicly with others, such as photos or videos on other social media platforms, or that others may have copied. Public segments and routes will also remain available."

Account deletion takes up to 45 days to complete, and certain data like public segments, routes, and content shared with others persists indefinitely even after deletion.