Strava App Shows Your Info to Nearby Users Unless this Setting is Disabled

Popular running and cycling app Strava can expose your information to nearby strangers, which has sparked privacy concerns among its users.

After learning of this information sharing feature, some fear this functionality can be abused for stalking and “predatory” motives.

Previously, Strava had published heatmaps generated from 13 trillion GPS coordinates from joggers’ data, which inadvertently exposed the locations of military bases around the world, including those in the U.S.

Exposes full name, picture, running routes of strangers

This week, Andrew Seward, Head of Data Product Development at Experian, brought to light how Strava exposed sensitive information on nearby runners.

“Out running this morning on a new route and a lady runs past me. Despite only passing, when I get home Strava automatically tags her in my run,” tweeted Seward.

“If I click on her face it shows her full name, picture and a map of her running route (which effectively shows where she lives),” he continued.

According to Seward, this information was shared, although he did not know who the stranger was, and neither of them followed each other on the app.

The incident sparked concerns among users on Twitter about how the feature could be abused by stalkers and “predators” for identifying Strava joggers in their vicinity. 

A user named Ken Wynn tweeted, “Looks very intentional to encourage flybys to stay public. The only privacy setting means you can’t see your own either, and its the only setting which doesn’t have the third ‘followers’ option. Also scary is ‘anyone on the web’ so not just via the Strava platform?”

Shortly, Seward showed that many of the app’s privacy settings defaulted user information visibility to “Everyone.”

Also Read: The PDPA Data Breach August 2020: A Recap of 8 Alarming Cases

Further investigation by Strava users revealed that this spillage of user information was being caused by the default privacy settings for “Flyby” being set to Everyone.

Flyby is a Strava feature that lets cyclists and runners playback their recorded activity and see others near them on a map and timeline.

As Flyby’s default setting is to share your activity with all nearby people, anytime you run or cycle past another Strava user, your information will be exposed.

These privacy concerns come shortly after Strava’s incorrect location data had inadvertently pinned an innocent man to have been present at a crime scene earlier this year.

Series of events such as these have certainly caused trust issues among the online community.

“Even if you turn this setting off, I wouldn’t trust them not to pull a Facebook and set it back on by default in an app update. They could also totally reorganize the settings without warning you, in order to be maximally obfuscatory,” tweeted yet another user.

How to prevent Strava Flyby from sharing your activity

To prevent Strava Flyby from sharing your information with other users, please follow these steps:

1. Login to Strava.com.
2. Once logged in, click on the drop-down arrow next to your profile picture and click on Settings.
3. Click on Privacy Controls.
4. Under Flyby, click the drop-down arrow and select ‘No One‘ and then press ‘OK,‘ as shown below.Flyby settings
   Source: BleepingComputer

Also Read: 10 Practical Benefits of Managed IT Services

With Flyby set to ‘No One,’ your personal information and activity will no longer be shared with other nearby Strava users.

Strava now reportedly prompts you to adjust privacy settings

Shortly about Seward’s Twitter thread, another user Charlie Brown tweeted the company had now put a privacy settings link in his Strava feed.

In an age of stricter data privacy laws and increasing data breaches, consumers expect tech companies to provide basic controls and features that guard consumers: by enhancing their privacy and security and not working against these tenets.

In the case of Strava, it seems, the expectation is put on the user to adjust their privacy settings, or risk having their private data exposed to strangers.